ECSC 2018 Analysis Report

DECEMBER 2018 About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contact

For queries in relation to this paper, please use ecsc@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

Acknowledgements

We would like to thank our colleagues at Cyber Security challenge UK for taking care of all local logistics for the organisation of ECSC’2018 and in particular Ms. Debbie Tunstall and the colleagues at BT that provided the technical support throughout the event.

Our gratitude is also extended to our colleagues Razvan Gavrila and Adrien Ogee for their contributions to the success of the European Cyber Security Challenge. Finally, we would to thank all our colleagues’ responsible for the national competitions and the preparation of the teams that participate at the ECSC. Without their untiring efforts this competition will not be possible.

Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged.

Table of Contents

Executive Summary 4

1. Introduction 6 ECSC Background 6 ECSC Setup 7

2. ECSC Attendance Evolution 8

3. ECSC 2018 hosting country 9

4. ENISA Contribution to ECSC2018 10 Steering Committee Management 10 Jury Management 10 Presentation management 12 Deployed Platforms 12 Scoring Platform (Score board) 13 Competition Challenges 13 Bandstand 16 Public affairs Strategy 17 Social media impact 18 VIP program support 19 International Engagement 19

5. Final results 20 Post event activities 21

6. Lessons learnt 23 Governance and decision-making 24 Public Affairs 24 Challenge 24 Logistics 26 Side Events 26 Compliance 27

7. Maturity assessment results 28

8. ECSC 2019 29

Executive Summary

The 5th Edition of the European Cyber Security Challenge, ECSC2018 was hosted in London during 14th to 17th October. The event was organised by the Cyber Security Challenge UK at the Tobacco Dock, an iconic grade one listed building which has a rich history. The event was hosted together with the job fair Cyber Re:coded.

Each country was represented at the ECSC final by a team of 10 contestants, comprised of the winners of the national competition. Half of the team members are within the range of ages of 14-20 years old and half in the 21-25 range. In total, 200 people (contestants, coaches and judges) representing 17 EU and EFTA countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, and United Kingdom) competed in the ECSC final in London. The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hacked hardware systems. However, technical skills are just one part of the whole story. Teamwork and presentation skills were also evaluated. The complete skillset which is important for working in an IT security team, is thus tested. The finalists of ECSC 2018 were the teams from Germany, France and UK.

ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: ECSC main website, ECSC planning platform, public affairs strategy, challenges creation, governance framework of the competition, secretariat support, etc…

In order to ensure appropriate and transparent reporting to the Steering Committee ENISA, the following key observations were made by independent third-party observers that have attended the ECSC planning meetings and the actual event. These observations have been produced based on the feedback collected from participants, members of the ECSC Jury, members of the ECSC Steering Committee, and attendees to the event. In addition, these observations reflect the feedback provided by organisers and participants collected by an online evaluation survey:

 The venue, accommodation and logistics provided by Cyberchallenge UK has been very well received by participants. The venue was very well aligned with the theme of the challenge and provided for adequate facilities to support the event.  The technical infrastructure supporting the challenge has significantly improved as compared to ECSC2017. The service providers contracted by Cyberchallenge UK delivered a relatively stable, state-of-the-art and reliable infrastructure. Some opportunities for improvement have been noted, but overall the user experience was positive. Some infrastructure challenges have affected the course of specific individual challenges (e.g. King of the hill, Capture The Flag), which is a key lesson learned to take into account in future editions.  The platform developed by ENISA to support the challenges in the format of contracts was received well by the participants and organisers as it facilitates a real-time scoreboard that is also accessible to the public over the ECSC website (www.ecsc.eu).  The Public Affairs activities conducted by the national teams, the organisers and ENISA have gained significantly in exposure, reach and engagement. To put things in perspective: #ECSC2017 had a total estimated social media reach of 199 913, compared to 5 062 457 for #ECSC2018.  Exposure towards traditional press and media, as well as potential sponsors, national representatives, and private entities has significantly increased. ECSC2018 welcomed several political representatives of EU Member States thereby supporting the objective of bringing

nationalities together and foster a pan-European spirit in the realm of the European Cyber Security Challenge. The 2019 edition of the European Cyber Security Challenge will take place in Bucharest Romania, in October 2019.

