UNIVERSITY PARK, Pa. — Six students from Penn State celebrated a second-place finish in the northeast regional competition of the Collegiate Penetration Testing Competition (CPTC) — the best finish by a Penn State team in the school’s history – and secured a spot in the upcoming national competition in Rochester, New York, Nov. 22-24.
The regional competition was hosted at Penn State Oct. 11-13 and simulated an authentic environment where collegiate cybersecurity students compete against each other as they conduct a penetration test.
The purpose of this type of test is to execute an authorized cyber attack to test the security of a system. With today’s rising concerns of cybersecurity, penetration tests play a crucial role in guaranteeing the protection of a company’s online system. The students’ goal was gain access into a realistic organization’s system and steal “confidential data.” Teams are scored on technical skills, as well as professionalism and communication skills.
“Most teams in our region found similar vulnerabilities in the competition’s environment,” said Cole Daubenspeck, junior in cybersecurity analytics and operations, and captain of Penn State’s team. “The main difference was how each team reported their findings. This competition helped cement the idea of how important technical writing is.”
He added, “As a team, we not only needed to accurately convey important information, but we needed to make it easy to understand to an audience of C-suite executives and technical experts. We also needed to make sure to focus on the important topics and analyze the business impacts from the client’s perspective.”
According to Daubenspeck, CPTC is not an easy competition. He encouraged his team to meet weekly leading up to the regionals to study advanced topics in penetration testing and utilize helpful tools to provide them with real-world experience.
“We used a variety of free resources, such as hack the box and overthewire.org, to test various skills,” said team member Cara Schwartz, a junior in cybersecurity analytics and operations. “Cole also set up a sample testing environment on his own server for us to model the competition.”
Along with understanding the technical aspect of the competition, the team had to learn each other’s strengths and know how to take advantage of them. Their extensive preparation benefited them in the long run, said team member Justin Wu, a junior in cybersecurity analytics and operations.
“I was reminded of how important it is to have a team of people who work well together,” he said. “We have great people on our team who listen to each other and are willing move past haughtiness to be fantastic teammates.”
As the regional competition began, the Penn State students discovered many challenges they would need to overcome, including the lack of time to complete their test and develop a report.
“The competition began at 9 a.m. with testing until 6 p.m. After 6 p.m., we wrote a report on our findings, and this ended at 3 am,” said team member Walter Bain, a senior in security and risk analysis. “But even with the competition happening the whole day, it felt very fast paced.”
“It is a long day, but relatively speaking the testing window is very short. You have to constantly stay motivated and also productive. It can be very frustrating at times,” Schwartz added.
Penn State will face a new and fiercer competition as they prepare to compete at nationals next month.
“We will continue working on more specific strategies and solving any issues that came up during the regionals competition so that they are not repeated in the future,” said teammate Petr Esakov, a sophomore in electrical engineering. “We can also streamline a lot of our workflow, and that will be a focusing point for the future.”
“I am grateful for how hard our team worked for the chance to go to nationals, and I am just excited for the chance to compete with the team again,” added secondary captain Sarah Hume, a senior in cybersecurity analytics and operations. “I am looking forward to representing Penn State in a national, widely respected cybersecurity competition.”