I joined the “Micro Hardening” event on June 3rd.  Thus, I’ll report what I learn and what I feel.

1. The motivation for writing this report

Because I’d like to join this event with foreigners. There’re many foreigners in our company. Therefore, I wanted them to attend this event. However, the event will be held in only Japanese, not in English and there’s not any report or instruction in English. That will become a barrier to attend this event. Thus, I wrote this report to introduce and want to let you interested in Micro Hardening.

2. What is the Micro Hardening Project?

First, I’ll introduce what the Micro Hardening project is. Referring to the Connpass web site of MicroHardening, MicroHardening is a more casual version of the Hardening Project. Then, what is Hardening? It’s a project targeting to maximize the value of defending techniques. Hardening Project is also known as Full Hardening when we compare it with Mini or Micro Hardening.

Second, I’d like to introduce the regulation of Micro Harding. For 45 minutes, We have to deal with the threats(Cyber Attacking) of the attacker who tries to make our EC shop website system stop or tamper. Every attendee can start the game at any time by executing a start command. During the game, the crawlers buy the product on our EC site. The points will eval by the sum of the purchased price. If your system stop or tamper, the points will stop increasing because the crawler can’t purchase our product or be hard to purchase. By the way, this game designed to try it greater than or equal 3 times. Therefore, we can observe the situation of the attacking and attempt some measure to each attack.

In my opinion, the Micro Hardening is not only a security competition but practical learning method of how to measure the cyber attacking.

3. Preparation for Micro Hardening

I had done below preparation before the day.

1. Watch the video of the previous full hardening event.
   I had watched the video and written down the attacks and how to deal with those attacks.
2. Make a todo list
   I had made a todo list about what should I do in the game and assigning priority for them. (e.g. Change password, Delete not required user, and so on)
3. Write a script
   Because I want to automate dull tasks(moreover, it consumes much time), I made shell script referring to the script made by a member of our company. Unfortunately, my script didn’t work on the environment of the game. I did it manually because I thought It was a waste of time to fixing the script.
4. Keep your condition healthy
   It’s the most important factor in everything! However, I was not a perfect condition because I have to do my assignment the previous day. Therefore I stupidly stayed up all night before. I strongly recommend keeping your health condition fine.

4. On the Day

I joined with my roommate(@Enderd) to this event. Thanks for attending despite the sudden invitation. Then, I went to the venue earlier than he because I had to prepare the venue for the event.

First, Mr. Kawaguchi introduced us to how we connect to the server and how to check the score. Please pay attention to permission of using a well-known port.

Second, we checked up our environment and set up the environment to defend from attacks. Then, the first period was started. I can’t write a detail because it becomes a spoiler but many cyber-attacks happened and we dealt with it. After the game finished, we have some breaks and prepare for the next period.

The more we play, the more the points increase. I get only 60,000 points at first but it increased to 110,000 points at third.

5. My impression

I think it is good for training on how to deal with the threat and to know how difficult to protect the system. After all, I learned 3 things.

1. Record
   We have to record when we attacked and how we deal with it. It’s useful for only the game but making a report. If you have the record, it becomes easy to defend our system.
2. Check Logs
   Most attacks can be found in log files of the server. Therefore, don’t miss a suspicious log.
3. Share
   We must share information with teammates. I used a todo list to do it but it not satisfied the required function. I recommend a whiteboard for sharing information because it can write a problem clearly and erase it easily.

6. Conclusion

The Micro Hardening Project is useful for training on how to deal with cyber attacks. And I learned 3 important points. Those are records, check logs, and share. Overall, I came to want to study hard to improve my skills in protection.

I hope someone who reads this article will be interested in Micro Hardening. Finally, I’d like to thank Mr.Kawaguchi and all people who help us to hold this event.