I got an email recently me asking if I had experience running an Elevation of Privilege tournament. I haven’t, and wanted to ask if anyone out there has done so, please share your experiences and suggestions
One element that I thought about is a scoring system to help with the tournament’s goals. For examples, you might want good coverage and also innovative threats, so perhaps each sample system should have a list of threats you expect anyone to find — points for each of those, and points subtracted for missing them. You could also have a set of things awarded by the judges, for example, ‘most insidious’, ‘hardest to address’, or ‘best movie plot.’
But again, please make suggestions, and I’ll let you know how it goes.