A major shipping company is under attack.<\/p>\n
With help from a corrupt executive, an international hacking syndicate called Scorpius, has penetrated the computer networks of\u00a0Fast Freight Ltd.<\/p>\n
The hackers have taken\u00a0control of servers and compromised the systems that control Fast Freight\u2019s\u00a0vessels and its portside machinery.<\/p>\n
The company\u2019s cyber security\u00a0consultants have 48 hours to uncover the breach and repulse the attackers\u00a0before they\u00a0cripple Fast Freight\u2019s business and cause serious economic damage.<\/p>\n
It sounds like the plot to a blockbuster thriller. But this was the fictional scenario\u00a042 budding computer security experts\u00a0faced at the annual U.K. Cyber Security Challenge competition earlier this week in London.<\/p>\n
With demand for cyber security\u00a0expertise\u00a0exploding, but qualified people in short supply, war-gaming competitions like this have become key recruiting grounds for companies and government security agencies.<\/p>\n
\u201cWe want to find untapped talent to fill roles in our own operation and in the industry as a whole,\u201d said Rob Partridge, BT Group Plc\u2019s head of commercial development for penetration testing.<\/p>\n
BT is one of a half-dozen companies, including Airbus SE, Cisco Systems Inc. and smaller, specialist cyber security firms\u00a0Darktrace Ltd.\u00a0and\u00a0Check Point Software Technologies Ltd., that sponsored this year\u2019s\u00a0Challenge competition.<\/p>\n
The U.K.\u2019s National Crime Agency, the Bank of England and law firm 4 Pump Court also supported the competition. Partridge also said he hopes the competition will help raise the profile of cyber security\u00a0as a profession, encouraging more students to pursue a career in the\u00a0field.<\/p>\n
There are about 1 million unfilled cyber security\u00a0jobs globally, according to an estimate from Cisco. And computer security firm Symantec Corp. forecasts that the number of positions will\u00a0grow to 1.5 million by 2019. In the U.K., advertised cyber security\u00a0roles exceed\u00a0interested candidates by about 3 to 1,\u00a0according to online recruitment site\u00a0Indeed.<\/p>\n
It\u2019s this gap that Cyber Security Challenge U.K., a non-profit organization set up by the British government with support from corporations and universities, is supposed to help fill.<\/p>\n
The group runs a series of online games that allow amateur cyber sleuths and white-hat hackers to test their skills. Those who score well online\u00a0are invited to a series of regional, in-person competitions.<\/p>\n
The top performers at these events are then invited to the annual three-day masterclass and team-based competition where they face a realistic scenario created by experts from the sponsoring companies.<\/p>\n
About 70 percent of the finalists wind up being hired into cyber security jobs within 12 months,\u00a0Nigel Harrison, co-founder and acting chief executive officer of Cyber Security Challenge, said.<\/p>\n
The challenge began\u00a0in 2010, amid growing concern about the cyber warfare\u00a0capabilities of other countries, including China and Russia,\u00a0Harrison\u00a0said.<\/p>\n
It was loosely modeled on similar events in the U.S., such as those run by the U.S. Department of Energy\u2019s National Laboratories and the U.S. Department of Homeland Security.<\/p>\n
This year\u2019s competition focused on potential cyber attacks on the shipping industry largely because it was held at Trinity House, a Georgian building that houses a 500-year-old charity\u00a0empowered by the British government to maintain lighthouses and other aides to maritime navigation, Harrison said.<\/p>\n
But\u00a0he said ports and shipping were\u00a0important components of critical national infrastructure that are increasingly targeted\u00a0by hackers.<\/p>\n
Recently, A.P. Moller-Maersk A\/S, one of the world\u2019s largest shipping companies, posted a third-quarter-loss after having its business disrupted by a cyber attack last summer.<\/p>\n
Previous years\u2019\u00a0competition scenarios were scripted, but this year\u2019s featured a live \u201cred team\u201d made up of professional network penetration testers from the sponsoring companies.<\/p>\n
That made the war-gaming more realistic \u2013\u00a0and more difficult as the competing teams might plug one vulnerability only to see the attackers shift tactics and exploit another one.<\/p>\n
It also included hacks of industrial systems, such as those that control robot arms and factory equipment.<\/p>\n
Even many cyber security\u00a0experts are unfamiliar with the software that manages this kind of equipment, said Kevin Jones, head of cyber security architecture and innovation at Airbus.<\/p>\n
As Sophia\u00a0McCall\u2019s team struggled to repel a group of attackers that had compromised five of its six computers, forcing the group to work on one machine, the 19-year old student from Bournemouth University said the competition was the toughest she\u2019s ever participated in.<\/p>\n
\u201cIt\u2019s good but it\u2019s definitely been really challenging,\u201d she said.<\/p>\n
McCall said she normally practices hacking networks, not defending them and was finding that playing defense was teaching her to think differently<\/p>\n
\u201cIt caught me off guard,\u201d she said.\u00a0\u201cBut it is good to be on the flip side and see what that is like.\u201dThe push for realism also extended to requiring the competing teams to brief the board of the fictional shipping company on their investigation.<\/p>\n
They also had to present forensic evidence and the competition organizers\u00a0brought in actual trial lawyers, in the wigs and gowns they wear in the U.K., to grill the competitors.\u201cIt\u2019s not just about technical skills,\u201d Jones\u00a0said.<\/p>\n
\u201cWe need people with business knowledge too, and presentation skills. It even reaches into psychology, since human factors are one of the major vulnerabilities in any network.\u201d<\/p>\n
Jess Williams, now a cyber security\u00a0technical consultant at BT, is among those who have found jobs after being talent-spotted at the competition.<\/p>\n
She had been studying computer game design at De Montfort University in Leicester, England, in 2015 when on a lark she decided to try her hand at the online Cyber Security Challenge games.<\/p>\n
She advanced all the way through the finals competition, where she caught the attention of BT, which later offered her a job. This year, Williams returned to the competition to help run it.<\/p>\n