Linux Headache Is Latest Cyber Security Challenge

The ongoing Cyber Security Challenge (CSC) UK competition has broken new ground with a task involving the Linux and open source environment: the Sophos Linux Forensics Challenge.

Anti-malware company Sophos was asked to devise a test after last year’s competitors were polled for ideas. The challenge, which ran on August 27, required the candidates to detect hacker activity on a specially prepared Linux platform.

Embattled Corporate Linux Infrastructure

The task’s development team, under James Lyne, director of technology strategy at Sophos, created a simulation of a real corporate environment facing a cyber-attack which required prioritised actions to be implemented to fend off the hackers.

Successful defence may have been the aim but the clock was running as the competitors battled to repel the attack. Their efforts are being marked on the correct prioritisation of their actions and the speed with which they were implemented.

“A lot of the recent highly publicised data breaches have occurred on applications running on Linux,” Lyne said. “Because of a lack of ‘malware’ compared to other platforms, companies assume that these systems are eminently secure and entrust them with their most sensitive data. However, in reality, the dangers are still there, they are just different from those faced by conventional PC systems.”

He explained that, with so much important data being entrusted to Linux systems, the future of UK businesses is at stake and open source skills are constantly being sought as companies recruit security professionals. The problem is in identifying these skills because they are rarely taught adequately in schools and universities. The landscape is changing all the time and keeping up with the rate of change is difficult.

“Without a formal academic path, it’s difficult for employers to identify those with the right skills and for potential employees to demonstrate they have them,” Lyne said.

This is the crux of the Challenge, its dual aims are to raise awareness of security as a compelling and lucrative career, plus uncovering the hidden talent out there. To unearth those with the innate skills, the CSC competition is open to anyone and last year was won by a postman who is now training for a career in security.

The new Linux segment has proved extremely popular. Judy Baker, director of Cyber Security Challenge UK said, “In their feedback, many candidates suggested that we develop a competition on Linux. With employers searching for people with expertise on these systems, we knew we had to put something together and Sophos took up the baton. When we announced the Sophos Linux Forensics Challenge all 100 initial places were filled almost immediately and we have had to add [100] extra spaces to meet the demand.”

Fresh Challenges Appearing All The Time

When the challenge judges have reached their conclusions, the overall winner of the forensics test will be awarded a career-enhancing prize which will be revealed later.

Along with other successful candidates, the winner will then be entered to the next stage of the competition, the Sophos Malware Hunt, in January, 2012. Here, the candidates will be asked to identify and explain the behaviour of a range of real malicious code, from the vaults at SophosLabs, as they bid to prevent data theft and system failure.

Apart from this Sophos-led thread, there are other competitions and mini-challenges being devised and run by CSC’s other major sponsors, which include Cassidian, HP, Qinetiq, SAIC and the SANS Instuitute. The Cabinet Office and PwC also play key sponsorship roles.

The winners of each division will meet in live head-to-head and team trials at the Grand Final next year to determine the UK Cyber Security Champion 2012.