Командные соревнования формата attack/defense как инструмент практико-ориентированного обучения защите информации

Abstract

The paper considers team attack/defense CTF competitions as a practice-oriented form of training information security specialists. An architecture of a training ground is proposed: identical vulnerable web services for each team, an automated jury system that places fresh flags and verifies service availability, and an isolated VPN network. A scoring model combining attack, defense and service-level criteria is described. It is shown that competitions develop the skills of exploiting vulnerabilities, secure development and incident analysis while preserving the service functionality, thus improving the quality of practical trainin