‘No substitute for hands-on experience’: Cyber students gain key experiences

There’s no substitute for experience, especially when it comes to something as complex as cybersecurity.

That was the premise behind two cybersecurity competitions that nine students from Augusta University’s School of Computer and Cyber Sciences, all members of the AU chapter of the Association for Computing Machinery (ACM), competed in during March. Four of the nine students even put their talents, skills and knowledge to the test in both competitions spaced less than a week apart.

The two competitions, Virtual Internship and Varied Innovative Demonstrations (VIVID) and the Southeastern Collegiate Cyber Defense Competition (CCDC), are designed to give students studying cybersecurity a taste of what they could be up against in the real world, but each had different hurdles and requirements.

“Competitions like VIVID and CCDC are great experiences because they allow students to take what they have learned in the classroom and lab and apply their skills and knowledge to real-world situations,” said Michael Nowatkowski, PhD, director of AU’s Cyber Institute. “These competitions also allow for networking with other cybersecurity students from around the region and country, as well as professionals already in the field.”

Preparation is key

Similar to the real world, neither competition gave teams much time to prepare. The “arena” and rules weren’t fully known going into either contest. The rules were loosely defined prior to each competition, but the exact terms of engagement weren’t revealed until hours before.

This presented a unique set of challenges but also made it imperative for teams to hone in on who was on their team and what skill set each member could contribute. Having a cohesive, well-rounded team was vital for success, especially when one teammate was suddenly removed from the competition and given a new task at one of the contests.

Izaac Picazo, a fourth-year cybersecurity major, said previous experience with the style of competitions was a key factor in preparing. VIVID featured three days of three completely different styles of competition, while CCDC was what is known as blue team versus red team.

“Both competitions required a deep understanding of networks and services to succeed. Where it differs is doing it in the time allotted. CCDC forces you to hit the ground running as soon as your hands touch the keyboard, but VIVID, having a six-hour window, allowed us to take our time with each question to ensure accuracy. I’m very grateful to have competed as there really is no substitute for hands-on experience,” Picazo said.

A unique competition

For VIVID, AU has partnered with the University of Alabama in Huntsville (UAH), Florida International University and the University of Arizona, all either R1 or R2 universities, for a three-year program funded by a $3.2 million grant from the Department of Defense.

Nowatkowsi is a co-principal investigator for the coalition led by Tommy Morris, PhD, director of the UAH Center for Cybersecurity Research and Education (CCRE). Other co-PIs include Sharon Johnson, deputy director of the CCRE; Josh Pauli, PhD, department head of Arizona’s Cyber, Intelligence, and Information Operations in the College of Applied Science and Technology; and Randy Pestana, director of Cybersecurity Policy at the Jack D. Gordon Institute for Public Policy and the director of education and training at Cybersecurity@FIU.

“This is a unique partnership where each host institution had a connection to organizations within the Department of Defense. The fact that it was completely virtual meant teams had to have excellent communication and plans in place for when interruptions happen, just like in the real world,” Nowatkowski said. “It was a full week for the students as they competed in different styles of competitions, which really tested everyone’s critical thinking and ability to execute strategy.”

VIVID is also unique in that the entire competition was held virtually. Nowatkowski, Pauli and Jeff Morris, PhD, organized, coordinated and assisted in the development of the competition, which was hosted by the Georgia Cyber Innovation and Training Center‘s Georgia Cyber Range led by David Ivey. The virtual competition consisted of a different event style each day of the competition.

“VIVID was a completely new competition that we had very little details of the platform or tools compared to CCDC, which has been around for years with a specific focus on defense and hardening,” said Hannah Kim, a first-year cyber operations major. “Since we were only allowed five members for VIVID, we had to ensure we had a well-rounded composition focusing on adaptability, mental flexibility and a unique array of skills. CCDC was much more strategic with specific roles necessary to fill and more hands-on practice with a lab environment.”

Going virtual

For VIVID, AU’s team of Picazo, Kim, Wesley Kimbrell, Patrick Woodell and Aidan Massenberg went up against 90 other teams from 64 schools from across the nation, all CAE-designated by the National Centers of Academic Excellence in Cybersecurity (CAE).

The teams were introduced to the competition environment the day before the competition began, and they then proceeded to compete in a Jeopardy-style capture the flag event on the first day, red team (offensive) tasks on the second day and blue team (defensive) tasks on the final day. Teams scored points for successfully solving challenges each day of the event, with their final score calculated from the sum of total points across the three days of events.

“Communication usually tends to be the choking point for things that are virtual. Thankfully, collaboration tools like Discord and Google Sheets were allowed, and these tools meant that we could share our findings within the team in a quick and readable manner,” Picazo said.

“The competition being completely virtual threw in some unique challenges. On the second day, my internet went out for the last hour of the competition. Very quickly, the team started to screen share their screens with me, and I continued to try to help in any way that I still could. I wrote down commands that would be useful, I asked for them to share a binary file with me so I could continue to reverse engineer it, and we all did our best to realize the issue and play around it,” Kim said.

