It's about obtaining some hidden information (the "flag") in a computer security context, where you're either trying to penetrate a hardened (computer) target,

It's about obtaining some hidden information (the "flag") in a computer security context, where you're either trying to penetrate a hardened (computer) target, or reverse-engineer an obfuscated binary. It's a constructed exercise, as opposed to a "live" situation.