1. Introduction

The growing need for IT security professionals is widely acknowledged at European level. To help mitigate this shortage of skills, many countries launched national cyber security competitions addressed towards students, university graduates or even non-ICT professionals with a clear aim:

‘Identify new and young cyber talents and encourage young people to pursue a career in cyber security.’

The European Cyber Security Challenge (ECSC) https://www.europeancybersecuritychallenge.eu/ leverages on these competitions by adding a pan-European layer. Top cyber talents from each participating country meet to network and collaborate and finally compete against each other. Contestants are challenged in solving security related tasks from domains such as web security, mobile security, crypto puzzles, reverse engineering and forensics and in the process collect points for solving them.

In a nutshell, ECSC is the annual European event that brings together young talent from across Europe to have fun and compete in cyber security. Its main aim is to highlight the importance of the national competition.

ECSC Background

The project was initiated under the umbrella of the EU Cyber Security Strategy (Feb 2013):

‘The European Commission will organise, with the support of ENISA, a cybersecurity Championship in 2014, where university students will compete in proposing NIS solutions.’

As of 2014, ENISA has been supporting the organisation of the ECSC. ENISA is actively organising the meetings of the governance structures, supporting the development of the competition rules and games and it is also part of the ECSC Jury. As of 2016, ENISA is the acting secretariat of the ESCS Steering Committee.

In 2017, 15 countries attended (Austria, Cyprus, Czech Republic, Denmark, Estonia, Germany, Greece, Ireland, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland and United Kingdom). The ECSC2017 st nd took place between the 31 and 2 November in Malaga, Spain. The winner of the final was Spain.

In the edition of 2018, held during 15-17 October 2018, 200 people (contestants, coaches and judges) representing 17 EU and EFTA countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, and United Kingdom) competed in the ECSC final at London. The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hack hardware systems. However, technical skills are just one part of the whole story. As time and resources were limited, teamwork and presentation skills were also evaluated. The complete skillset which is important for working in an IT security team, is thus tested. The finalist of ECSC 2018 were the teams from Germany, France and UK. By 2020, ENISA expects to have more than 25 countries involved in the ECSC.

The 2019 edition of the European Cyber Security Challenge will take place Bucharest Romania, in October 2019.

ECSC Setup

Each country is represented at the ECSC final by a team of 10 contestants, comprised by the winners of the national round. Half of them are within the range of ages of 14-20 years old and half in the 21-25 range.

Two preparatory pilot phases of ECSC have been held in 2014 (in Austria) and 2015 (in Switzerland) with attendance by 3 and 6 countries, respectively. Since 2015, ENISA is lending its experience and position to coordinate and organise the ECSC effort to reach its full maturity by 2020.

The activities of the ECSC are supervised by a Steering Committee, composed of representatives of the attending countries. ENISA facilitates the meetings of this group and provides strategic guidance. The decision making processes are described in the ECSC Charter, which is approved every year.

ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: the ECSC main website, the ECSC planning platform, the public affairs strategy, challenges creation, etc…

In addition, ENISA is working closely with the host of each edition, in order to ensure appropriate and transparent reporting to the Steering Committee.

During the year, two Steering Committee meetings are held prior the execution of the event:

ENISA organised these preparatory events and was overall responsible for the efficient running of the project, including meetings minutes and the follow-up of the proposed actions.

2. ECSC Attendance Evolution

From the first edition of the ECSC in 2014 the evolution of the attendant’s countries has been the following:  2014 [3]: Austria, Germany, Switzerland  2015 [6]: Austria, Germany, Switzerland, Spain, Romania, United Kingdom  2016 [10]: Austria, Estonia, Germany, Greece, Ireland, Liechtenstein, Romania, Spain, Switzerland, United Kingdom  2017 [15]: Austria, Cyprus, Czech Republic, Denmark, Estonia, Germany, Greece, Ireland, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, United Kingdom  2018 [17]: Austria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Italy, Liechtenstein, Norway, Poland, Romania, Spain, Switzerland, United Kingdom

25 20 15 10 5 0

3. ECSC 2018 hosting country

The 5th Edition of the European Cyber Security Challenge, ECSC2018 was hosted in London during 14th to 17th October. The event was organised by the Cyber Security Challenge UK at the Tobacco Dock, an iconic grade one listed building which has a rich history. The event was hosted together with the job fair Cyber Re:coded.

