Stealing Our Children's Youth: Identifying Early Cybersecurity Talent

the besides DC 2017 videos are brought to you by threat quotient introducing the industry's first threat intelligence platform designed to enable threat operations and management and data tribe a new kind of startup studio co building the next generation of commercial cyber security analytics and big data product companies hello everybody my name is Michael Bailey and this is stealing our children's youth so Who am I I am the student at George Mason University I'm also an intern at the crypsis group kind Fulk up here i've been there for probably coming on into two years president of Mason's CTF Club that's them and and in high school I did a bunch of competition stuff that's just like where my background is with this

I'm also twenty so if you're inviting me to your work happy hours I can't go for a reason yeah or I can but that's a separate conversation disclaimer nobody told me to do this nobody told me I could or couldn't do this nobody even knew what I was doing literally Jericho and attrition if you've ever heard of him he proof read it but other than that nobody knew I was submitting so don't assume when I talk about these companies and these programs and all kinds of stuff I'm representing any of them this is just personal experience to the most part ok so what's all this about cybersecurity activities programs competitions that are primarily in college in high school how you would

theoretically be able to help them if you're out of that age / not necessarily age institution and obviously as a lot of people are aware some people might have but a lot of people didn't get to this point learning through a public school classroom so there's a lot of interest in trying to get knowledge outside of the usual the usual routines so a few just precursor notes there's a lot of different cybersecurity competitions attack defense is more free-range and you see them less common because they're kind of hard to set up but we can talk about that more later Maryland is absolutely like killing it right now at least in college yeah that's CJ with UMBC and they're

doing really well as somebody who's competing in Virginia and like not that I'm getting first or anything but at a relatively high level like half of Maryland could like wipe the floor with me so just figured I'd preface that high school is a little bit more restrictive in the programs they can run because they're a minor's like heavily and be high schools have a closed networks and it's all really controlled for related reasons because they're minors so if they're trying to do a cybersecurity competition that's kind of less less logistically possible who cares about what I'm talking about here it's you're an HR person trying to hire out of college / high school this is a great idea of how to what programs

would be a good idea to target in terms of who's actually wants a good but who's who's engaged in their field right now people who are just opportunistic or curious for nice people maybe you want to volunteer at these programs and to help out the next generation of people who are doing cybersecurity young people who are actually trying to participate and parents who have people who have spawn coming through these programs Crypt Kids is here this year so we have a lot of procreation Pro procreation fans here so that might be a little more applicable so background in general and what different cybersecurity kind of competitions there are out there there's a CTF it's capture the flag a

lot of people who are here have probably heard of them considering there's literally like two or three running at this event there's jeopardy which is kind of question-and-answer it's more fun than an exam I promised attack-defense you try to hack people without getting yourself hacked then there's also a less common one computer network defense which is all of the fun of defending with none of the fun of attacking but in I mean you could argue that CNTs are more real-world applicable because it's not like you're hacking back 24/7 unless you're a very specific set of companies and then in CMT's there's generally you get graded on service uptime just to be more realistic if you're protecting a

box but yeah some of you might already know what that is also I should practice with a lot of this talk isn't necessarily a very technical so if there are people who are trying to get their technical fix / don't know what a CTF even looks like I'm hosting a incredibly small one like for problems and they're all recycled from past Jeff's at b-sides Michael Ballack oh so if they're really trying to get their fix they can go to that but also just to see what the interface is like the interface that's being used their fun fact it's literally the same interface the IOT village is using right now it's called CTF D so if you're if you've seen

that you've seen what's up there pretty much so what probably makes a good competition program exercise kind of thing this is largely personal opinion but if it's both beginner friendly and that people can at least get their foot in the door if they don't know that much and not like instantly get crushed then it's kind of a nice program or competition to have requires you talk to other humans it's pretty pretty good that's ETF's there's a lot to be seen about this and while it's great and you can assess people's technical ability to a degree through CTF you don't necessarily assess any of their soft skills in the slightest I verified that with I had a

conversation with Shane Wilton who competes on samurai about that samurais like really high ranking and there was apparently somebody on CTF time who was like top three and literally was running individual so you don't necessarily have to be a good people person to ace some competitions also isn't a complete waste of time and it stays on topic so some competitions don't actually under several security competitions really drill in on as a lot of people know there's fundamentals that go into cyber security like IT Computer Science like there's a lot of components to it sometimes competitions like won't even try to specifically hit cybersecurity it'll be more of an IT security competition or more of a computer

