Overview

CISA’s annual Capture the Flag (CTF) is oriented around an incident response scenario involving attacks on critical infrastructure. This year, the featured critical infrastructure sectors are city infrastructure, water purification, medical facilities, and railway.

The CTF is open from Saturday, August 31 at 1:00 p.m. EDT through Wednesday, September 4 at 12:00 p.m. EDT.

Challenges are presented jeopardy-style, with a wide range of difficulty and a set of introductory challenges, and teams may contain up to four players. This CTF runs alongside the Mal.Con ’24 conference, but meeting attendance is not required to participate.

Registration opens Saturday, August 24 at 1:00 p.m. EDT and remains open until the end of the competition, so players can join at any point. Registration will be located at https://ctf.cisaicsctf.com/.

Scenario

In this Capture the Flag event, you will be serving the role as an incident responder investigating various cyber incidents that occurred in the small city of Driftveil. This CTF is split into five main categories:
• Security Foundations: introduction challenges that provide an introduction to Malcolm and an overview of basic ICS and security concepts
• Driftveil City: Driftveil City is a small city on the coast and has been experiencing issues with their city infrastructure ICS protocols
• Castelia Solutions: Castelia Solutions is the primary water-treatment facility for Driftveil and have been experiencing issues with their Historian and various embedded devices
• Virbank Medical: Virbank Medical is the main hospital serving Driftveil and its surrounding towns and has been experiencing issues due to ransomware and poor cyber hygiene
• Anville Railway: Anville Railway is a large rail-transport operating company headquartered in Driftveil and has been experiencing issues with their ICS network and devices

When solving challenges for these organizations, you and your team will be working alongside and assisting their engineers, technicians, IT, and security teams to investigate and remediate their cyber incidents. Each organization will have an introductory challenge to brief you on their situation and what they need your team's help with. The Security Foundations challenges serve as introductory-level challenges on various security and ICS concepts and are unrelated to the scenario.

Each company has provided network traffic to assist you in your investigation. All network traffic was taken on Thursday, June 20 2024 and has been ingested into Driftveil's security operations center's (SOC) Malcolm instance.