Inside CSAW, a Massive Student-Led Cybersecurity Competition

CSAW – Brooklyn, New York – New York University's CSAW, which calls itself the world's largest student-run cybersecurity competition, this week announced the 397 high school, undergraduate, and graduate students from around the world who will enter its final round.

CSAW started in, and is organized by, NYU's Tandon School of Engineering. This year, its 15th running, saw 3,500 teams from more than 100 countries enter the games. The remaining contenders will now travel to academic sites across four continents to compete in the finals.

The competition was founded in 2003 as a small local event by Nasir Memon, an NYU professor of computer science and engineering. It has since expanded to include eight global events, all of which evolve to host challenges and contests that align with the changing threat landscape.

"It started accidentally, like many things start," said Memon in an interview with Dark Reading at the North American branch of the CSAW finals. The event is taking place this week on NYU Tandon's campus in Brooklyn, New York.

CSAW's first participants, all Tandon students, were challenged with cleaning up poorly configured laptops among other adversarial tasks designed to test their offensive and defensive security skills. The internal competition quickly expanded — first to local New York universities, then throughout the tri-state area, and now in Mexico, Israel, and around the world.

"What we really caught on to was, there's a kind of talent that likes these adversarial challenges," Memon explained. "You cannot really teach security by lecturing in a classroom. You have to understand how attackers work."

The first stage of CSAW happens online. When competitors reach the finals, they're brought together so they can get to know each other. "In order to protect … you need to be sharing information with each other," he said. "Otherwise, the bad guys have an advantage."

Challenges are designed with the help of New York City's top white-hat hackers. Players of all ages and levels can join Capture the Flag, the flagship CSAW event that tests hacking and defensive skills. An embedded security challenge, which CSAW calls its most difficult event, pits red teams against blue teams in simulated cyberattacks. This year's, created with the United States Office of Naval Research, requires participants to perform data exfiltration attacks against Internet of Things devices.

Different challenges attract students of different levels and expertise. A Policy Challenge attracts students in policy and law school who are interested in how security will play a role. Applied Research accepts peer-reviewed security papers that have been published in scholarly journals. A forensics analysis competition is restricted to high school students, he explained.

Memon said CSAW has proven an effective way to attract students to cybersecurity, a concept he said wasn't yet in people's minds when the competition started 15 years ago. Studies show after competing, students often decide to pursue cybersecurity careers, he pointed out. If they don't, they have greater security awareness as software engineers or other non-infosec roles.

The event has become a hot spot for recruiters, who CSAW initially brought in to help offset the cost of transportation and accommodations for students who fly in for the finals. "We're not doing this to make money," Memon said, noting all the workers are volunteers. But flights and hotels for a growing pool of student competitors can get expensive.

Companies "across the board" come to CSAW to recruit security employees, he said, with the majority representing the tech and financial sectors. A growing number of businesses are expressing interest in attending the event to seek out talent.

Related Content:

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.