Cyber Cinderella story
Underdog U of Virginia wins NCCDC college cyber championships
Taylor Swift suddenly blared from every computer in the room. One by one, each of the University of Alaska Fairbanks “blue team” servers shut down. Then the team's entire virtual infrastructure disappeared.
That's how they knew they’d been hacked.
“We beat them down pretty bad,” said Julian Zottl, a Raytheon cyber architect and member of a “red team” of hackers at the 2018 National Collegiate Cyber Defense Competition.
The red teams were the attackers. Ten blue teams of students, each from a different college, played defense. At the end, it was the University of Virginia blue team that held off and neutralized attacks faster than nine other finalists to win the 2018 NCCDC championships in Orlando, Florida, April 13-15, 2018. Later that summer, Raytheon brought the winning University of Virginia team to Washington, D.C., to tour some of the nation's top research and national cybersecurity sites. They visited the state-of-the-art cyber test range at Raytheon’s CODE Center, and they had their coding skills put to the test during an cyber escape room challenge.
The competition challenges teams of college students to operate and manage a network infrastructure similar to those run by commercial businesses. The teams are scored based on their ability to minimize system infiltration, keep critical services in operation and prevent leaks of sensitive data.
NCCDC, presented by Raytheon, tests cyber defense skills in a collegiate competition modeled after real-world attack scenarios. The aim is to encourage more students to pursue cybersecurity careers.
More than 230 colleges and universities competed to test their cybersecurity prowess, culminating in single-round eliminations at regional contests nationwide. Ten finalists advanced to the national round.
“NCCDC educates and inspires the next generation of cyber defenders and prepares them for the types of threats they will face and defend against in the real world,” said Dave Wajsgras, president of Raytheon’s Intelligence, Information and Services business.
In this year's national championship, the competing teams worked to secure a fictional biotech firm named "Volitech," which specialized in vaccine research, materials research, pharmaceuticals and biomechanical organ development. The student blue teams fought off an onslaught of persistent cyber attacks from the top security experts, posing as hackers, who formed the red teams. There was also a “white team” to officiate and score the contest.
This was the University of Virginia's first NCCDC. In fact, the team just formed three months ahead of the competition.
“We practiced twice a week in the beginning, and then three times a week,” said Mariah Kenny, Virginia’s team captain. “We had a pretty good game plan going in...We were flexible and adaptable to whatever situation popped up, swapping systems if there was a better person for the job. We had a great dynamic.”
Kenny said they received some red team “trolling;” their website was defaced, their virtual machine rebooted repeatedly, and malware turned off one of their machines at regular intervals. They fixed that with a script that restarted the machine at a faster rate.
Whenever a team detects an attack, they fill out an incident report, identifying the breach, describing what the red team did, the impact on the fictional business and the corrective actions taken. Good reporting raises the team's scores.
“You can have all the technical skills in the world, but if you’re not talking to each other and helping each other, then you’re going to fail,” said Kenny, a third-year computer science engineering major. “Knowing each other’s strengths and communicating constantly made all the difference for us.”
Kenny is already planning to defend her team’s title at the 2019 NCCDC.
“Actually, we’re still getting over the fact we won,” she said. “But we’ll definitely be back. It’s been really fun, and we learned so much in just the span of three days.”
After University of Virginia's top finish, University of Central Florida placed second, and Dakota State University placed third. The 10 schools that competed at the championship included:
- University of Alaska Fairbanks, at-large regional winner
- University of Virginia, Mid-Atlantic regional winner
- Indiana Tech, Midwest regional winner
- Dakota State, North Central regional winner
- University of Buffalo, Northeast regional winner
- University of Washington Seattle, Pacific Rim regional winner
- Utah Valley University, Rocky Mountain regional winner
- University of Central Florida, Southeast regional winner
- Baylor University, Southwest regional winner
- California State University Northridge, Western regional winner
Sponsors of NCCDC include government agencies, colleges and commercial companies.