Questions and Answers

How Many VMs Can We Use?
     - from the Norwich Team

Q: Will the number of simultaneous VM’s running be restricted on the host
XP machines? Specifically, as long as the original “server” stays running, could
we add other VM’s to the same host?

 
A: There is no "rule" limit on the number of VMs you may run. We have employed
VMs to simplify the task of the Black (operations) team in deploying identical
servers. However, if you wish to clone, install, or otherwise configure additional
VMs in your enterprise, feel free to do so. As the question indicates, the original
server must keep operating, and at the same external IP address. Other than that
we do not care.

NOTE: the "same IP address" requirement implies that you might use NAT or some
other technology to move servers from one physical platform to another, or even
consolidate servers, as long as a user on the outside of your enterprise can still get
to it with the same IP address as at competition start.

Can We Use Alternate Software for Services?
     - from the U Maine Team

Q: I wanted to know if we are allowed to use applcations other than ones listed
in the packet for providing services (assuming they are open-sourced, free, etc).
Specifically I want to know if I'm allowed to use Exim4 instead of Sendmail, etc.

 
A: You are allowed to use alternate applications as long as (as the question stated)
they are freely available and require no special license (i.e., no license for a fee).
The only gotcha with these is that they must offer an identical view to the user,
operating on the same port, requesting logins and passwords in an identical manner,
etc. Keep in mind that we have an automated service checking program (the scoring
engine) that checks for services to be up and it cannot be customized to new servers.
So ... if your  server looks and reacts identically with the original, you are all set.

How Can We Bring in Scripts We Have Written?
     - from the SUNY/Buffalo Team

Q: How can the team access scripts they have written without breaking any of
the rules?  Do the scripts actually have to be written once they arrive or can they
be written in advance and posted online?

 
A: Creating a staging site, where you post software (even software your team
has written) is expressly prohibited by the rules. We passed this question on to
the National organizers,  to see if they allow teams to burn a CD and have it
pre-approved by the competition staff. Their reply was:

With regards to pre-written scripts the rule for every national event has
been pretty simple – you can bring in anything you want via hard copy
but no USB drives, CDs, archives of pre-written scripts, etc.  It’s annoying
to the teams I know, but there’s just really not a good way for us to be
able to screen every script or file that every team would want to bring in.

We wish to reflect the National rules as closely as possible, so that the winning
team at the Regional does not depend on an advantage that they would lose
at the National.

As a result, the only way to bring in scripts or code that your team has written
is on hardcopy.

Exactly How Does Scoring Work?

Q: This is an anticipated question ... not from any team in particular, but as
an amplification of the answer to the questions below from Northeastern.

 
A: During the competition, your team may accmulate or lose points in the following
ways:

Accumulate points:

• Every few minutes, the scoring engine will test to see if your services
  are up and working. This is not a skin-deep test. The test may involve
  logging into your web site, making a purchase, sending an email, etc.
  If any of these fail (perhaps because you did not inform us of a password
  change) the service is considered down. Up services accumulate points
  on each test, down services do not.
   
• The white team will periodically send in business injects. These are intended
  to mimic real events that might occur in a business environment. If you
  satisfy the requirements of the inject you will gain points.

Lose points:

• When a service is down, you do not accumulate points and thus lose
  ground with respect to teams that have the service up. Also, when a
  service is noted as down, a timer is started. When it has been down for
  over an hour, point deductions are assessed. As services stay down
  longer, these deductions accumulate and can become severe.
   
• The BLACK team will provide disaster recovery when requested. This amounts
  to resetting a host to its state at the start of the competition. Each such
  request will cost you points.
   
• When the RED team successfully penetrates your defenses, they first
  attempt the same penetration on all teams. Then, a report is filed with
  the WHITE team regarding the nature of the penetration and what teams
  were susceptible. The WHITE team assesses a penalty in ponints to
  each team that was penetrated. You are not notified by the WHITE team.

  If you detect a penetration, defend against it, and write a report to the
  WHITE team detailing the attack and your mitigation efforts you can
  win back up to 50% of the points deducted.

When Does Scoring/Attack Start? - from the Northeastern Team

Q: During the first hour of competition are services being scored?  Is the
red team able to attack?

 
A: During the first hour of competition, the Red team will not be overtly attacking
your enterprise. They MAY engage in espionage, but may not install software,
change configurations, or in any detectable manner affect your systems.

During the first hour of competition, you WILL be scored on services. See the
answer to the question above for details on how this works

Does the Team That Competes in the Regionals Have to be
Identical to the Team That Competes in the Nationals?
     - from the RIT coach

Q: It’s not clear whether the team that competes in the REGIONAL is one that
MUST compete in the NATIONAL. For example, if a team has a member who WILL
be available for the regional competition  but may NOT be available for the Nationals,
(on co-op, out of the country, or otherwise) how will / should that be addressed?

 
A: There is no specific rule governing this question. In fact, a team is promoted
to the NATIONAL because we (as the organizers of the REGIONAL) report the
school and coach's name to the organizers of the NATIONAL. We do not provide a
team roster. So, there is no operational reason that you cannot make tweaks between
the REGIONAL and NATIONAL events.

We view this as similar to any intercollegiate sports team, in which the team that
attends any one event may differ in personnel from the team that attends another.
It is the "team" that represents the "school."

Why Are Coaches Required?

Q: This is an anticipated question that we will answer in advance. Each team
must have a coach in attendance during the competition. Why? .

 
A: The reason for this is
that, if a problem arises that requires a changing or clarification of the rules,
we wish to allow the coaches an oversight role in deciding how to proceed.

The White Team will ask the coaches for input on a ruling. This will be done by
going to the alternates & coaches room (see below) and pulling out whatever
coaches are present for an informal meeting. This input will then be folded
in to the ruling. The final authority for all rulings is still the White Team, however
we wish to provide transparency to the teams, through their coaches.

Rules Question Regarding Alternates from the RIT Coach

Q: What are the rules about alternates? How many can we have on a team? 
When can they be subbed in? If there is a limit, when do I have to designate the
alternates for my team?

 
A: Each team may designate one alternate. The nationals permit no alternates,
but we allow an alternate to provide teams with some leeway in case a team member
becomes ill or for some other reason cannot complete the competition. It also
gives teams a little 'depth' in case a team member must be replaced between
the regional and national competition.

To discourage 'gaming' this rule, we only allow 1 alternate and only that designated
alternate may be substituted during the competition. Also, once the substituteion
is made, it is for the remainder of the competition ... the original member may not
return to the competition after being replaced.

Your alternate (if you have one) must be designated at registration time. We will
ask you for a list of team members' names shortly before the competition, so we
can have badges ready. If you make changes after that, we will manage as best we
can.

Finally, during the competition, we will have a team room set up for alternates and
team coaches to play along. If a team has other interested students with them,
and there is space after alternates and interested coaches are accomodated, they
will also be allowed to play along.

Rules Question on Team Make Up from the U Maine Team

Q: Can teams include students from other departments at the same university?
Can they include students from other campuses of our state university
system? We are having trouble getting a full complement of students from
our department.Answer to question 1 is absolutely yes – they’re all students
at the same school.

 
A: We have teams made up of students from different departments all the time. 
Actually I encourage that – bring some business students to run processes or
management students to help organize.
 
Second question no if I am reading it correctly.  UTSA and UT Austin are part
of the UT system, but they’re separate campuses and very different schools. 
However UTSA has 3 campuses here in town – they’re all still part of UTSA though
and fall under the same school.  So if it’s U of Maine downtown and U of Maine
suburb campus that would be fine but if it’s U of Maine and U of Maine at Fort Kent
that would be no.