1. No category

The National Cyber League – Where Cybersecurity is a Passion
2014 NCL Fall Season
Rules
Table of Contents
The NCL Season .................................................................................................................... 2
2014 NCL Fall Season ................................................................................................................... 2
Eligibility ......................................................................................................................................... 3
Competencies .................................................................................................................................4
Games: Capture-the-Flag (CTF) .................................................................................................5
Scoring.............................................................................................................................................. 5
Schedule of Events ........................................................................................................................ 5
Seasons .................................................................................................................................... 5
Mandatory Pre-Season Game/Assessment ............................................................................ 5
Regular Season: Optimized for Individuals ........................................................................... 6
Post Season: Optimized for Teams ........................................................................................... 8
NCL Rules of Conduct and Ethical Behavior ................................................................. 9
Professional Conduct ................................................................................................................... 9
Questions, Disputes, and Disclosures ................................................................................... 10
Game Conduct ............................................................................................................................. 11
Team Representatives .............................................................................................................. 11
Internet Usage ............................................................................................................................. 12
Scorebot Attacks......................................................................................................................... 12
Disabling Challenges/Puzzles ................................................................................................. 12
Collusion/Flag Sharing ............................................................................................................. 12
Laws ............................................................................................................................................... 13
Target Altering............................................................................................................................ 13
Solution Artifacts........................................................................................................................ 13
Scoring........................................................................................................................................... 14
1
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
The NCL Season
The NCL provides an ongoing virtual training ground for students to develop and
validate cybersecurity skills using content aligned with individual/team games and
professional certifications.
For example:
 Games are conducted using 100% cloud-based services – AKA the NCL Stadium
 Hosted lab exercises and games are based on widely adopted CompTIA
Security+TM and EC-Council Certified Ethical Hacker (CEH) TM performance-based
exam objectives
 The season includes a set of 20 Security+TM and 19 CEHTM virtual lab exercises
based on these certifications' performance-based exam objectives, which
students (AKA players) and faculty (AKA coaches) can access remotely from
anywhere to develop knowledge and skills
 Preparatory lab exercises and games help prepare students for the Security+TM
and CEHTM certification exams
 Games measure skills being developed in the NCL Gymnasiums
 3 geographic NCL Conferences to facilitate regional and national games among
players
 3 brackets support novice players (Bronze bracket), intermediate (Silver bracket)
and experienced players (Gold bracket)
 Games support individual and team play to develop cybersecurity skills as well as
soft skills (communication, collaboration, problem solving, critical thinking,
decision making, and time management)
 Developed, maintained and operated by dedicated faculty volunteers from
leading cybersecurity academic institutions with a passion for promoting
learning-based cyber games
2014 NCL Fall Season
The NCL will host preparatory exercises in its virtual Cyber Gymnasiums (powered by
NDG’s NETLAB) and games in a virtual Cyber Stadium (powered by iSIGHT Partners’
ThreatSPACE®), with challenges aligned to the CompTIA Security+TM and EC-Council
CEHTM performance-based exam objectives.
2
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
The 2014 NCL Fall season includes:
 39 virtual preparatory lab exercises, enabling players to develop knowledge and
hands-on skills any place, any time
 Mandatory Pre-Season game to identify players with similar knowledge and skill
levels; players will be placed in one of 3 brackets as follows:
o Bronze: novice players. Players will have limited existing knowledge and
skills and should be able to complete some or most of the preparatory
lab exercises
o Silver: intermediate players. Players will have an intermediate level of
knowledge and skills and should be able to complete all of the
preparatory lab exercises
o Gold: experienced players. Players will have the highest level of
knowledge and skills (e.g., have already completed relevant certifications
and/or completed more advanced study)
 Regular Season with 2 games optimized for individuals
 Post Season with a National Championship game optimized for teams
 Provide students with diverse skill levels, fun, and engaging learning and playing
environments available anywhere, any time
 Deliver lab exercises and challenging game scenarios tied to widely adopted
Security+TM and CEHTM performance-based exam objectives
 Prepare students for the Security+TM and CEHTM exams
 Measure how players perform in the games
 Give faculty opportunities to enrich classes by integrating lab exercises and
competitions into existing security-related curricula
 Stimulate individual cybersecurity skills development
 Create opportunities for soft skills improvements through team-based,
collaborative problem-solving
 Create school pride for players and coaches
Eligibility




