Blue Team

What we do

We train to defend systems hosting critical services from adversaries. We track down misconfigurations and indicators of compromises while hardening these systems to keep the service running and score points.

Some of the concepts and skills that we learn are:

Service management (Web Servers, DNS, Databases) and hardening

Setting up defensive infrastructure (centralized logging and network prevention/detection systems)

Detecting and handling persistence and backdoors

Configuring permissions, analyzing network traffic, and scripting success

Check out our blue team resources

Resources

Getting started with cybersecurity can be daunting --- below is a collection of resources we recommend for beginners looking to getting started with a variety of cybersecurity topics.

Getting Started
arrow_forward_ios NCAE Cyber Games
arrow_forward_ios pwn.college If you've never used Linux before, the Linux Luminarium module teaches you how the terminal works. The rest of the modules cover a variety of topics that are irrelevant to blue teaming.
arrow_forward_ios TryHackMe Guided learning paths and challenges, ranging from beginner to advanced

Further Learning
arrow_forward_ios HackTheBox Practice Hacking and PenTesting on a range of virtual machines. Understanding how attackers think makes you a better defense.
arrow_forward_ios Hal Pomeranz's Intro to Linux Forensics An excellent resource for tracking down indicators of compromise in Linux
arrow_forward_ios hackback.zip - Windows A presentation by a UFSIT alum that covers all things Windows blue teaming.
arrow_forward_ios hackback.zip - Purple teaming A presentation by a UFSIT alum that serves as an introduction to purple teaming (how to detect and improve from attacks)

Other
arrow_forward_ios KC7 A series of games training you to use KQL like a SOC analyst. This is perfect for any blue teamer in a professional environment that uses Microsoft Defender.

Competitions

Collegiate Cyber Defense Competition (CCDC) January (TBD)

The premier defense competition, which many others are modeled after. Teams are given a simulated corporate network to defend against live penetration testers while completing injects.

NCAE Cyber Games February (TBD)

This is a great blue team competition for beginners. While it retains similar elements to CCDC, it is less intense so participants can focus on learning and having fun. Additionally, there is a CTF component and no injects.

UBNetDef's Lockdown April (TBD)

Competitors defend a simulated corporate network against live penetration testers while completing injects.

Tuesdays at 6PM

Mala 5210

What we do

Where do I start?

Resources

Competitions