The organization provided different useful information about how to get to the event from the selected hotel and the different facilities provided during the execution of the competition. Also, different activities were performed for the participants:

4. ENISA Contribution to ECSC2018

Steering Committee Management

The activities of the ECSC are supervised by a Steering Committee, made out of representatives of the attending countries. ENISA facilitates the meetings of this groups and provides strategic guidance. The decision making processes are described in the ECSC Charter, which is approved every year.

During the preparation of ECSC 2018, ENISA was responsible for the following activities related with the management of the Steering Committee:

 Planning Platform maintenance and update  Mail list management  Organization of the IPC in Brussels  Organization of the MPC in Athens  Hot wash meeting after the execution of the competition in London  Feedback collection: Lessons learnt report and surveys to the participants

Jury Management

A jury body was established during the competition: A jury member is appointed from each of the members of the ECSC’s Steering Committee, once this is set, it will resolve any dispute during the competition.

The following improvements were implemented this year:

1. A “Jury guidelines” document was created, summing up the most important points to take in to account. The Jury members and captains from all teams could use this document as a reference. 2. Jury meetings were scheduled at regular intervals in order to improve the efficiency of the competition: Jury members meet at predefined times during the competition to discuss and resolve complaints and queries received during the period in between two jury meetings. Also, a framework was created in the case an “extraordinary jury meeting” was necessary for issues that may affect severely the running of the competition. 3. Creation of a Jury coordinator role: In charge of acting as a PoC, receiving and collecting complains from participants, captains and jury members. 4. Definition of a clear workflow in case of complaints. The workflow is depicted in Fig. 3.

In general, during the competition the role of the jury was:

 Attend jury meetings  Resolve disputes with impartiality  Attend and evaluate presentations  Attend to any other issue that may need the expertise of the jury.

Presentation management

For ECSC 21018, ENISA proposed new guidelines and rules for the presentation of the contracts (“ECSC contract presentations guidelines”). During the event, the teams had the chance to present a contract of their choice, earning additional cash rewards. The final grade varied between:  Good ( extra 40% cash reward of the selected contract)  Very good (extra 50% cash reward of the selected contract)  Excellent (extra 60% cash reward of the selected contract) All the 17 teams presented during the competition with the following grades:

Deployed Platforms

For the planning, testing and execution of the ECSC, ENISA supported the development of the competition by deploying different platforms:  Planning portal: https://ecsc.enisa.europa.eu.  Test Scoreboard and contracts platform: https://board.ecsc.eu  File Sharing platform (owncloud): Used for information sharing and contingency mechanism: https://storage.ecsc.eu/  ECSC 2018 Website: Promotion of the event. Real time scoring information was provided during the challenge to externals interested parties: https://www.europeancybersecuritychallenge.eu/

Scoring Platform (Score board)

In order to manage the scores and the contract resolution, ENISA coordinated the development of a new game board platform:

Also, onsite support by the main developer was provided during the challenge. The code of the platform was released to the community under EUPL licensing and can be found on Github (https://github.com/enisaeu/ecsc-gameboard). For ECSC 2019 is expected that this platform will be further improved and many changes requested and identified during the challenge will be implemented.

Competition Challenges

For ECSC 2018, 36 challenges or “contracts” were provided to participants during the two days of the competition divided in 110 different tasks, these includes activities involving different skills like Crypto, forensics, malware and artefacts analysis, reverse engineering, network forensics, hardware, mobile, steganography, and Capture the flag (CTF) challenges.

Challenges were provided by BT and ENISA. The final selection of challenges was done by the organisers. The Final list of challenges executed in the event was the following:

The teams managed to resolve more than the 95% of the tasks

Bandstand

As a novelty, an exterior bandstand challenge with an escape-room approach was introduced this year with a very positive feedback. The bandstand was set-up by BT and consisted in a physical challenge with 5 different associated tasks which the teams can choose to do but is not compulsory.

