Cyber Grand Challenge, Security through Automation

Written by Ben Friedman, August 5th, 2016

On August 4th, 2016 the world's first all machine hacking tournament occurred for a prize pool of $3.7 million dollars. The objective, security!

The Cyber Grand Challenge put together some of the best and brightest to compete in a completely automated game of capture the flag. For those of you that are familiar with DEFCON (the hosting event) they hold a Capture the Flag tournament just about every year. The nature of the game, steal the others teams' flags while protecting your own. In just about every way it's quite similar to the game that most of us have played before. The primary difference being that instead of a physical flag to steal, it's data and instead of people playing on a field, it's played across a LAN over network cables and computers.

Every year teams participate, teams lose and teams win, but it's a great experience for all. However never has there been an automated bot participating standalone without human intervention.

The Cyber Grand Challenge set a new precendent by having the first machine only competition for capture the flag. Not only did it attempt something new, but it also demonstrated that unmanned machines could help secure faulty or buggy programs in real-time. Bots of this caliber could be deployed in the future to secure webservers that would otherwise be vulnerable to attack.

Most importantly many if not all of these bots were able to recognize attacks and vulnerabilities by analysis, not by signature. This means they can counter new and previously unknown attack vectors, patching them after the first sighting. A response so quick and so precise could help secure vast swaths of the internet. Server admins could rest easy knowing that while they take a break, a bot will be picking up the slack.

Although such a concept may still be far off. The Cyber Grand Challenge demonstrates that such a possiblity is nearer than we thought. It's quite possible in the next few years we may see the first completely automated cyber defense systems in public systems, requiring little to no human intervention. Such a world could mean that even as new vulnerabilities are leveraged against servers, new patches and fixes could be implemented as they are attempted. These fixes and patches can help keep our information, and the information of others, safe. Even for those that aren't using such systems, these patches could then be released to others allowing anyone to keep their machines safe and sound.

Questions? Corrections? Concerns? Contact us at inquiries@axolsoft.com