science competition or something like that which is fine it's just important to note when you're looking at a competition whether you're hiring a participant or you're trying to volunteer at that competition or you're anything like that it's probably focused in a specific area attack-defense are kind of nice because it's more creative so you can do more different areas but one example is CyberPatriot is a very common high school one CyberPatriot is great CyberPatriot is largely IT you could have no computer science background and get first place that CyberPatriot again great foundation great program it's important to note it's pretty much ITT frequent struggles a lot of rules and stipulations there are a couple that are

very anal about their rules disclosure of bias I got a rule book thrown at me in CyberPatriot but I should still maintain that for instance CyberPatriot is run by largely ex-military so they're very like here's our 60 page book and you should know every line in that book so again teamwork is pretty important because you want to build your soft skills as much as you want to build your technical proficiency and like I said it pretty much only teaches a subset of information 99% of the time so we're gonna go into examples of these competitions I've been talking about high school CyberPatriot is an incredibly common one its IT security but it's so CyberPatriot you get a

VMware image you have to lock it down and harden it as much as possible they have ten pain points in mind whether that's policy or in an intentionally messed up firewall rule or something like that and they grade you based on how many of those pain points you're actually covered cyber Maryland is a conference in cyber Maryland there is an md c3 competition i think they're renaming it to like maryland cyber challenge because they rebranded and read it everything this year and then also there's a virginia cyber range if you're in virginia which is still in beta and still building but it's got some exciting stuff going for it in college there's CCDC which is basically a

college cyber Patriot and they do some stuff better such as instead of doing those 10 pain points which is great but if you're securing a firewall and all that and you don't actually get any points for that that's kind of a shame because that's the kind of thing you would do in the real world but if in CyberPatriot they're only checking those 10 points or those 10 bullets none of it Siri just turned on and I have no idea how those 10 bullets then like it's very static and the way it's done and doesn't necessarily grade the person to how they're actually doing in the terms of hardening the box see CDC does more of

the stuff I was talking about where they enforce that you actually have your services up and check on all that and in later rounds they have an active red team attacking you and all that it's more in my opinion like professional applicable they're both great programs up CCDC all this we'll talk about cyber Olympics in the past it's been it's been great it's been kind of a Jeopardy CTF kind of thing but one big note about cyber Olympics usually they have tiers where it's like round one we're gonna cut out 30 percent round two we're gonna cut out 50 percent cyber Olympics is round one everybody competes round two like 30 teams compete so they cut straight to

finals and in general when you're professionally you pretty much get your lion's share of competitions you can do whatever you need to do companies even run internal ones I know Capital One runs one every month for instance Amazon likes doing that kind of stuff so you pretty much have your lion's share shutout - peeko CTF which we're gonna go over later because they like gamifying their competition and they like making it actually fun not seeing the other ones aren't fun but they put a lot of effort into the graphics and the production value and the entertainment aspect of it so particularly in the high school I should preface this with I went to to two schools actually in Fairfax

County so that's the prior we're and largely talking out of but these are in multiple counties at multiple states I went method and went straight back to my high school and went to a meeting to see if anything's changed and things have changed they used to be a CyberPatriot Club and now they're just a cybersecurity club in general and they're working on something called the Virginia cyber range which I'll talk a little bit about but I recognize not everybody's here from Virginia so MDC three in particular they had a high school League and a college professional league previously it was act attack defense live buy in at like two hundred and fifty dollars a team and then the

prizes like some for our high school and college suite amount of money like two thousand five thousand personally I have a rough history with this competition I don't want to take the stage and bash companies but I did write articles and write-ups on those competition on mediums so if you're absolutely curious those are the only two medium articles I've ever written so after a year or two of going okay this is getting really bad let's put it on ice they stopped doing it for two years and this year they came back with a new company new format new everything it's only one hour now but its annual and it's at the cyber Maryland conference and as they

rebranded and redid their whole format I can't speak that much on how it was this year so I don't want to speak too much on it in general because it's not very beneficial to talk about how it was in the past if it's not there anymore Virginia cyber range it's coming out of Virginia Tech largely it's really better for coursework than it is like extracurricular activities and all that what it is is it's it's designed to be a courseware program and every time they do an exercise or a lesson or something they get a if you're familiar with sift it's a virtual machine based on forensics largely virtual machine in their browser and they can do the actual