AU finished 11th, earning a berth to the national championships. The top 15 teams advanced to compete in the VIVID Live Competition, held during the annual CAE Colloquium in St. Louis, Missouri, Oct. 6-10. The Sycophants of the University of Central Florida (UCF) took top honors with USF CyberHerd from the University of South Florida (USF) finishing second.

Up against the best

After wrapping up VIVID, Picazo, Kim, Kimbrell and Woodell had just a few days to switch gears and begin preparing with Gabriel Horton, Deniz Barim, Kayla Mazyck and Robert Franklin for what they could expect at CCDC.

“As a school, we’ve competed in CCDC every year and have made it to regionals in the past, but it had been a couple of years since the last time we earned that opportunity,” said JoJon Cabrera, a graduate student who serves as the team’s student coach. “This year, our team included some who had never competed in competitions before along with veterans that have competed in previous years, but with their combined skills, they were able to knock out the bigger schools in the state of Georgia to represent the state at the regional.”

Only the top eight teams in the Southeast qualified for the competition, which was held at Kennedy Space Center in Cape Canaveral, Florida. Augusta went up against a stacked field, including Central Florida, South Florida, Clemson University, University of Florida, Tennessee Tech University, Montreat College and UNC Charlotte. UCF has accounted for five national CCDC titles, including back-to-back in 2021 and 2022, and three second-place finishes. Charlotte won the national crown in 2006.

While VIVID featured a different style of competition each day, SECCDC was in a different stratosphere.

Seeing red

CCDC being held at NASA’s Center for Space Education was a clue as to what the premise of the competition would include, but the scope wasn’t fully released to the teams until the morning of the competition.

Each team was tasked with protecting a theoretical space agency’s networks from cyber attacks. The attackers, or red team, happened to be 27 of the best cybersecurity professionals in the United States. The 27 members of the red team were all seasoned industry professionals who protect some of the biggest corporations and companies, not just around the country but around the world.

And they were relentless, launching attack after attack and creating havoc for each team.

“We knew we were going to get hacked by some of the smartest red teamers around. This is why we focused a lot of our energy on things we could automate through scripts and making a playbook to fall back on. The experience we gained from going will be the greatest prep for the workforce we could ask for,” Picazo said.

As the two-day event wore on, a lot of red began showing up on one page of the leaderboard, which tracked how many areas each team had protected and indicated either green or red.

At one point, the entire board was red, and by the end of the competition, not a single team on the leaderboard had positive points.

“CCDC can become extremely nerve-wracking as you get moments where your entire network goes black,” Kim said. “The clock is ticking and your points are steadily trickling down, but everyone has to scramble to figure out the issues, recover and reset. A machine can suddenly go dark due to genuinely thousands of reasons, but you have to remain calm, ask questions and figure it out in the end.”

At the end of the competition, TJ O’Connor, PhD, the competition director for SECCDC and an assistant professor in the College of Engineering and Science – Electrical Engineering and Computer Science and the Cybersecurity Program Chair at Florida Technical College, declared the winner was the red team.

When looking at it from the cybersecurity realm, it means the bad guys won. They had successfully wreaked havoc by infiltrating the teams’ networks, destroying passwords and firewalls, and planting viruses.

In many competitions, that would be viewed as a failure, but that was the point: to learn what from mistakes in a safe, controlled environment so they could be better prepared for what happens in the real world every day.

“In our after-action report, we came to the agreement that experience is the massive thing we were lacking from placing higher. It’s hard to practice high-stress situations and rapid incident response reporting,” Picazo said. “Some of our members now have two years of CCDC experience under their belt, and we are hoping to move that knowledge forward. We plan to accomplish this with proper documentation and a lab to practice simulations that will hopefully lay the foundation to help future members for years to come.”

UCF won among the blue teams, earning the automatic berth to the national competition, with USF second and Clemson third. AU finished a respectable sixth, but it was not without an even brighter spot in a special callout during the closing ceremony.

Kim was recognized for having successfully completed a side contest that stumped many upperclassmen, causing several to drop out of that part of the competition. Kim, who attributes some of that success to competing in two or three competitions every month, has lofty goals for continuing to advance her knowledge through competitions, including the U.S. Cyber Games, as well as completing two certification exams: GIAC Cloud Security Essentials and Offensive Security Certified Professional.

“Ultimately, I want to be able to learn and apply myself as much as possible, and I hope I can continue to share the knowledge and passion I have with other students,” Kim said. “I love competing, and while it may feel like I have a lot of time left to decide my options and compete at a collegiate level for much longer, I want to be able to do the most with my time.

“If I had to give advice to anyone interested in studying cybersecurity, I would say consider actively participating in challenges and competitions,” Kim continued. “Not only are they thrilling and fun, but, for me, I get so immersed they basically replace video gaming. But I truly believe anyone who is passionate enough and applies themselves well outside of class can demonstrate and develop such skills, and this is just a proof of it.”