SECCON

SECCON
Name	SECCON
Genre	Capture the Flag, cybersecurity competition
First	2009
Frequency	Annual
Venue	Varies (Japan)
Organizer	SECCON実行委員会

SECCON is an annual Japanese Capture the Flag competition and cybersecurity conference that brings together students, professionals, researchers, and hobbyists to test offensive and defensive information-security skills. The event features online qualifying rounds and an on-site final, combining hands-on challenges, keynote talks, and workshops that attract participants from across Japan, South Korea, United States, Taiwan, and Singapore. SECCON has become a focal point in East Asian cybersecurity culture, intersecting with academic institutions, private-sector firms, and hobbyist communities.

Overview

SECCON is structured around a Capture the Flag (CTF) format derived from longstanding competitions like DEF CON, Pwn2Own, and Codegate. The contest emphasizes real-world scenarios inspired by incidents such as the Stuxnet operation and vulnerabilities disclosed at Black Hat USA and RSA Conference. SECCON events commonly include categories reminiscent of challenges from Google CTF, CTFtime, and the Tokyo Cybersecurity Conference. Organizers invite speakers from entities like NISC (Japan), large vendors comparable to Microsoft, Cisco Systems, and academic groups from The University of Tokyo and Kyoto University. The competition cultivates ties to student programs at institutions such as Tokyo Institute of Technology and Osaka University.

History

SECCON was founded in 2009 by a coalition of Japanese security researchers and enthusiasts influenced by global events such as the rise of Anonymous (group), disclosures at Chaos Communication Congress, and trends exemplified by Shodan. Early editions mirrored formats used by DEF CON CTF and regional contests like SECCON CTF in Korea and Korea Internet & Security Agency-backed events. Over time, SECCON expanded from local meetups to a national festival with qualifiers comparable to Google Summer of Code timelines and finals hosted alongside conferences similar to Interop Tokyo and CEATEC. Notable milestones include collaborating with corporate sponsors that later partnered in initiatives like JPCERT/CC outreach and aligning challenge design with publications from IEICE and IPSJ researchers.

Competition Format

The SECCON contest follows a mixed-format structure comparable to formats used in DEF CON, BSides, and national Olympiad-style tournaments. Initial online qualifiers allow teams from regions including Hokkaido, Fukuoka, and Okinawa to compete in jeopardy-style problems across categories inspired by incidents such as the Equifax data breach and techniques discussed at Black Hat Asia. Final rounds often incorporate attack–defense mechanics resembling those in Pwn2Own and timed live challenges similar to demonstrations at RSA Conference. Scoring algorithms draw on methods discussed at ACM CCS and Usenix. Teams originate from entities like university labs at Waseda University and corporate security groups modeled after Rakuten and NTT Data.

Notable Challenges and Winners

SECCON has hosted problems that mirror high-profile vulnerabilities disclosed at venues such as Black Hat USA, ZeroCon, and CanSecWest. Past challenge themes have referenced paradigms explored by researchers at Google Project Zero and vulnerabilities in products from firms like Adobe Systems and Apple Inc.. Winning teams have included groups associated with institutions like The University of Tokyo, independent collectives similar to Plaid Parliament of Pwning, and corporate blue teams echoing Microsoft MSRC practices. Notable winners have later presented at conferences such as Chaos Communication Congress and Black Hat Asia, while some competitors progressed to roles at organizations comparable to NISA and JPCERT/CC.

Organization and Sponsorship

SECCON is organized by a volunteer committee, academic partners, and corporate sponsors resembling collaborators found at Black Hat Europe. Funding and sponsorship have come from entities analogous to major Japanese technology companies and security firms like Trend Micro and Fujitsu. Organizational governance includes partnerships with educational bodies similar to MEXT-affiliated programs and coordination with incident-response organizations exemplified by JPCERT/CC and regional CERT teams. Logistics for hosting finals have utilized venues comparable to Tokyo Big Sight and support from local governments akin to municipal promotion offices.

Community and Impact

SECCON has influenced the regional cybersecurity ecosystem similarly to how DEF CON shaped US communities and how OWASP projects impacted web security. The event fosters talent pipelines into cybersecurity roles at companies like NTT Communications and contributes to academic research cited in publications by IEICE and IPSJ. Community activities include workshops modeled after Hackerspaces meetups and youth outreach reminiscent of CTF4Kids initiatives. Alumni of SECCON have participated in policy discussions with agencies similar to NISC (Japan) and contributed to open-source projects comparable to Metasploit and Radare2. The competition’s archival problems have been used in curricula at universities such as Keio University and in training programs at private firms like CyberTrust.

Category:Cybersecurity competitions