Currently enrolled, full- or part-time undergraduate and graduate students at an
U.S. accredited 2- or 4-year college/university
All players must have a faculty/coach
The registration fee is $20 per individual participant for the Pre/Regular Seasons
and $25 per participating team for the Post Season
Players are expected to commit to the entire season
3
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion


There are no prerequisite skills for participation, but players should have a crosssection of beginner/intermediate knowledge and skills in computer science,
networking, systems administration, IT, and/or information security
For more information, visit
http://www.nationalcyberleague.org/eligibility.shtml.
Competencies
One of the distinguishing factors of the NCL is the integration of learning objectives in all
its activities. One of the main ways this is accomplished is by aligning the preparatory
lab exercises available in the NCL Cyber Gymnasiums with the games themselves. This
allows players to use the Gym environment to develop knowledge and skills and then
demonstrate these newly acquired skills in competitive individual and team play. It also
allows the NCL to measure player’s game performance and produce individualized
reports (AKA the NCL Scouting Report) on strengths and weakness amongst various
learning objectives.
The NCL lab exercises and games are designed to develop and validate the following
competencies:
1. Open Source Intelligence: Regular Season Game #1 and NCL National
Championship
2. Network Traffic Analysis: Regular Season Game #1 and NCL National
Championship
3. Log Analysis: Regular Season Game #2 and NCL National Championship
4. Scanning & Reconnaissance: Regular Season Game #1 and NCL National
Championship
5. Wireless Access Exploitation: Regular Season Game #2 and NCL National
Championship
6. Cryptography: Regular Season Game #2 and NCL National Championship
7. Password Cracking: Regular Season Game #1 and NCL National Championship
8. Web Application Exploitation: Regular Season Game #1 and NCL National
Championship
9. Enumeration & Exploitation: Regular Season Game #2 and NCL National
Championship
4
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
Games: Capture-the-Flag (CTF)
Players will participate in a type of computer security game called a Capture-the- Flag
(CTF). In CTF games, player’s race against each other and a clock to answer securityrelated challenges, often searching for digital “flags" hidden on servers, in encrypted
text, or in applications. Challenges within the CTF are open-ended and require expertise
and skills in a wide range of security-related topics: computer forensics, cryptography,
network penetration testing, web security, and system/network administration. When a
player submits a flag, they receive points for solving the challenge. The player or team
with the highest cumulative score at the end of the game wins.
For more information, visit http://www.nationalcyberleague.org/games.shtml.
Scoring
Players will be scored on their ability to successfully complete the challenges and obtain
the flags therein. Most challenges in the games contain more than one flag. To
accumulate points, players receive a pre-assigned point value for successfully submitting
a flag. The point value for some flags is determined by the NCL-defined difficulty rating
system. The total game score for a player is the sum of points for all successfully
submitted flags during gameplay. The scores for all players are ordered highest to
lowest within each bracket to determine Conference and national rankings for each
bracket for each.
For more information, visit http://www.nationalcyberleague.org/scoring.shtml.
Schedule of Events
The 2014 NCL Fall season will begin August 23 (when the Pre/Regular Season
registration opens) and end December 19. For an updated Schedule of Events, see
http://www.nationalcyberleague.org/schedule.shtml.
Seasons
Mandatory Pre-Season Game/Assessment
A goal of the NCL is to provide beginners with an entry point into cybersecurity games
through preparatory lab exercises, while also challenging and engaging players who
have already mastered similar content. As part of the Pre-Season, student knowledge
and skills will be assessed through a mandatory Pre-Season game. Based on the results
5
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
of the Pre-Season game challenges, players will be placed in one of three brackets. It is
anticipated that the players will have the following knowledge and skills:
 Gold Bracket: Players will have the highest level of knowledge and skills (e.g.,
have already completed relevant certifications and/or completed more
advanced study)
 Silver Bracket: Players will have an intermediate level of knowledge and skills
and should be able to complete all of the preparatory lab exercises
 Bronze Bracket: Players will have limited existing knowledge and skills and
should be able to complete some or most of the preparatory exercises
 Players will compete within their own bracket for the maximum number of
points. While game challenges are available to all players, there are increasingly
difficult challenges included to test players in higher brackets.
The following governs the Pre-Season game/assessment and bracketing process:
 All registered players will be provided login credentials to the NCL game
environment (powered by iSIGHT Partners’ ThreatSPACE®) prior to the PreSeason game
 Participant knowledge and skills will be assessed at the beginning of the season
through a mandatory Pre-Season game during the week of September 27October 4 (this is the Pre-Season)
 It is not necessary for players to prepare for this assessment, other than going
through the Public Tutorial in the ThreatSPACE® game environment
 At the end of the Pre-Season, all players’ scores will be totaled and used to place
players in the appropriate bracket in their Conference
 Ties between players will be broken first by using the total number of flags
captured, and then by the players’ accuracy. The player with the higher number
of flags captured will win the tiebreaker; or in the case of an equal number of
flags captured, the player with the higher accuracy percentage
 NOTE: a higher accuracy percentage is calculated using the following formula:
o Number of total successful flag captures/total number of flag submissions
Regular Season: Optimized for Individuals
These rules govern the Regular Season games:
 The 2 Regular Season games are optimized for individuals – meaning, players
compete as individuals in both games
 All players will have access to the same puzzles, but will be scored within their
6
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion







respective brackets
Games will be based on the Security+TM and CEHTM performance-based exam
objectives, and preparatory lab exercise content:
o Bronze challenges will be limited to material covered in the preparatory
labs
o Silver challenges will include advanced concepts from the whole portfolio
of performance-based exam objectives and labs
o Gold challenges will include other advanced topics, not strictly limited to
Security+TM and CEHTM
Each individual must pay a $20 fee to play
The cumulative score of the 2 Regular Season games will be used to rank players
in their respective Conferences and nationally in each of the three brackets
Players will have access to a public scoreboard and game clock during each game
(available in the ThreatSPACE® game environment)
Scoring for Regular Season games works as follows:
o Each flag will be classified as Gold, Silver, and Bronze based on the
difficulty of the puzzle
o The point value for each flag will also increase as the difficulty increases
(e.g., Gold flags will be worth more than Silver, and Silver will be worth
more than Bronze flags)
o The individual player with the highest point value wins that game
o In the event a tiebreaker is needed, the following will break the tie:
 First, the player with the most captured flags (regardless of point
value) will win the tiebreaker
 Second, the player who was most accurate (fewest attempts per
flag capture) will win the tiebreaker
Competencies being measured in Game #1:
o Open Source Intelligence
o Scanning and Reconnaissance
o Web Application Exploitation
o Network Traffic Analysis
o Password Cracking
Competencies being measured in Game #2:
o Log Analysis
o Cryptography
o Wireless Access Exploitation
7
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion

o Enumeration and Exploitation
Award certificates will be presented to all players that competed in both Regular
Season games
Post Season: Optimized for Teams
Real-world cybersecurity work is often done in teams; therefore, the NCL has designed a
Post Season game to provide a safe and challenging environment for individual players
to apply their knowledge and validate their skills in a team setting.
The following rules govern Post Season play:
 There will be 1 team game, the NCL National Championship
 School teams may be created with 5 to 10 players. Schools with fewer than 5
players may negotiate a collaborative team with another school. The NCL can
help facilitate the formation of these collaborative teams
 Schools can have any number of teams play
 Each team must pay a $25 team fee to play
 In order to participate in the NCL National Championship game, all players must
have played in the Pre-Season game and both of the Regular Season games
 A team’s bracket will be determined relative to all the teams registered to play:
o A raw team score will be calculated by adding the Regular Season flag
scores for all the players on the team and dividing by the number of
players on the team
o If 2 teams tie for inclusion in a bracket, the team average for the number
of flag captures and accuracy will be used to break the tie
 All teams from all schools will compete within their bracket
 At the conclusion of the NCL National Championship game, the top teams in
each bracket nationally will be named the NCL National Champions
 Scoring for the Post Season games will work as follows:
o Teams will have access to a public scoreboard and game clock during
each game (available in the ThreatSPACE® game environment)
o Scoring for the flags is the same as in the Regular Season:
 Each flag will be classified as Gold, Silver, and Bronze based on the
difficulty of the puzzle
 The point value for each flag will also increase as the difficulty
increases (e.g., Gold flags will be worth more than Silver; Silver
worth more than Bronze flags)
8
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion



The team with the highest combined point value wins
In the event of a tie, the following will happen:
 First, the team with the most flags (regardless of point
value) breaks the tie
 Second, the team with the most accurate play (fewest
attempts per flag capture) will win the tiebreaker
Competencies being measured in NCL National Championship game:
1. Open Source Intelligence
2. Network Traffic Analysis
3. Log Analysis
4. Scanning & Reconnaissance
5. Wireless Access Exploitation
6. Cryptography
7. Password Cracking
8. Web Application Exploitation
9. Enumeration & Exploitation
NCL Rules of Conduct and Ethical Behavior
Professional Conduct






All participants, including players and coaches, are expected to behave
professionally at all times during all NCL games, including preparation meetings,
game events, etc.
In addition to these published NCL rules, host site policies and rules apply
throughout the games and must be respected by all NCL participants
All NCL events are alcohol free events. No drinking is permitted at any time
during game hours
Activities such as swearing, consumption of alcohol or illegal drugs, disrespectful
or unruly behavior, sexual harassment, improper physical contact, violence, or
willful physical damage have no place at NCL events and will not be tolerated
Violations of the rules can be deemed unprofessional conduct if determined to
be intentional or malicious by NCL officials
Players behaving in an unprofessional manner may receive a warning from the
NCL officials for their first offense. For egregious actions or for subsequent
violations following a warning, players may have a penalty assessed against their
individual/team score, be disqualified, and/or expelled from the NCL
9
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion

game/season. Players expelled for unprofessional conduct will be banned from
future NCL games for no less than 12 months from the date of expulsion
Individual(s), other than players, behaving in an unprofessional manner may be
warned against such behavior by the NCL officials or asked to leave the game
entirely by the NCL officials
Questions, Disputes, and Disclosures
Prior to the games: Team captains and/or coaches are encouraged to work with the NCL
officials to resolve any questions before the game begins. Questions can be sent using
the following address: info@nationalcyberleague.org.
During or after a game:
 During a game: protests by any individual(s)/team(s) must be presented in email
form to the NCL Support Team (support@nationalcyberleague.org), during
game hours
 After a game: Protests by any individual(s)/team(s) must be presented in email
form to the NCL Commissioner (cobrien@nationalcyberleague.org), no later
than two days (2 days) after the competition end date
 The NCL officials will be the final arbitrators for any protests or questions arising
before, during, or after the game
 Rulings by the NCL officials are final
 All game results are official and final once posted to the NCL website by the NCL
 In the event of an individual(s)/team(s) disqualification, the player(s)/team(s)
must leave the room where the game is taking place immediately upon
notification of disqualification and must not re-enter the game or game area at
any time
 Disqualified individuals/teams are also ineligible for individual/team awards,
certificates of participation, Scouting Reports, scholarships, etc., as defined by
the NCL
 It is the responsibility of the disqualified individual(s)/team(s) to request a
meeting in email form to the NCL Commissioner
(cobrien@nationalcyberleague.org), from the Team Captain and/or coach, no
later than seven days (7 days) from the date the NCL Commissioner notified
individual(s)/team(s) of their Disqualification status
10
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
Game Conduct




Players are forbidden from entering or attempting to enter another player’s
machine, or account
Players must play NCL games without outside assistance from non-player
members, including team representatives, from the start of the game to the end
of the game. All private communications (calls, emails, chat, texting, directed
emails, forum postings, conversations, requests for assistance, etc.) with nonplayer members including team representatives that would help the player gain
an unfair advantage are not allowed and are grounds for disqualification and/or
a penalty assigned to the appropriate player/team
Any active mechanisms that interfere with the functionality of the scoring engine
or manual scoring checks are exclusively the responsibility of the players. Any
firewall rule, IDS/IPS, or defensive action that interferes with the functionality of
the scoring engine or manual scoring checks are exclusively the responsibility of
the players
Players are free to examine any target systems; no offensive activity against
other player’s systems or the NCL systems will be tolerated. Any player
performing offensive activity against other player’s or the NCL’s systems will be
immediately disqualified from the game. If there are any questions or concerns
during the game about whether or not specific actions can be considered
offensive in nature, contact the NCL officials before performing those actions
Team Representatives





