Potential Skills List

[roseregina]

This is a list of what skills we want to give people an opportunity to work on

[seamustuohy]

Incident Detection

• CON

  • false sense of security
  • can't be exaustive
  • incredibly contxt specific for IOC
  • privledge certain communities over others
  • may not align with needs of participants
  • not super helpful if working in orgs where they automate this skill
  • somewhat jumping the gun
  • also covered in advice, etc.

• PRO

  • Can't be exaustive on anything
  • Proper positioning will not make false sense of security
  • Malicious email identification is the CORE skill
  • TODO: ensure that we provide problems/challenges that are broad and representative
  • May need windows devices to support people give it a try
  • TODO: Do most/all excesizes assuming a windows end-user

Incident Response

• Con
  • incident resp examples that are concise enough to be valuable is going to be hard
  • technical skill needs to be much higher
  • failure is harder to identify
• PRO
  • becasue hard we need to give an oppourtunity to try it in a no stakes environment
  • only way to develop competencies is to develop them
  • this is something that our folks ARE going to do weather on not we provide support
  • They have experience, but don't know they have experience and this highlights their exp and builds comfort and efficacy in the space.

Evidence Collection PRO

• for IR providers
  • This is where many IR support events fail. they can't find the source and this allows the initial infection/vector to survive. This leads to possible persistance and failutre to detect possible similar incidents in the future (no vulnerability identification in the post-incident response).
• Researchers
  • Sanatizing evidence from a vulnerable population to pass on to a researcher is critical because oftentimes the trust relationship between the CS-respoder and the actor is different than the security/privacy provided by the researcher who is using the evidence. (informed consent with no duty of care)
• Human rights documentors
  • Evidence collection with an understanding of evidence preservation in a forensic and legal sense is something that supporting HRD MAY need and is valuable to think about and have in the backs of their mind as they encounter evidence. Also, how to collect advocacy narratives and human evidence alongside the technical artifacts.
• Attribution vs. Addressing Issue vs. Changing Conditions/advocacy

• CON

  • We only have so much time
  • None of the structures that make this usable are in place for the orgs we are woring with
  • Pipe dream, will make folks sad
  • Not useful
  • When we start looking at collecting evidence. They quickly jump to attribution. None of us are at a point to do attribution on these topics. Talking attribution on these topics.

• PRO

  • By making MOST the narratives include commonplace petty theives we can actually help combat this narrative.

Collaboration with existing security for civil society community

• PRO

  • None have social skills and we all need practice
  • Provides comfortable spaces for folks who see themselves as non-technical
  • Solid flag that is accomplishable and help them keep moving
  • Could you score in the top prize winning tier by just being awesome at collaboration?
  • In real life yes. Should it be in the CTF?
  • How do we make this happen?
  • The most important thing we can do to normalize a non-rockstar approach to security!
  • Baddies are all sharing stuff so we need to as well or we won't keep pace
  • So used to working in silos that we won't gain skills if we don't use them
  • We lack financial and/or time resources to pursue skill development and education in non-cooperative means

• CON

  • This is about skill building not making people feel good about not having skills
  • people shirk responsibility for learning this shit all the time and it leaves me and a few others addressing everyones problems in our free time and I'm burning out, others have already burned out, and some poeple have a closet full of harddrives that they will never get to for civil society actors. So, they will never be useful for protection, advocacy, support, or otherwise.
  • Comfortable space for LEARNING, not for eating cookies and talking
  • Silos are bad, that's why we have TEAMS. They collaborate by participating why score them on something they are getting scored by their getting flags?

• PRO

  • Fuck you seamus! - Rose Regina
  • par to this is making a place where people feel like they can learn
  • part of this is reminding them of their ability to feel sucessful
  • First, we confirm their existing skills and then we teach them new things
  • Can we incorporate the participants in training others on skills as a way to get flags?
  • There is no good mechanic identified for this yet.
  • How do we encourage cross-team collaboration?
  • Special flags that are only obtained by cross team collaboation.
  • Like some of the semi-collaborative games
  • (mode in block-by-block game): All of you can lose together, but only one of the players can win.
    • Best metaphor for security for civil society space EVER!

Documentation

• PRO

  • It means you have taken the time to understand and clarified the problem in your own mind
  • It serves a reflection prupose that is directly connected to your
  • First step for communicating for the people you work with
  • About keeping internal records so when you get hit by a bus that there is insitutional knoweledge (continuous narrative)
  • never have I ever think that wiki's are a radical act of self preservation

• CON

  • half impossible to eval these because we won't have enough people to read them
  • puts non-english as a first language players and folks with learning dissabilities at a HUGE disadvantage
  • longform writing can be a problem yet they may be phenominal at in-person or short form so a specific format of response is just not appropriate
  • Why not make this about properly contributing to an existing resource (issue, commit, email, etc.) so they build their communit wide documentation skills?

