Wahoos Win Hack-to-Back Championships
University of Virginia defends national collegiate cyber defense title
When the University of Virginia's national champion men's basketball team returned to their campus in Charlottesville in early April 2019, they received a police escort and were greeted by thousands of cheering fans. It was their first time winning the title.
On April 25 in Orlando, Florida, UVA repeated as the 2019 National Collegiate Cyber Defense Competition; they’re expecting neither a motorcade nor the fanfare. But that’s OK; their team of eight will be courted by corporations and agencies like NBA lottery picks.
“Our school might understand the basketball win more than our win but to us, they’re just both awesome,” said Mariah Kenny, UVA team captain. “When we won the first time, we were still figuring out the game. But winning the national championship for a second time, we realized that we had done something right, and we really do work together well. We got some of the technical stuff down and definitely learned a lot from last year.”
The Wahoos prevailed over nine other finalist teams in the 14th annual competition that began with a field of more than 235 teams. Regional competitions composed of multiple stages and a single-elimination round reduced the field to 10 finalists for the national championship.
The University of Virginia team successfully protected the network of a fictional agriculture firm called “Cryovine,” specializing in cryopreservation, crop research and development, and sustainable farming. A “red team” of ethical hackers carried out multiple attacks on the teams using the same tactics and techniques as real-world bad actors. Not only did the teams need to detect and protect their networks, they had to keep their network up and have critical services available for users like web access, email servers and e-commerce sites.
“We were trying to figure out what they were doing while they were trying to figure out what we were doing,” Kenny said. “We would set something up, and they’d either take it down or find a new way in. There was one system that we were fighting for control of, it went back and forth, back and forth. We were trying to figure out how they got in, in the first place, and in the meantime, we had to kick them out again. It was a lot.”
For the past six years Raytheon has presented NCCDC, the first collegiate competition to test cyber defense skills modeled after real-world attack scenarios. The company has seen how the practical application of cyber defense skills encourages more students to pursue cybersecurity careers.
“NCCDC’s systematic, professional approach to this competition, and the use of real-world business scenarios, helps attract the talent that will fill the 3.5 million cyber job vacancies we will see by 2021,” said John DeSimone, vice president of Cybersecurity and Special Missions at Raytheon Intelligence, Information and Services.
To help fill the worldwide talent gap, Raytheon also offers a women cyber scholarships and hosts the "Cyber Academy," workshops that have been held at universities in the United Kingdom, Kuwait and the United Arab Emirates. The academies and NCCDC offers practical, realistic training that students can't get in the classroom.
"Getting hand’s on experience and working under all that pressure is particularly hard to get in normal classrooms and courses, which usually just teaches the students techniques and not how it works in practice nor the kinds of situations they might encounter," said Yonghwi Kwon, UVA’s faculty adviser,
Regarding his team's ability to handle the real-world stress, Kwon said, “I was blown away. We were doing great in services, great with injects, great in everything. I was trying to find something to improve but I couldn’t. So I said ‘Just keep doing what you’re doing.’”
In addition to University of Virginia’s top finish, University of Central Florida placed second, and Rochester Institute of Technology placed third. The 10 schools that competed at the championship include:
- Baldwin Wallace University, Ohio, Midwest Regional Winner
- Rochester Institute of Technology, New York, Northeast Regional Winner
- Stanford University, California, Western Regional Winner
- University of Alaska, Anchorage, At-Large Regional Winner
- University of Tulsa, Oklahoma, Southwest Regional Winner
- University of Washington, Seattle, Pacific Rim Regional Winner
- Utah Valley University, Rocky Mountain Regional Winner
- Dakota State University, South Dakota, North Central Regional Winner
- University of Virginia, Mid-Atlantic Regional Winner
- University of Central Florida, Southeast Regional Winner
Sponsors of NCCDC include government agencies, colleges and commercial companies. Raytheon will bring the winning Virginia team to Washington, D.C., to some of the nation's top research and national cybersecurity sites this summer.