The first Information Security Talent Search was held in 2003, organized by the Security Practices and Research Student Association (SPARSA) at the Rochester Institute of Technology in Rochester, NY. Beginning as a small, in-house competition for SPARSA members and RIT students, ISTS has grown to include teams representing numerous colleges from the northeastern, mid-atlantic, and midwestern regions of the United States. Each subsequent year of competition has evolved ISTS slightly, changing everything from the competition rules and structure, to the hardware and software used by the competitors. To this day, ISTS remains a completely student-organized and student-run competition.
In 2013, the 10th annual ISTS brought twelve teams, featuring representatives from RIT, the University at Buffalo, Alfred State University, Rensselaer Polytechnic Institute, Capitol College, and Eastern Michigan University. ISTS(x) also featured SPARSA’s first attempt at virtualizing the competition infrastructure. While this goal was only partially achieved, the foundation was put in place for a fully virtual competition in future years.
Each of the past ten years of the ISTS competition has brought some changes to our structure. Our current structure features teams of up to five college students (the “Blue Teams”), who are responsible for securing and defending a number of computer systems in a simulated enterprise infrastructure. Competitors are responsible for maintaining the uptime of certain “critical services” on their business infrastructure, which feature such applications as HTTP, HTTPS, SSH, FTP, Mail, etc. The team’s infrastructure is under constant attack from our “Red Team”, which is comprised of security industry professionals. Their objective is to gain control of, and either deny teams uptime on their services, or steal information from their systems.
The primary way in which ISTS differs from other security competitions is that “Blue Teams” are not only encouraged, but required to attack other “Blue Teams”. Roughly a quarter of a team’s final score is dependent on their success in attacking other teams. Other scoring components include the uptime and availability of critical services, completion of side challenges (such as lockpicking, cryptanalysis, reverse engineering, etc.), and the successful handling of business injects.
Competitors are given a team packet before the first day of competition, which features the backstory of that year’s scenario, as well as a (likely inaccurate) infrastructure topology. This is designed to give teams time to prepare a rough strategy before walking into the competition. However, as the packet often contains innacurate information, teams are encouraged to prepare for any number of possible scenarios.
The competition infrastructure is managed by a team of student volunteers, known as the “White Team”. These individuals spend much of the year leading up to the competition designing and implementing the competition infrastructure, and are responsible for managing the infrastructure, as well as general competition tasks during the weekend of competition. Being a member of the White Team grants individuals the unique experience of constructing and managing an enterprise-style infrastructure, which will be resilient to both attacks and high demand, all in a very short period of time. Additionally, White Team members will get an insight into both the creation and managing of competition activities. Those individuals interested in volunteering for the White Team should seek out a SPARSA e-board member at one of our weekly meetings, or send an email to make your interest known.
ISTS is held annually at the Rochester Institute of Technology in Rochester, NY. In recent years, the competition has been held in the RIT Center for Student Innovation. This venue featured a uniquely open layout, placing all of the teams in close proximity to one another, and added to the “arena” feel of the competition. However, recent renovations to the room have taken away a portion of the usable space, making it no longer feasible for an event the size of ISTS.
The SPARSA e-board is currently seeking a new home on campus for our competition, and an announcement will be made once the location has been officially determined.