courseware from their browser and a highly interactive fashion it's just starting out it's just now building in high school it's in a closed beta right now I'm told it's a closed beta and I'm not invited but I'm assuming it's a closed beta considering I'm not in high school so why would I be invited and it's in a public beta for colleges if you're a faculty / if you're a faculty out of college you can just ask for it and they give it to you but yeah this is really more interest specifically for if you're somehow involved in curriculum in a high school or college yeah their special sauce is like the fact that they're able

to provision virtual machines directly into the browser and teach through them they actually got mad at me because I got a copy I got invited to the private beta and then I immediately launched all 10 of their courses with 200 participants which means it instantly spun up 2006 VMs and apparently that's not something you're supposed to be doing in beta so they they were very polite CyberPatriot I'm a huge fan boy of this program and it's that should have extra links to it to the fact that as I said previously they threw the rulebook at me and I'm still a huge fan of this program above is the team I had in high school and our mentor below is

what a meeting looks like in our high school everything's great who says you can't get slides from your mother's Facebook nobody so that's there you go [Applause] so yeah other than the fact that a CP is a really unfortunate acronym to be talking about when you're in high school it's a great competition they do computer network defense it's largely Windows and Linux and all that but it's like I said it's a set number of like 10 15 pain points and vulnerabilities they give you a virtual machine for instance they say this is an SSH server if it's running Apache you shouldn't uninstall it because all they told you was it was an SSH server so your your

hardening you're limiting the attack surface we're doing all that and they're scoring you based on that our club was relatively large based on the fact that we sourced out of the entire county it had 105 people in my year 16 teams and a great part of this is if you're not in high school or college they have a lot of avenues for people to help out you can coach you can mentor CyberPatriot team do any of that and it's multiple avenues of commitment coaches need to show up to competitions and all that they have strict rules on what they need to be doing mentors are specifically oh you're from a technical background become a mentor and help in whatever capacity you

can whether that's talking to students how it literally however you can there's no requirements for a mentor other than you're going through a background check which if you can't pass a background check to show up to a high school like that's not an incredibly high bar you get actual connections in real life Paul is here Paul I competed with in CyberPatriot like three years ago and we've been roommates for like three years so you do actually meet people in these programs wave hi Paul that's Paul also check to see who did cyber patreon I don't know if I know you through CyberPatriot but I'm ok never mind a lot anyway they actually have good integrations in

industry and a lot of companies are aware at least in HR departments and all that of what CyberPatriot is like half of these people at the table all them were invited from our CyberPatriot Club to an app SIA conference half of them already had internships keeping in mind this is junior and senior year of high school so it was a great start it's applicable people here the program and know what it actually is and recognize that there's value in people doing well in them yeah certain companies pay more attention to it than others like Northrop Grumman like their Platinum major super sponsor so they keep a very close eye on it but of our variety of

companies our enjoy it so yeah restating if you are a professional and you are interested in helping I'm not saying the best Avenue is to probably coach or mentor CyberPatriot because that would just be showing CyberPatriot but probably the best avenue in my opinion is to coach or mentor soccer patriot okay picot CTF it's an online competition it's good times it's if you are aware of what a CTF is which you should be because I literally explain what a CTF is it's it's a Jeopardy CTF so it's answering question you get artifacts all that fun stuff it's a phenomenal example of where corporate funding could help because while I'm not cued in to all the details

and I'm not exactly on their planning committee they had their 2014 competitions in 2013 competition constantly running since it started it was amazing it was beginner friendly and then they went because of server costs we're shutting them down now they're no longer available we used them for training so that's a good example of where a company could help because I'm pretty sure that's like a blip on the radar if anybody's AWS still so they're doing phenomenal work it's high school friendly but it's still got similarities to what you would see in a call college or professional competition it's been in my opinion not less beginner friendly but it's been more competitive and harder in the past year or two and their

stories used to be like elaborate like it was literally I think the 2013 or 2014 one was like my father's been kidnapped and I have to go like save him from a spider monster or something like it was an elaborate storyline for a competition and now they're putting a little less effort into the stories but like really who cares because it's not like anybody and CTFs are even remotely trying to write stories on it in the first place so they're still ahead in that regard this is an example of what the 2017 version looked like so you have a variety of categories whether that's web crypto forensics you have a shell to play around with a lot of competitions

are big fans of doing as much as they can in the browser just for the sake of if you're high school or college student that you can't even guarantee you have a good computer for the competition so they have the shell also it's a known good environment so if somebody's trying to do like a 64-bit binary on their laptop and their laptops running 32-bit you don't want that to be the mitigating factor of them not being able to do a cybersecurity competition so at least here you have a known good environment yeah and then there's a story line between scenes but again like yeah there are other CTFs in high school that are pretty good too I enjoy our easy CTF and

