National cyber competition reveals top security talent

Collegiate championship participants manage real world fires and showcase their skills

San Antonio, Texas, was ablaze with cyber fires as 10 of the top college teams competed for the number one spot in this year's National Collegiate Cyber Defense Championship.

What started with 230 teams was winnowed down to 10, but the University of Maryland, Baltimore County showed impressive strength and teamwork, earned the highest score,  and landed the coveted spot of the 2017 winners.

"The competition itself is diving into the day in a life of being a cyber security specialist," said Jeff Jacoby, director of cybersecurity and special missions at Raytheon, "and they are working on real-world scenarios that they need to maintain business continuity."

The teams this year worked to secure a multi-site retail corporation with 160 employees, point of sale systems, inventory systems, and other systems you find in a typical retail company.

Jacoby said, "The information assets are operational and the information that resides on them is protected. The teams have to work together not only to secure and maintain the assets but also to deal with the day-to-day responsibilities like service requests, managing various forms of user requests, or requests that come in from management, all while being hit with various attacks from a red team."

It all sounds super stressful. Though it is likely a familiar situation for veteran security practitioners, for those who are trying to establish themselves, there must have been a lot of pressure, especially knowing that they were also being evaluated and hoping to win.

Jacoby said that Raytheon has been a sponsor of the competition for four years, and each year they change up the scenario. One challenge specific to managing a multinational retail company is that the service has to always be up and operational. 

While focusing on the primary objectives of business continuity, the teams were also dealing with customers, whether it was, "Customers saying the online website was down or a transaction wasn't processing, or they didn't receive confirmation of a purchase," said Jacoby.

The teams had to decide among themselves who would do what. "They had to come in and determine their division of labor," said Jacoby. They had to delegate and lead to cover every aspect of security operations.

"Everything from someone managing phone calls while others monitor systems. They were responsible for mitigation and putting patches in place. They worked together to figure out how to prioritize the use of their time when comparing the day-to-day duties against responding to critical situations," said Jacoby.

Not to take away any of the acclaim that the winning team deserves, but it's important to recognize what this competition means for the cyber industry at large. These are not your average college students.

They have spent years honing their cyber skills, and some of the participants have some pretty interesting hacks ranging from an insulin pump and an electric car to a video surveillance camera in a school lab. Still others have hacked a connected avionics system that loads maps onto an airplane, an elevator, a McDonald's router, and even a beer kegerator.

One student participant, Sarah Cunha, a graduate student at BYU, said, "The strength of this type of competition is the ability to test and learn skills that are directly applicable to the very real-world problems industries are facing in cybersecurity. CCDC is a rare opportunity to not only practice securing all types of systems, but to be able to see malicious attackers in real-time, how they act, and understand what kind of clues to look for to find and eliminate hackers."

"The NCCDC is satisfying a larger issue that we face as an industry. The skills needed are underrepresented in the workforce, and in this competition the students are applying classroom learning and augmenting them on their own to hone and develop their own skills," said Jacoby.

Yet the students aren't the only ones who are able to augment and develop. These competitions are also a great opportunity for colleges and universities to evaluate their students and improve their own curriculum, said Jacoby.

Congratulations to all the teams, to the top 10 who made it to San Antonio, and to the 2017 winners, University of MarylandBaltimore County.

Raise up your commenting trophy by heading to our Facebook page.

Copyright © 2017 IDG Communications, Inc.

Subscribe today! Get the best in cybersecurity, delivered to your inbox.