Gamifying Developer Education with CTFs
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 11:45· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Organizers run a week-long internal CTF during security awareness month to teach real failure modes: web flags, forensics captures and Slack-specific puzzles, plus trivia. They deploy challenges on DigitalOcean using Facebook CTF + DigitalOcean + Slack for delivery and coordination, use PhantomJS to verify real XSS exploits and recommend Wireshark and hashkiller for exercises. Participation exceeds expectations across offices, four individuals finish all challenges, and organizers scramble to add harder tasks after they run out of challenges, while facing caching, sandboxing and prize-shipping issues.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:31Max Feldman
- 1:27Security Development Lifecycle
- 3:08Security Education
- 5:25Ctfs
- 8:25Cyber Grand Challenge
- 9:34The Pros and Cons of Running a Ctf for Education
- 10:17Cons Are of Running Ctf
- 14:27What Is It Like To Administer a Slack Team Securely
- 17:22Trivia and Sleuthing
- 19:30Forensics Challenges
- 20:54Web Application Flags
- 24:55Things That Worked
- 28:11Lessons Learned
- 37:50Do You Plan To Do this on a More Regular Basis
related talks
47mGaining experience through CTFs
23mGrowing Your Skillset with Capture the Flag
46mCapture the Flag for Developers
20mPlay, Learn, Secure: The Power of Gamification in Security Training
16mThe Dungeon Master: Mastering Cybersecurity by Building CTF Challenges
01h 57mSecurity Competitions
14mClosing + CTF Wrap Up
24mHALT AND CATCH FIRE: Social Engineering CTFs for fun to a job as a...