high school CTF ironically both harder than PT Peco CTF in my opinion easy CTF has been getting harder ironically enough and they're both pretty heavily in computer science like I said usually they lean one way into another field instead of cybersecurity itself a lot of CTF scope creep into computer science pretty quickly how can you help become a coach or an advisor or anything coaches the more hands-on needy position feel free to host an event Capital One literally have one in their security operations center with live security feeds going on and people still at work there for GM you so if they can do that in their security operations center with sensitive data running down the screen

so you really have no excuse as to why you can't host one and reach out to any County or school at this point it's like every County that's trying to participate in these kinds of programs it's likely gonna be a two sided relationship you can probably hire out of there and you can they can when I say can likely fund school I mean you can likely fund the program such as a lot of them have entry fees and while a lot of a lot of counties $250 to send a team as peanuts for a lot of counties it's not the fee itself depending on the competition is not a concern CyberPatriot has a 2 or $300 entry team

fee for team which adds up quickly but if you are in a certain position CyberPatriot is very willing to help you I don't know how institutions work but there are classifiers for lower less well funded institutions and they look for those and if you match one of them they go ok we'll just let you in so some of them do do accommodate for that some of them don't for instance MDC 3 nothing against them they're not large enough where they're planning on doing all of those like fee structuring things so there's just $250 straight up so that's somewhere where they legitimately might not get funding for that I know I can speak from personal experience regarding the CyberPatriot

structure because there was a school I talked to coaches a lot there was a school in Fairfax County actually I they start with an F I'm not trying to censor them it's legitimately I just don't remember the name of the school but they were lower they were in the lower income area and they were able to just get their fee waived so College like I said last time how I was basing my experience in high school on basing my high school experience in my Marshall high school experience College I'm at George Mason University I'm a junior so that's my background there that's what I'm largely speaking out of but also I do at I did

ask people before this presentation what kind of competitions they did CCDC is a common one like I said it's College CyberPatriot really it's really fun again it's extremely limited in the fact that it's pretty much IT goodtimes still limited they go virtual round then once you do well enough in the virtual round you have a regional round cj's we're regionals for this region Laurel ok they're in Laurel in this region and then Nationals San Antonio last time right San Antonio was the last place they put Nationals so yeah they used live red teaming after I think regionals and nationals they do virtuals they might I don't know honestly because they hook you up to a network but there's a

red team in virtuals ok there is a red team in virtuals there definitely is because when I did CCDC I had to leave 2 hours early but I had a hard in firewall nobody else did so I still ended with the highest score because everybody else got wrecked after I left or they wrecked their own computer entirely possible professional CTFs if you're in college or you're you should be starting to enter that world anyway so a lot of the professional competitions just see if you can go and if you can go then go like net wars here is like it's a professional conference and all that but nothing's stopping a college student from registering and doing a network

here so I encourage if you can go then go if you're overwhelmed try again do another thing study what study what happened when you got overwhelmed that's a common thing I see with like people who are beginning is they'll go to a competition it'll be some competition that's designed for like this Carnegie Mellon's team and like mi t--'s team to go at each other's heads and they'll do it and they'll pick the highest value problem and be like wow this is overwhelming this is a lot not cut out for this quit everything it's like no it's not meant to be the easiest thing to understand always and if you don't understand it hey you could pick another problem pick

another competition B you could study how it's done also of note in almost all these competitions they publish write-ups after the competitions those are not a bad way to learn especially if you attempted the problems NC L is a pretty National Cyber League is a pretty good one they teach and test not at the same time as much as you would think in the sense that you can get the curriculum and not even be a team and NC l and a lot of people in the competition don't necessarily use the curriculum they just wing it but they use something called cyber skyline and a lot of people are starting to use it it's a local

company and it's kind of an attempt at like an OS and the browser kind of thing if that makes any sense to people like this is the screenshot below is a browser and it's running html5 JavaScript all that but they're attempting to at least make it possible so you can do the competition just in the browser so dramatically limiting it to do you have a at least lenovo $200 laptop to do you have a modern browser that's great if you're in high school and college you don't necessarily have access to the resources you otherwise would and again place a company would be able to help is actually get them those resources and also cyber skyline is pretty unique

