A CCDC Blue Team Interview: Heather Lawrence
Welcome back! I got the chance to speak with Heather Lawrence, who was on the winning CCDC team this year, University of Central Florida. I asked her the same questions as other interview candidates, but was struck at how different her answers were. She emphasized the teamwork, dedication, and training it takes to be a champion at CCDC. Without further ado:
DB: Hey Heather, let's start with more about you. How long have you been involved in Information Security? What are your areas of interest / expertise within Infosec?
HL: I switched fields from a nuclear engineering technician over to infosec after leaving the military and going back to college to get a degree. That puts me at a bit of a disadvantage (depending on how you look at it) as I've only been formally studying the field about 3 years now. Within infosec I'm more of a jack-of-all-trades than possessing a particular expertise. My current position has given me more experience with coding Python, regulatory compliance, and incident response.
DB: How long have you been involved with CCDC? How many Red / Blue style events have you been involved with? How long have you been playing Infosec games?
HL: I was on the 2014 team as an alternate and the 2016 team as a core member, so 2 years. I don't have as much experience with red v. blue, but I'd like there to be more of them - I've been playing CTFs sporadically over the last 3 years including CSAW, hack.lu, Cyberlympics, and UConn's CyberSEED. I'd like to ramp up my abilities and win Defcon CTF in the future.
DB: Do you think CCDC has had an impact on your skills as a practitioner?
HL: As practitioners we still have to operate as part of the business unit - thus we still need to be able to communicate effectively and forward the mission of the business or we cease to be useful. CCDC forces participants to work as part of a business while under pressure, so I feel that CCDC helps me develop my skills.
DB: Do you think CCDC has an impact on ones teamwork or ability to work with a team?
HL: Do I think CCDC has had an impact on one's ability to work as part of a unit? Absolutely. We had a member on our team this year that could be difficult to work with under pressure and working with them gave me both a lesson in patience and exercise in communicating effectively with other team members that are experiencing high levels of stress. As an example of this, this year a team member asked to have a live CD burned in order to strengthen our network defense - that request kept getting punted down the line to the point of aggravation. As a team we had to stop what we were doing and triage tasks. That required communication and teamwork in order to get the work done, including burning a live CD, in a timely fashion. I would work with any of the members of my team again.
DB: Do you think CCDC has an impact on ones ability to work under pressor?
HL: Yes. See the above example.
DB: Do you think the competitive environment of CCDC cause people to innovate?
HL: Red teamers are notoriously good at their jobs. They break into systems for a living and love the work that they do. As such they are motivated attackers during the competition. I feel that this causes teams to innovate - teams aren't competing against an AI or a static program, they compete against real threats forcing them to innovate to defeat another human mind from breaking into their systems.
DB: What are some of the core values you think CCDC promotes?
HL: CCDC promotes teamwork and communication and inspires motivation in the next generation of information security practitioners.
DB: Does training for CCDC make information security training in general more enjoyable than vs a more traditional context?
HL: Actually no. While the hands-on aspect of preparing for CCDC does increase one's skill set, the actual competition is not real life and training for the competition only partially prepares a student for a career in information security. Training on our team is another part-time (unpaid) job that is very time intensive and draining. In a more traditional context I have the flexibility to drill down into nuanced problems, but for CCDC I have to possess a more overall knowledge base.
DB: Do you know anyone who's gotten a job from CCDC?
HL: Yes. There are five prior members that have leveraged their wins from CCDC to help place them in positions in the workforce - however it should be noted that they worked hard to sharpen skill sets that would have otherwise got them hired, and winning CCDC was a way to put themselves in front of managers/companies that were hiring.
DB: This year potentially being the last competing on the Blue side of the house, whats your most lasting impression of CCDC?
HL: CCDC was difficult to compete in - the time investment alone was not trivial - but I remember practices and team dinners fondly as they allowed me to learn more about my teammates or as I call them, friends.
DB: Hey Heather, let's start with more about you. How long have you been involved in Information Security? What are your areas of interest / expertise within Infosec?
HL: I switched fields from a nuclear engineering technician over to infosec after leaving the military and going back to college to get a degree. That puts me at a bit of a disadvantage (depending on how you look at it) as I've only been formally studying the field about 3 years now. Within infosec I'm more of a jack-of-all-trades than possessing a particular expertise. My current position has given me more experience with coding Python, regulatory compliance, and incident response.
DB: How long have you been involved with CCDC? How many Red / Blue style events have you been involved with? How long have you been playing Infosec games?
HL: I was on the 2014 team as an alternate and the 2016 team as a core member, so 2 years. I don't have as much experience with red v. blue, but I'd like there to be more of them - I've been playing CTFs sporadically over the last 3 years including CSAW, hack.lu, Cyberlympics, and UConn's CyberSEED. I'd like to ramp up my abilities and win Defcon CTF in the future.
DB: Do you think CCDC has had an impact on your skills as a practitioner?
HL: As practitioners we still have to operate as part of the business unit - thus we still need to be able to communicate effectively and forward the mission of the business or we cease to be useful. CCDC forces participants to work as part of a business while under pressure, so I feel that CCDC helps me develop my skills.
DB: Do you think CCDC has an impact on ones teamwork or ability to work with a team?
HL: Do I think CCDC has had an impact on one's ability to work as part of a unit? Absolutely. We had a member on our team this year that could be difficult to work with under pressure and working with them gave me both a lesson in patience and exercise in communicating effectively with other team members that are experiencing high levels of stress. As an example of this, this year a team member asked to have a live CD burned in order to strengthen our network defense - that request kept getting punted down the line to the point of aggravation. As a team we had to stop what we were doing and triage tasks. That required communication and teamwork in order to get the work done, including burning a live CD, in a timely fashion. I would work with any of the members of my team again.
DB: Do you think CCDC has an impact on ones ability to work under pressor?
HL: Yes. See the above example.
DB: Do you think the competitive environment of CCDC cause people to innovate?
HL: Red teamers are notoriously good at their jobs. They break into systems for a living and love the work that they do. As such they are motivated attackers during the competition. I feel that this causes teams to innovate - teams aren't competing against an AI or a static program, they compete against real threats forcing them to innovate to defeat another human mind from breaking into their systems.
DB: What are some of the core values you think CCDC promotes?
HL: CCDC promotes teamwork and communication and inspires motivation in the next generation of information security practitioners.
DB: Does training for CCDC make information security training in general more enjoyable than vs a more traditional context?
HL: Actually no. While the hands-on aspect of preparing for CCDC does increase one's skill set, the actual competition is not real life and training for the competition only partially prepares a student for a career in information security. Training on our team is another part-time (unpaid) job that is very time intensive and draining. In a more traditional context I have the flexibility to drill down into nuanced problems, but for CCDC I have to possess a more overall knowledge base.
DB: Do you know anyone who's gotten a job from CCDC?
HL: Yes. There are five prior members that have leveraged their wins from CCDC to help place them in positions in the workforce - however it should be noted that they worked hard to sharpen skill sets that would have otherwise got them hired, and winning CCDC was a way to put themselves in front of managers/companies that were hiring.
DB: This year potentially being the last competing on the Blue side of the house, whats your most lasting impression of CCDC?
HL: CCDC was difficult to compete in - the time investment alone was not trivial - but I remember practices and team dinners fondly as they allowed me to learn more about my teammates or as I call them, friends.