• PRO

  • not inherently longform
  • anything should be able to be written as a series of bulletpoints
  • easy to spew endlessly, so the best option is to give word limits. Manageable for us, and make it not about nice prose, but cocise and clearly putting the info down.

Search Engine security/troubleshooting Skills Stuff (Support)

• PRO

  • no one teaches this, it's the skill that anyone can do and provides the best bang for our buck to stop people from asking for the answers to questions that are very easily found if you know how to look for them.

• CON

  • ARGH if this is not something someone is already doing why are they participating in this CTF.

Search Engine Skills Stuff (OSINT)

• PRO

  • people don't know how much info is out there on themselves or their orgs and don't knwo how easy it is to find.
  • the first thing we need to teach folks around privacy preservation and OPSEC is how to see just how vulnerable they (or our "victims" are).

• CON

  • Folks will cyber-stalk attendees
  • It is an endles pit and there is no "im done"
  • It is utterly terrifying and upsetting and we want participants to sleep
  • It's very likely to be miscommunicated to other people at the event that makes non participant attendees uncomfortable.
  • too much time with osint makes one paranoid

• PRO

  • Can be used to teach around risk assessment and investigating adversarial capabilities and intent in a way that does not require someone else to write a journalistic piece about. If folks don't know how to search for threat intelligence they weill be reliant on the most publicly announced threats that are news-worthy, but not necessarily accurate to the real threats they face. Not everything is a zero day, but to an activist this is what the news and reports by our space say everything is.

• CON

  • Should make it optional
  • Every part of the CTF we should have a clearly understandable description of activities so that folks who hear about it understand what the reasoning is. This will let us cut short objections.
  • Just don't do the personal OSINT to DOX self/persona at all.

[seamustuohy]

Risk Assessment:

• Appropriate for Threat Requirements?
  • Example: Technology Evaluation: Conduct an rough evaluation of if a software tool meets the security, privacy needs of a requester.

Respecting Requester:

• Adhering to Requirements/Standards
  • Example: A Technology Evaluation where they conduct an rough evaluation of if a software tool meets the privacy requirements identified by the requester.

Utility:

• Guidance Evaluations
  • Does guidance provided meet the utility requirements of a requester.
  • Does guidance/advice respond to the capacity / capabilities of the requester

Psycho-Social Skill:

• Dealing appropriately with vulnerable/traumatized folks
• Conveying information in actionable way
• Avoids fear mongering

Accessability:

• information is easy to understand and concise

Incident / Event Detection

• It's the FIRST STEP
• Example: Malicious email identification is the CORE skill
• Users need to know how to search for the technique for a device/program they are unfamiliar with.

Incident Response

• We need to give particpants an oppourtunity to try IR in a no stakes environment
• This can feel impossibly hard, so giving wins and examples of minimal interventions is solid.
• This is why we have the "help desk" to help them identify specific things they can do minimially
• Some incident response is about isolation and evidence collection not about fixing and that is CRITICAL for ensuring that incidents are halted and evidence properly collected to allow the incident responders in the space to truely address the issue.

Evidence Collection

• for IR providers AND researchers AND human rights documentors
• By making MOST the narratives include commonplace petty theives we can actually help combat this narrative.
• Some incidents from semi-organized malicious non-state actors to identify increasing threat
• VERY small number of "shiney" nation state attacks, if any.

Collaboration

• A team should not be able to get in the winners circle without collaboration.
  • Should a team be able to score in the top prize winning tier by just being awesome at collaboration? Maybe, but they would be absolutely stellar!
• How do we encourage cross-team collaboration?
• Can we incorporate the participants in training others on skills as a way to get flags?
• Submit a well documented, amazingly written, and properly formatted issue (or double flags for fixing/contributing to an existing issue) on an open source secutriy project for a bug that actually exists. (Jon/Gus?)
• Threat Information Sharing

Documentation

• Give word limits.
  • Manageable for us,
  • not about nice prose,
  • It's about concise and clearly putting the info down.
• First step for communicating to the community you work with
• About keeping records so when you get hit by a bus that there is a continuous narrative/knoweledge
• Can we also make this about properly contributing to an existing resource (with git[lab/hub] issues, actual commit, email to people, etc.) so they build our community wide documentation skills and identify issues in existing documentation that is OUT OF DATE AGAIN!

Search Engine security/troubleshooting Skills Stuff (Support)

• no one teaches this, it's the skill that anyone can do and provides the best bang for our buck to stop people from asking for the answers to questions that are very easily found if you know how to look for them.

Search Engine Skills Stuff (OSINT)

• OSINT on IOC, websites, and emails
• OSINT on organizational fronts/is the org legit or shady

[blackswanburst]

I find this thread very inspiring for creating puzzles. Each one should aid one of the skills above.