to the region because I believe it's it is a local company so if you're going to California I wouldn't necessarily expect to see cyber Scotland yet there are a wide variety of local events metropolis is one in why did I just say in because I don't remember where it is but that's okay metropolis is one its local MDC three already mentioned Virginia Tech does a competition every year well for colleges largely that's great because I'd imagine if you're in the middle of nowhere Virginia that's your best bet you could do CyberPatriot they could have programs there but a lot of them are Maryland and Northern Virginia competitions it's also a great competition they do a hybrid

kind of between jeopardy and perfect like actual servers and all that and the sense you have to pivot you have to actually scan these servers you have to get into them and then then the challenge is sitting on the actual server there's call wide variety of local private events so one of the best things you can do if you're a company is reach out to schools and be like a Capital One did last week where they reached out to George Mason and goes yeah we can have a little local competition for George Mason at least like we can we can scale that and then George Mason came and asked their students if they wanted to come we heard

it sent like 35 people and then yeah we have people who are engaged or doing competitions so that's something where a I would recommend if you're a high school or a college student reaching out to your institution and seeing what they have available and keeping up on the mailing lists and all that for that kind of stuff if you are a company keep in mind that just because you want to do a competition doesn't mean you have to do a competition for a million people because I recognize that's not possible for a lot of companies code day is the local hackathon type thing and it happened in a local when I did it happen in like a local graphic design studio

that could not plausibly hold more than a hundred people who's basically a town house in DC so like there is a possibility to do it regardless of what space you have usually there's even like cleared spaces do it they just make preparations obviously you can't just let high schoolers in the winner in the past two years of Net Wars I believe I could be wrong you can tell me if I'm wrong did you win the past two years No did you win last year two years ago two years ago so I got confused cuz I think they'll last you to this but I went the year before well two years ago CJ I want it at net wars CJ is a year older than

me at UMBC so college students can absolutely be competitive in this kind of stuff even if it's a professional competition that's my main point there IOT village is doing a mini CTF type thing with but you have to wire in and it's been busy but still it's a great competition they do it I believe every year usually so those are examples of like local events you need to keep your eye out for and try to show up too if you can anyway and there's a lot of research involved in trying to figure out where competitions are and which ones you actually like because if somebody posts on Meetup that they have a competition that implies you're

watching meetup for competitions so you need to like keep plugged into as many feeds as you can if you're trying to go to these local events and you're trying to understand where they are sometimes some of them announce with six months lead time some of them announced with a week lead time so it's pretty it's pretty tricky you need to pay attention to the actual feeds they're announcing through which meetup mailing lists news bulletins so Google's pretty accurate all that kind of stuff if you're trying to be helpful to the real world you host local events make them at least accessible to a growing individuals so one example of this is like I hit on in

my earlier thing hosting them at a bar might not be the best idea because 80% of the people who want to go won't physically be able to go but uh in addition making them accessible to growing individuals keeping them local because some people might not be able to drive so I understand you may want to appeal to a larger audience but if there's a certain core group you're going after keeping it local to that group is probably a good idea I drove to the Virginia Tech Summit that was a four and a half hour drive I don't expect most college students to be able to do a four and a half hour drive during midterms like you keep in mind

what college students and high school students are doing it's also an insanely insanely unique opportunity like I said there were people working while I was doing the Capital One competition in there saw so I was sitting at a desk doing like base64 decoding gzipping data unzipping data all kinds of fun stuff in Linux and there's a analyst sitting right next to me he was like oh cool you're able to do this stuff and while I'm very happy at my company if I wasn't that would take three seconds to turn around and go oh you have a card okay cool you guys have internships what kind of stuff do you have going on and I saw

other people who were able to do that at that event so it's a great opportunity to mesh together full disclosure I did not expect to get through this quickly so I'm gonna go back to a couple slides that are important CyberPatriot a key bit here is north of bremen for instance north of Grumman has a pipeline specifically for CyberPatriot competitors there is a internship that is we are looking for CyberPatriot high school students and if you are a CyberPatriot high school student you can apply to that internship that kind of gives you a fast lane to an internship not all competitions do this obviously Pico wouldn't necessarily be able to do this since they have a million

registrants and they're online but I will say even even with pico for years they were sponsored by the NSA and the NSA I'm pretty sure reached out to some high-ranking pico people as you would expect them to

