Sealing the Gap Between Physical and Logical Security
The exercise turned out to be an excellent learning opportunity for all involved, demonstrating weaknesses that plagued the CCDC defending teams as well as many organizations—the most notable issue being the gap between physical and logical security. In most organizations, the lines between physical and logical security are distinct and clear:
- Physical security watches the gates and ensures that employees and outsiders are not walking out the front doors with company assets.
- Logical security ensures that external entities and employees are not accessing information that exceeds their authorization.
But who watches that gray area between physical and logical security? No one! Even with the implementation of tools such as data loss prevention (DLP) and host-based intrusion detection systems (HIDS), most organizations lack strong policies and procedures that would enable them to identify and mitigate attacks by insiders.
Another lesson learned from the CCDC event was the need for schools to provide more education and awareness to their students. At the end of the exercise, the students were asked if any of their classes had provided training or awareness of the risks associated with social engineering or insider threats. All the students indicated that they had not received any information on this issue. Schools need to ingrain in students the importance of looking at information security from all angles—not just the bits and bytes.
Events like the annual Collegiate Cyber Defense Competition continue to be a fantastically fun learning exercise for students and security professional alike. The event provides a fast-paced and technically challenging environment where the next generation of security professionals can learn the complexities of their craft. During the exercise, the students may have been naïve about the risks of insider threats and social engineering, but it's a good bet that they'll be wiser from the event, and will take that wisdom with them as they move into the workforce.