Each team must have at least one school representative present at the NCL
National Championship game. The representative must be a faculty or staff
member of the institution the team is representing
Once the NCL game has started, representatives may not coach, assist, or advise
an individual or their team until the completion of that game
Representatives must not interfere with any other individual or team
The representative, or any non-team member, must not discuss any aspect of
the NCL game, specifically game tasks, configurations, operations, or
individual/team performance and must not attempt to influence an individual or
their team’s performance in any way
Team representatives, sponsors, and observers who are not players are
prohibited from directly assisting any player through direct advice, suggestions,
or hands-on assistance. Any team representatives, sponsors, or observers found
assisting an individual or team will be asked to leave the player area for the
11
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
duration of the game and/or a penalty will be assigned to the appropriate
individual/team
Internet Usage




Internet resources such as FAQs, how-to's, existing forums and responses, and
company websites, are completely valid for game use provided there is no fee
required to access those resources and access to those resources has not been
granted based on a previous membership, purchase, or fee
All Internet resources used during the game must be freely available to all
players
Internet activity, where allowed, will be monitored and any player caught
viewing inappropriate or unauthorized content will be subject to disqualification
and/or a penalty assigned to the appropriate individual/team. For the purposes
of the NCL games, inappropriate content includes pornography or explicit
materials, pirated media files, sites containing key generators and pirated
software, etc. If there are any questions or concerns during the game about
whether or not specific materials are unauthorized, contact the NCL officials
NCL officials are not responsible for the security of any information, including
login credentials, which players place on the game network
Scorebot Attacks

DO NOT, under any circumstance, attack the ThreatSPACE® scoring system. This
includes, but is not limited to, launching automated scans or tools targeted
towards the scoring system, attempting injections, or attempting to manipulate
data stored within the scoring system. Players found manipulating the scoring
system will be disqualified from playing in NCL events
Disabling Challenges/Puzzles



DO NOT under any circumstance purposely disable, alter, or damage a
challenge/puzzle and target
Puzzles and targets break, but please do not purposefully attempt to limit or
disable another player's ability to complete a challenge
Players found manipulating the puzzles and targets will be disqualified from
playing in NCL events
Collusion/Flag Sharing

During NCL Preseason and Regular Season games, DO NOT share answers or
12
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion



solutions directly or indirectly with another player or team
Once a player is identified as sharing flags, post-game adjustments will be made,
accepting only the first flag capture for that competitor/team and invalidating all
subsequent flag captures for that flag from players at that school
This allows the player who first captured the flag to keep his or her points, while
their cohorts receive no points for the flags they simply copied
During NCL Postseason game(s), the NCL encourages players from the same
team to work together to solve challenges
Laws




DO follow the laws in your area and the United States
DO NOT under any circumstance violate any laws or the terms you've agreed to
in this rules document
You DO hereby have express permission to attack any asset designated as an NCL
game "target," so long as you abide by the game rules and terms of this rules
document
Violators will be turned over to law enforcement
Target Altering



DO NOT alter an NCL target in a manner that will disrupt the solution or
structure of the puzzle or gameplay. This includes, but is not limited to, changing
core system configurations (passwords, firewall rules, services, etc.),
manipulating any network settings, and/or altering, introducing, or removing
vulnerabilities on the system
Some challenges require you to make changes to a system (adding files,
executing commands, exploiting vulnerabilities, etc.). Players should limit their
interaction to the scope of the puzzle - don't change the way the challenge works
Violators will be subject to a reduction in score or disqualification, or expulsion
from the NCL events
Solution Artifacts
Many challenge solutions require the persistent storage of code (be it on a web
application or in a file on a system). Please be sure to remove your artifacts after you've
solved a puzzle. This will allow the next player to have a more pristine experience with
the target. In the event that you are unable to remove an artifact, please contact
support during the NCL game.
13
2014 NCL Fall Season Rules | Updated 11/21/2014
The National Cyber League – Where Cybersecurity is a Passion
Scoring
Scores will be maintained by the NCL officials and will be shared as soon as possible
after the game. The NCL will do its best to periodically update a leaderboard with
running totals provided during the game. Any individual or team action that interrupts
the scoring system is exclusively the responsibility of that individual/team and will result
in point penalties/disqualification. Should any question arise about scoring, the scoring
engine, or how they function, the Team Captain and/or coach should contact the NCL
officials.
Questions, Disputes, and Disclosures
14
2014 NCL Fall Season Rules | Updated 11/21/2014