Capture-The-Flag (CTF) Competitions: Everything You Need to Know

ENISA has published a report on the modern use of Capture-The-Flag (CTF) competitions worldwide. It investigates how these competitions function and offers a high-level study of the dataset of the most recent important public events.

The study makes recommendations for the design phase of these types of competitions, based on the results of the research.

The study is a supplement to Capture-the-Flag activities such as the European Cybersecurity Challenge that ENISA and the European Commission have co-organized over the previous five years (ECSC).

what exactly are ctf competitions?

Computer security competitions consist of Capture-the-Flag tournaments. For the objective of getting the highest score, participants participate in security-themed activities. In order to enhance their score, competitors must "capture flags," hence the event's moniker. Flags are typically incorporated strings of randomness throughout challenges.

CTFs have grown in prominence since they draw an increasing number of fresh talent every year. They contribute to the development of the necessary abilities for a career in cybersecurity.

Jeopardy and Attack-Defense are the most prevalent kinds of these competitions. This report focuses on these two CTF varieties in particular. Format, score, debate, and modifications are explained and analyzed in detail for each of them.

what type of analysis and technique were applied to the findings?

The themes used to qualitatively analyze CTF events were selected with the intent of providing sufficient information about all aspects of conducting a CTF event. Consequently, the following aspects of the competition are examined in depth:

• Entry requirements: consolidates data on age, status, qualifications, location, etc.
• Diversity and inclusion: gender parity, socioeconomic background and proportional ethnic participation, etc.
• Examines challenge categories, scoring, platform used, awards, competition duration, etc.
• Analyzes data on team sizes, mentors, and coaches, as well as qualifiers and concurrent competitions.
• Organization of the event: Considers other activities, such as food, transportation, and lodging accommodations.
• Post-event actions: Examines actions carried out after the event, including the distribution of challenges and solutions, the release of result data, and following publications.

ctf competitions: main suggestions

In relation to the examined topics and areas, recommendations are made. Formats, for example, should be selected in accordance with the competition's intended audience.

Jeopardy's format is better appropriate for non-professional contestants due to its accessibility and reduced implementation costs. Attack-Defense, which is more comparable to wargame forms, is more suited for professional training exercises.

The study contains suggestions for the following areas:

• Team requirements
• Team sizes
• Rules and scoring
• Parallel contests
• Challenge formats
• Media and communication
• Post-event.

who is the intended audience?

The study on CTF contests will be of special relevance to all individuals and organizations interested in their development. Participants and organizations wishing to promote such events will also discover useful information on how such events are organized and made functional.