UNIVERSITY PARK, Pa. – Penn State’s Collegiate Cyber Defense Competition (CCDC) team reached new heights earlier this month when they participated in the regional finals of the Mid-Atlantic Collegiate Cyber Defense Competition for the first time.
The program provides institutions nationwide that offer information assurance or computer security programs with a competition to assess their students’ depth of understanding in protecting corporate network infrastructure and business information systems.
“CCDC simulates a cybersecurity team’s worst nightmare – a network breach,” said team captain Brant Goings (senior, cybersecurity analytics and operations). “CCDC brings that into a competitive environment by having a live red team – the attackers – onsite actively trying to break into your extremely vulnerable machines while you try to keep them out and secure them at the same time.”
Held April 2-4, this year’s regional finals competition scenario involved teams of eight students working with the Artificially Intelligent Institute – a fake company which teams were tasked to protect.
“Artificially Intelligent Institute was a company that managed client electronic medical records as well as hosted an ecommerce website for customers to purchase products and services from,” Goings said. “Within the company, employees relied on their email to communicate between customers and other staff. Our job was to keep those services up and secure throughout the 16 hours we competed.”
But this was just part of the responsibility the team faced. Goings said the team was also tasked with keeping the CEO updated on their work, as well as writing documentation for employees to follow, incident reports in the event of breaches, and updated policies to keep the company from failing audits.
Mark Wallace (senior, cybersecurity analytics and operations) said that teams were scored on the length of time services, such as the company email and website, are up; as well as on various tasks, such as creating new users, configuring new firewall rules, creating new services or briefing executives.
“Teams can also earn back points by providing documentation on how hackers got into their systems and how the team took steps to protect it,” he said.
While the competition is typically demanding, according to Penn State faculty adviser Nick Giacobe, this year’s regional finals competition was even more challenging with last-minute changes put into place due to the COVID-19 outbreak. Social distancing guidelines and stay-at-home orders prevented students from traveling to competing at John Hopkins University, like in previous years. In a typical competition, each team works against each other in a virtual environment within the same physical location; however, this year, each member of each team was also required to work remotely with one another from their locations all across the country.
“Normally in the regional qualifiers we are in the same room, are able to look at each other face-to-face, and have the benefit of a quiet room to work in together,” Goings said. “However, with COVID-19 and all the changes that has brought, we had to compete from eight different rooms over a teleconferencing platform and weren’t able to work as efficiently as we would’ve been able to otherwise.”
The Penn State team was one of 33 teams that participated in the competition’s Mid-Atlantic regional qualifier on March 21. From there, Penn State and seven other teams advanced to the regional finals. Though the Penn State team did not further advance to the national finals, Wallace is proud of the obstacles the team overcame throughout the competition – including his own connection issues from his apartment.
“I think it was a struggle for all teams to communicate online, but everyone did a fantastic job,” Wallace said.
Other members of the Penn State team included Namo Asavisanu (junior, computer science), Evan Eastwood (senior, cybersecurity analytics and operations), Petr Esakov (junior, electrical engineering), Jason Mercede (junior, cybersecurity analytics and operations), Matt Ruff (senior, information sciences and technology and security risk analysis) and Justin Wu (junior, cybersecurity analytics and operations).
Goings added that the while the regional finals proved to be difficult, the team found excitement in completing the flood of side challenges given by the CEO while simultaneously keeping up with the pressure of attacks.
"Our seamless teamwork was worth celebrating at the end of the second day, plus the fact that we could still laugh together after being mentally exhausted by the end of it,” he said. “We performed very well considering our competition environment and are proud of the precedent we set for future PSU teams.”
Both Goings and Wallace encourage any interested Penn State student to get involved with CCDC.
“There are so many reasons to do CCDC,” said Wallace. “You are getting real world experience, and you actually get to defend a company network against an advanced team of hackers.”
He added, “I got to connect with a lot of professionals in the industry and have already gotten emails asking me to look at their company’s job openings.”