yes so this went I apologize this went slightly briefer than I expected does anybody have any questions and I highly encourage people to ask questions because I'm under time what's up priceless resource [Music] well so the question was regarding a high school student who's just starting out what what are some things you could just suggest it's all down to I gotta say there is an element of barrier to entry and what's already established CyberPatriot you could in theory just start a team but like that's a lot of theory so if you have a team at your school you could do it if you don't Pico CTF literally no barrier to entry recommend doing it CTFs in general

generally online generally no barrier entry find like-minded people in your school who can there's power numbers and this kind of stuff to a large degree we started a cybersecurity Club at our high school and suddenly a hundred people showed up after we promoted it and the and the school got hip to it and started distributing stuff about it so there's power in numbers wish it wasn't the case but there's power and it already being sitting there for you some counties are already hip to that fear of X County almost every school has a CyberPatriot program set up already even in middle schools Frost middle school kilmer middle school have CyberPatriot teams so CTFs if there's no barrier

entry CyberPatriot if possible well if there's any existing things in the county or the school great but if there's not at least CDF's the problem any other questions yes

so the question is bingo CTF entirely online no teams it's similar to other CTF in the sense that they're most CTFs do have teams it is online if you do if you went solo you could go solo you can have a team of one and if you had people around you who are interested in it again there are power numbers you could register your team for that there's another popular CTF called seesaw cybersecurity Awareness Week and weiu runs it they have an unlimited team cap and the only time it becomes an issue is when you get to finals and then they say okay send five people because we're not flying out like million people so there

are in all these competitions there's pretty much by our numbers it's not mandatory that they all be physically together and 99 percent of cases the cyber Bay sure has rules about who's in the same place at the same time but most ETFs you could be remote and in a chat room and you could be doing it any other questions yes [Music]

yeah so this is a key distinction that didn't make well CyberPatriot was kind of thrown in along with a lot of CTFs CyberPatriot runs very different from CTFs CyberPatriot gives you a virtual this is going to get a little technical CyberPatriot gives you about a virtual machine that virtual machine has a score on it the score scores the configurations you make on the machine and whether or not they're expected configurations to take your system for more vulnerable to less vulnerable state entirely different than 99% of CTF s-- that are set up attack-defence CTF so you would probably go through the same motions who try not to get attacked and you most people have the same list

regardless of whether or not they're looking for specific things or whether or not they're just trying to generally make the system more secure so I can see there being a lot of overlap if you're defending in an attack defense competition but cyberpatriots like I said with the CNTs it's more like a computer network defense defense competition yes

question was outside of the United States what kind of happens with this kind of stuff I know obviously very limited about that but CyberPatriot runs cyber Centurion the exact same branding exact same design in the UK I've seen a lot of attack-defence CTF s in India and that region in general well I can't speak about South America specifically because I don't know what it's off the top of my head what would be there but there I'm sure I'm sure there's local local at least events regarding CDF's

absolutely there is a team please nobody quote me about this but I believe there's a team called hit Cohn who is based out of Thailand Thailand Taiwan wowthat's whoops based out of Taiwan and there's teams from a variety of countries they're seeing you competing against a team and Japan there's it's it's a largely international and on top of that for instance we had our club at a speaker last week who was like yeah we used to compete out of South Carolina out of our University but now we all got jobs and we're in like two or three different countries and now we're all communicating and chat and doing the competitions they're so remote is absolutely a possibility CTF time org

has a lot of the resources regarding CTFs and you'll see the moment you see their like they aggregate a scoreboard on like the general landscape of where all these CTFs are and stuff scoreboards like five different countries at least so yes there any working resources to get started I will obviously I will preface this with I'm always a fan of like diving in and just learning through a firehose and information so if you jump into a competition and you don't get it it's on the end of the world but fiddling with live problems are a great way to learn that being said there are a variety of resources everybody has their own list it depends on the category you're going

after the CTF teach you web they do reverse engineering they do retire fee CyberPatriot has their own line of stuff if you literally go to their website they have training resources some are better than others but groups groups have CyberPatriot resources out there CTFs though everybody has their own list and it's it depends on what category you want to get into there's reverse engineering like I said forensics web cryptography depends on the competition I would recommend like googling like a hot list of CTF resources and it's you let me see people's personal ones I don't want to start throwing out and spouting URLs because nobody's gonna be like rapidly writing like 50 different URLs down one thing I can do is I

mentioned earlier Michael be like oh I can I can do my god I don't know why I did that I can throw I can for what on earth I can throw my list up there I don't know why that closed but whatever any I'll do one more question because I don't want you I need to be too long Hey okay okay let's okay okay I just I just got trolled by a co-worker so cool thank you