How useful or beneficial is participating in CTF contests for my security career?

Question

Yes, there are already some great questions and answers about CTF contests on StackExhange Security. But before I go down the rabbit hole of comparing all the CTFs out there, trying to find a team to join, and travelling to a conference to participate in a CTF contest, I'd like to hear some opinions on how beneficial this could be for my career.

One of my major concerns is that I want to learn real pen testing skills, not just now to crack clever code obfuscation puzzles and break into imaginary TCP services.

Answer 1

CTFs really are what you make them (like a lot of other things in life).

Networking You never know who you are talking to at these events or what type of opportunities arise with the people you are working with. You never know who will notice your skills at those kinds of events either. You may start a company with people on your CTF team or meet someone who offers you a great(er) job.

How it looks: I put victories for some of the CTFs Ive done on my resume (I guess Im the different kind of security person bethlakshmi mentioned :-) ) and this is almost always what potential employers ask me about.

Usually they ask questions like

1) What did you do for your team?

2) Did you ever work with technology they want?

Usual interview questions, but they honestly want to hear about the experience and can use it as a way to validate "This guy actually knows the things that are listed on his resume".

Your fears I would also say that breaking imaginary TCP services and funny puzzles are important to being a good pen-tester. People who have the skillset to break those puzzles understand not only the how to pen-testing, but also the "why things work" behind pen-testing. Potential employers will see you as being more eager to solve new problems, yada, yada.

Answer Is it for you? I guess you will have to try it. I can tell you it is a great way to have fun, make new friends, and learn more security. At the very least you will have people on your team who will help your pen-testing skills grow. In my opinion its worth it. For career advancement...that really depends on where your career is today and where you want it to be tomorrow.

Answer 2

I can say I've never even seen someone with this on their resume, but then there's a lot of different kinds of security folks out there. I have hired pen test type people - ie, people who are more focused at tearing down the wall, not building it higher... but primarily my teams have been composed of wall-builders and analyst typs -- so it's a fair point that I'm not the best to ask, as my work rarely involves recruiting to this demographic.

I'd think the combination of social network building and thinking about cracking things would be useful, and that your doing it in a legal, sanctioned way is important. I think we've moved past the days where cracking a corporate system Kevin Mitnick-style is going to be anything but a hindrance, so if you're looking for a way to meet people with similar interests and get some hands on time this area, I'd say it's a good as anything.

I'll say the one thing I see lacking is that organizational security issues are rarely as simple as the (rather complicated) technical side. Selling your discovery, explaining to management, documenting it, and proving you've done all the research you can do are as important for a job in this area as the raw pen testing skills... and I'm not sure any form of game-type scenario will get you there...

Answer 3

In the UK, and gaining traction in a couple of other countries is the CREST test. It could be seen as a sort of capture the flag, but with a very real and challenging environment that your ability to understand and penetrate is rated against.

Gaining CREST test cert is the top recognised penetration testing standard in the UK so this will DEFINITELY help your CV in security testing.

For CTF's in general, they may be seen as a useful extra on your CV but it will depend where you want to go. It wouldn't be one of the first things I would look for, but could be a good conversation starter.