A bunch of Iowa State University students will be pulling an all-nighter tonight (Friday), but they’re not partying or studying for midterms. Computer-science Professor Doug Jacobsen says it’s part of the work they do helping business clients fend off computer criminals. It gives them realistic experience with the fact that security attacks happen all the time and it’s the kind of thing businesses have to stay on top of. Jacobsen says it’s kind of fun, as the students stay up all night and will face off with a “red team” of foes experienced at breaking into systems. Twelve teams of students are defenders, and the “red team” of security professionals from central Iowa will all be the attackers. That “read team” is made up of security professionals, and Jacobsen explains many do this sort of thing for a living. They stage attempts to get into computer systems as a kind of “white-hat hacking,” he says, and many have found themselves up against all sorts of attacks. He’s heard the stories of companies that hire computer criminals once they’ve been caught, but thinks that’s wishful thinking. Jacobsen calls the idea of hiring a computer criminal kind of an urban legend, noting many corporations will not hire someone who’s a convicted “hacker.” The students get a great opportunity to defend against computer attacks, and the “attackers” spend a lot of time with the students, talking with them about what they saw and did. One of the things the students learn is that it’s more difficult to defend than attack; as Jacobsen puts it, “the attackers just need to find one way in, but the students have to stop all the ways in.” He says the lesson is that defense is a lot more fun than offense — much more challenging. He says it’s like a big chess game, and although the students will have to stay up all night.
