If you are applying for a cybersecurity job and want a resume filler to go under the Activities or Other Interest section (or even accomplishments if you are good), consider becoming a Capture the Flag (CTF) junkie. Capture the Flag competitions are not just for middle school kids at summer Cyber Boot Camp. They have evolved into a phenomenal learning tool for all levels of cybersecurity students, as well as, a way for anybody to hone and practice their craft in a fun and meaningful way.
Capture the Flag Builds Cyber Skills
The concept of CTFs is simple. Solve a problem and get a flag. The categories of CTF can vary widely, but they will usually consist of the following: Cryptography, Open Source Intelligence, Reverse Malware Engineering, Steganography, Forensics, Protocol Analysis, Packet Sniffing, and System Programming. For example using forensic tools on a photograph can reveal some interesting things about the picture including who took it. There can be CTF’s focusing on one or two areas, or several categories in the same competition.
Opportunities for all levels
There are multiple sponsors of CTFs including government agencies, companies, and educational institutions. Many of the CTFs will allow non-student or industry teams to participate and some do not have minimum or maximum numbers of team member requirements. If you are anti-social and cannot stand anyone but your dog, there are individual categories too. Some CTF competitions or challenges focus on real problems like crowdsourcing the location of a missing person through meta data such as geo location. Others will look at software bugs that may not have well known or incomplete fixes in hopes the contestant can display skills worthy of them being offered a job. Prizes can be real money, scholarship awards, items such as iPads, trophies, and medals.
There are even rolling competitions where you build up points competing in multiple events over the year, somewhat similar to a professional golfer establishing his ranking. One other thing that is great about CTFs is beginners are not only allowed, but they are also encouraged to participate in novice level competitions against people with similar abilities. My favorite site for CTF scouting is CTFtime.org, which has a great list of past and upcoming CTFs and links to contest websites for more information. Both CISA and NSA also have CTF type events held regularly. Most, if not all of the events are virtual so you do not even have to leave your basement. Reddit and Quora both have substantial discussion areas on CTFs where you can find links to practice challenges or past CTF question databases. The site ctf.cybersoc.wales is a great practice tool and costs nothing other than a registration to use.
Resume Skills Make You Stand Out
So back to the important part: your resume. Putting down that you have actively participated in multiple CTFs over the past year can show a potential employer you are willing to hone your skills on your own time because you like the profession. If you place high in the CTF standings, that is even better. I always suggest to my students when they build teams to find not necessarily their friends for teammates, but those whose skill sets complement theirs. This gives them a better chance of being competitive in events and teaches them some group dynamics and team shaping lessons, which is another great strength of a job applicant that employers look for.