1. Bypass electronic access control 2. Disarm an intruder alarm using a number sequence challenge 3. Bypass some combination locks 4. Solve some hidden riddles which will be exposed by use of a UV torch 5. Using teamwork, disarm a device (wire cutting challenge)

This challenge was located just outside the main competition area and was manned by BT personnel.

Public affairs Strategy

The European Cyber Security Challenge (ECSC) Steering Committee decided per ECSC Charter to develop a Public Affairs Strategy for every edition. The main objective of this Public Affairs strategy is to create, distribute and manage a coherent information flow to inform relevant audiences and participating countries about the ECSC final. Moreover, the Strategy provides the input for the Dissemination plan that ensures coherent and synchronised communication.

These documents will contribute to the maturity enhancement of the European Cyber Security Challenge and increase brand exposure. This will draw interested parties from the private sector in context of sponsor opportunities and attract more countries and participants to enrol in future ECSC editions.

The hosting country and ENISA implemented the strategy for the first year and the participants were provided with an official media pack which included the lines to take, brand identity information and press releases. In addition, ENISA will provide a Dissemination Plan that facilitates timely and coordinated implementation of the strategy amongst all participants and ECSC stakeholders.

Social media impact

Together with the public affair strategy a social media report was created, collecting the reactions during the event, according to the report, some of the most remarkable facts regarding to social media impact were the following:

 Estimated social media reach over the 5 million  Over 17 thousands direct social media interactions  97,2% of positive mentions. The complete list of collected indicators is the following:

VIP program support

A program for VIP visits was supported by ECSC 2018 organization. In this context, the following VIP visits were received during the execution of the competition:

 Raffaele Trombetta, Italy's ambassador in the UK  His Excellency Lars Thuesen, Danish Ambassador to the UK  Brigadier Lars Christian Hedemark, Defence Attaché, Danish Embassy UK  Jakob Holm, Press Attaché at the Royal Danish Embassy in the UK  Guillaume POUPARD, Director general ANSSI

International Engagement

The head of the USA cyber challenge, Douglas Logan, attended as observer in order to find synergies for future collaborations and leverage the event to a more international scale.

5. Final results

The final results were the following:

Post event activities

As post event activity and, in order to promote the competition and the work that is done at national level, representatives of the winning team of ECSC 2018 were invited by the European Commission as VIP guests to the ICT 2018 event held in Vienna on 4th- 6th of December. The ICT conference and fair is the largest event of DG CONNECT taking place every three years. This year is organised under the auspices of the Austrian Presidency to the EU Council.

The representation of the team had the chance to take part in the following activities:

 VIP tour on the exhibition area together with key EU officials  Attend to different ICT conferences and participate in the Innovation and Startups forum  Meet with key cybersecurity stakeholders but also MEPs and other EU officials  Participation in the social event of the conference  Participation at a Facebook LIVE chat interview

6. Lessons learnt

A lessons learnt report has been developed by an external observer on behalf of ENISA. It takes into account the feedback provided by ECSC organisers, the ECSC Steering Committee, the Jury, and participants regarding to the following domains:

1. Governance and decision-making aspects 2. Public Affairs: Improvements on the social media communication strategy 3. Challenge: Aspects of the competition to be improved related to the development and setup of the challenge and exercises 4. Logistics: Aspects of the competition related with venue, catering, hotel, transportation, etc. 5. Side Events: Aspects of the competition related with social events and networking meetings 6. Compliance: Aspects of the competition to be improved related with compliance with laws and standards

ECSC2018 Lessons Learnt Report Governance and decision-making Public Affairs Challenge Logistics Side Events Compliance

7. Maturity assessment results

In order to measure the current status of the ECSC project, a maturity assessment on different areas was developed by an external contractor, the results on the report are the following:

Total

8. ECSC 2019

The final of the 2019 edition of the European Cyber Security Challenge 2019 will take place at Bucharest in October 2019 where, at least, 20 countries are expected to participate. The latest updates will be published on ECSC 2019 website: https://www.europeancybersecuritychallenge.eu/

ENISA

European Union Agency for Network and Information Security 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

Heraklion Office

Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

1 Vasilissis Sofias Str, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu