AWSN – 2024 Incident Response Competition

Overview

Retrospect Labs and the Australian Women in Security Network (AWSN) have partnered again to provide a competition style incident response exercise for women working, studying, and interested in the sector across Australia. The competition is an exciting and fun way for you to use both your technical and non-technical skills to work through a realistic cyber incident - in a self-paced way - over 10 days. You will be placed into a team of up to five people (all with mixed skillsets) to work through the fictious incident, completing tasks along the way. At the conclusion of the event, there will be a judging panel, with the winning team announced and prizes for those teams who place in the top three!

This competition could not have happened without the support from the event’s key sponsor, the Australian Signals Directorate (ASD).

Note: This event will feature a brand-new scenario, so those who have previously participated in a competition provided by Retrospect Labs, are encouraged to get involved and participate again in this competition.

‍What does this competition involve?

For ten days, starting on Friday 11th October 2024, participants will work their way through a scenario that simulates a real-world cyber incident, impacting a fictitious organisation. The scenario is designed to test your incident response skills, and so it includes several aspects common to incident response. For example, the exercise will include forensic artefacts that participants can analyse to identify various Indicators of Compromise (IoCs), as well as understand what malicious activities have occurred and how the adversary undertook those activities (their Tactics, Techniques, and Procedure’s used). Participants will also be required to perform tasks that relate to managing the media, providing communications to senior leadership, and providing legal and privacy considerations in response to the incident. If you have an interest or skillset in these areas, you will also fit great into a team!

Throughout the exercise, teams will submit certain tasks common to incident response activities. These tasks will be used by a panel of expert judges, who will evaluate the performance of each team during the event and based on the tasks they complete we will name a winner during a virtually hosted closing ceremony!

Not only will the winning team earn the title 'Winner of the 2024 AWSN Incident Response Competition', but there are also some awesome prizes up for grabs!

‍Prizes

The full list of prizes is still yet to be confirmed, but we will announce all of the amazing prizes when we can!

‍When is it running?

Competition official opening – Friday 11th October 2024 at 9am (AEST)

Competition official close – Sunday 20th October 2024 at 11:59pm (AEST)

Closing Ceremony & Panel Event – Date to be confirmed.

In the lead up to, and throughout the event, there will also be several virtual sessions that you can choose to attend. These sessions will give you a chance to hear from various industry professionals who may share some tips & tricks that you can leverage throughout the event, provide some insight to what they do, and/or discuss an incident that they were personally involved in! More details on these sessions will be available closer to the event.

Who's this for?

Anyone in Australia who identifies as a woman, working in cyber, studying a related degree, or if you are interested in learning more about incident response and have some basic cyber skills or knowledge, we encourage you to register and to give it a go!

It would be beneficial to have some SOC/Incident Response skills (some familiarity with common incident response tools or incident response frameworks). However, you do not need to have these technical skills to participate in a team.

We don’t expect you to know everything about incident response, but we want you to want to learn along the way, find out what you do enjoy about IR, and get excited about it!

Registration

To make this competition as fair as possible, teams will be made up of individuals based on their individual strengths. You register as an individual, where you will be asked to answer a few questions that will give us an understanding of your experience. This information will be used to put together the teams, so please answer the questions as best you can! Teams will be made up of women from around Australia – so you might be working in a team with people from a different town, city, or state!

Based on participant feedback from the previous events and to support a great cause, for this year’s event, a non-refundable fee of $15 is required upon registration, in which all proceeds will be donated to a wonderful charity: White Ribbon Australia

We understand that some of you may be experiencing financial difficulties or are unable to pay this fee. If this is the case, we would still love you to participate, so we ask that you reach out directly to: programs@awsn.org.au

Once you have registered and the teams have been finalised, your team will receive an email with some further information and instructions (note, your email will be shared with your team members). Closer to the competition start date, you will be invited to a Slack channel, which will contain a space for you to communicate with your team, and to receive any communications from the competition organisers during the event.

Please note that places are strictly limited to 250 participants, and that the competitions in previous years sold out very quickly! If you’re not successful gaining a place this time round, we will make sure to keep your details in case a space opens up if someone withdraws.

We will have a wait list available once tickets are fully allocated, so if you can no longer participate, please let us know as soon as possible.

Registrations open – Monday 26th August 2024 at 10am (AEST)

Registrations close – Tuesday 10th September 2024 at 5pm (AEST) – If places are not fully allocated prior.

Your team will also be given access to Retrospect Labs cyber security exercise platform, Gauntlet. Gauntlet will be used for distributing the scenario (known as injects), forensic artefacts, and is where you will submit your tasks.

Response Lab

Following the feedback from last year's event, as well as to reduce the technical resource requirements for participants, all teams will again be provided access to a cloud-based forensic environment, which we call Response Lab. This environment will be primed with all the tools you require to analyse the technical artefacts involved throughout the competition, and will be simply accessible from your internet browser! That means you don’t need to set up your own virtual machines or forensic labs this year! Unless, you want to of course.

Case management and collaboration with Cydarm!

Case Management solutions are an important tool in an incident responder’s arsenal, that is used to ensure incident response activities are effectively managed, and tracked throughout an investigation. As many of you who participated in last year's event loved being able to use this amazing solution, Cydarm has again kindly offered the use of their case management solution to this year's participants throughout the competition. This will allow you to test out an industry standard solution, used by many real-world incident response teams, as you respond to the realistic incident you will be working through!

What else do I need to know?

Participants will be able to control the pace of the exercise and will have the flexibility to compete outside of work hours. You can start the exercise whenever you like, work through it at your own pace – but everything must be completed by 20th October. Participants won't be judged on how long they take to complete the challenge.

Places are limited to 50 teams of up to 5 participants.

Out of respect for the organisers and the judges taking their time to run this competition, as well as for your other team members, we would appreciate it if you let us know if you are no longer able to compete, by sending Retrospect Labs an email at least 48 hours beforehand. Thank you.