FSEstyle

Description: A sword is an offensive weapon which is normally used for attacking your opponent. That's why the Red Team may be represented with a sword in the CTF game.

Description: A shield is something that a warrior normally wields to defend instead of attacking. Thus the Blue Team may be represented with a shield in the CTF game.

Description: The shield is defensive but the sword is offensive, and that's what the cybersecurity red team does in the CTF game.

Description: A cool design about the blue team, a specialized cybersecurity professionals that defends the organisation network in a CTF game.

Description: Before Kali Linux became that popular, it was known as Backtrack Linux and this distribution was renamed to kali from 2013.

Description: One of the recommendations of secure coding is to practice pair programming, because 4 eyes catches more than 2 and it is a good way to share context and knowledge between coworkers.

Description: A funny design for someone who can't use a tool other than kali linux for security assessments or penetration testings. It is the most used and well-known Linux distribution for hunting vulnerabilities.

Description: Protect your organization network being a blue teamer as the spartan warrior defending their people and their country in the thermopylae battle.

Description: It is really important to aware or even train the coworkers to detect phishing so they will think twice before clicking any link on any suspicious email. In any case, this design will help to spread the word around your organisation.

Description: A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

Description: Despite all your efforts to increase the security posture of your organisation and no matter how good are the tools you are using, the malicious actors will always try to take advantage from the users which normally are the weakest part of the organization security.

Description: If you passed the OSCP exam and finally got the certification, then this design is absolutely for you! You've tried hard so you deserve this badge!

Description: Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.

Description: Besides training your coworkers to identify any phishing attempt, it would be great also to remind them to report the phishing attempt so, the antispam or the phishing prevention will learn to filter them and also, the soc team will receive a sample to further extract the IOC to blacklist.

Description: Threat hunting is one of the most interesting activities that the soc team does, in order to detect any potential threat or to create new detection use cases for future attacks.

Description: An awareness design to remind coworkers to don't leave unlocked their computers even for going to the toilet.

Description: Yet another security awareness design, but not less important, about the bad practice of saving clear text passwords in notepad. They should be saved in a password manager tool instead.

Description: An arcade look and feel of the cybersecurity purple team.

Description: Put your trust in a cybersecurity specialised profiles, call the blue team that will defend your organization network in a gamification manner.

Description: OWASP is a foundation that provides trainings, guidelines and useful tools for cybersecurity professionals to make the internet a safe place.

Description: An arcade look and feel of the blue team design. Great for wearing it in the capture the flag game.

Description: This should be mainstream when it comes to provide access or authorisation but, in some cases, it is not followed properly. Therefore, this design is to remind about this best practice.

Description: Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

Description: This is a typical attack that takes advantage from a web server misconfiguration. The result is that the malicious actor can browse the server file system.

Description: Fuzzing is an important testing to be done on running applications because it can catch flaws that static analysis can't like buffer overflows or memory corruption.

Description: The red team design in an arcade look and feel, great for the capture the flag game.

Description: If you want to test and prove your network, call the red team to do so. Any findings that they can report will be less findings for an eventual attacker to benefit from.

Description: If you think that your architecture doesn't needs to be reviewed then try to threat modeling it. Probably you'll know about new weakness overlooked previously thanks to the different points of view provided by the different participants.

Description: Layered defense or defense in depth, both are terms to refer to the same strategy to protect the assets from your organization. To put multiple and different security controls from the technical ones to administrative ones.

Description: Instead of giving systematically sudo or suid privileges when a non root user cannot perform an action on the system, the Linux capabilities are one of the alternatives to keep the least privilege principle.

Description: Obfuscation is not necessarily the same as encryption and sometimes the terms are confused. But the cryptography awareness is that obfuscation can be reversed, but encryption with a proper strength cannot be decrypted with our current computation power.

Description: An awareness design to avoid Linux administrators to provide sudo privileges for every single permission denied they get, when trying to run any command with a non root user.

Description: If the office macros or scripts are not disabled through GPO in your network then you have to deal with potential malware associated to office documents.

Description: For cybersecurity professionals the logs are the most important component since they can provide the required visibility, because you can't defend what you can't see.

Description: This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

Description: One of the ways to reduce the risk is to limit the impact in case of compromise so practicing least privilege is the way.