Microsoft O365

Each team will be provided a deliverables submission form, which will be shared with the Microsoft account provided.  The final report should be submitted via this form prior to the submission deadline.

During a professional penetration test, taking sensitive information, such as social security numbers, password hashes, or intellectual property from a client would be a serious serious situation.  Broadly, we perform these engagements to improve our clients, their environments, and their overall security.  Taking sensitive data potentially exposes them to additional risk; however, as professionals we also need to document our work.  

Although CPTC is not a penetration test of a “real” company, we still hold to the realism of asking teams to perform a professional engagement.  As such taking an entire drive, or other sensitive information such as PII, password hashes, code, designs, etc. is not allowed without the explicit permission of the client, similar to a professional environment. 

In short, take only what you need to document your work in your report (and in your future career your workpapers or documentation) and leave the real data at the client site.

When reviewing the regional kickoff, our team noticed that we would be using a provided OneDrive to store client information and to develop our report. As this is a large change from using Google Drive in previous years, we wanted to seek clarification on if we would be able to utilize the “Open in Desktop App” option within OneDrive’s Microsoft Office web applications or if we would be limited to only using OneDrive’s Microsoft Office web application.

During the event, we anticipate that teams will only be able to use the web versions of Microsoft Office in the competition VDI environment.  Teams are free to use the word processing application of their choice for developing their pentest report outside of assessment hours.