The Round Framework¶
Four hours goes fast, and the images are built so that the obvious problems hide the expensive ones. A fixed order keeps you from spending the first hour on the wrong thing. Use this order on every image, Windows or Linux, until it's a habit. The first ten minutes page covers steps 1 to 4 in detail.
The order¶
| Step | What | Why here | Time |
|---|---|---|---|
| 1 | Team ID, scoring report connected, snapshot | Nothing counts until the scorer is talking, and the snapshot is your only undo | 5 min |
| 2 | README, read twice, lists written down | Every decision for the next four hours is "does the README allow this?" | 10 min |
| 3 | Forensics questions | The answers are evidence, and hardening destroys evidence. A user you delete in step 6 can't be asked what they last ran. | 15 to 30 min |
| 4 | Start updates in the background | They take the longest and need no attention while they run | 5 min to start |
| 5 | Accounts: list, compare, remove, fix, then the sudo or Administrators group | The most points per minute on every image, and the thing an attacker uses first | 20 min |
| 6 | Password and lockout policy | Cheap, and it protects every account you just fixed | 15 min |
| 7 | Network doors: listening ports, services, firewall, SSH or RDP | Anything an attacker can reach from outside | 30 min |
| 8 | Unwanted software, prohibited files, malware persistence | The planted tools and the thing that restarts them | 30 min |
| 9 | Built-in protections: Defender, UAC, sysctl, kernel modules, AppArmor, bootloader | Settings that were turned off on purpose | 30 min |
| 10 | Server roles the README requires | Harden what has to stay running | 20 min |
| 11 | Auditing and logs | Turn on the record, then read it for what you missed | 15 min |
| 12 | Verify the slow things finished, re-read the README, final snapshot | Updates done? Reboot if the kernel changed. Anything in the README you skipped? | 15 min |
The times add up to about four hours with slack. If you're behind at step 8, don't skip it for step 9; the planted backdoor is worth more than a sysctl.
Two people, one image¶
With a partner, split by group, not by half the list: one person does accounts and policies while the other does network doors and unwanted software. Both read the README. Neither touches the other's area without saying so, because two people editing /etc/pam.d/common-auth or the same GPO at once is how an image gets broken.
Keep a log¶
A text file, on the image or on paper, with one line per change: what, where, why. Three reasons. When the score drops, the log says what you just did. When a forensics question asks what you changed, you have the answer. And at the end of the round it's the list of things you know how to do, which is what you'll turn into a script for next time (How to Use These Pages).
When the score goes down¶
Stop. Read your last three log lines. The most common causes, in order: a service the README required was stopped or removed, a user the README authorized was deleted or removed from a group, a required program was uninstalled, a policy value went outside the sensible range (a 5-character minimum password is worse than a 0). Undo the last change and watch the score. If that doesn't do it, the snapshot from step 1 is the fallback.