Best cybersecurity students on the globe battle at pentesting competition finals

The best new talent coming into the cybersecurity industry will battle for a championship trophy at the Collegiate Penetration Testing Competition (CPTC) global finals Jan. 11-14 at Rochester Institute of Technology. The event is the culmination of the world’s largest offense-based collegiate cybersecurity competition, which was started by RIT.

Throughout the fall, more than 400 elite cybersecurity students from 70 schools gathered at nine regional events across the world to compete in the CPTC regionals. The top 15 collegiate teams will face off in the weekend-long global finals at RIT in Rochester, N.Y. Participating teams are:

• Princess Sumaya University for Technology (Jordan)
• Indiana Institute of Technology
• University of Texas at San Antonio
• University of Central Florida
• United States Military Academy West Point
• Stanford University
• California Polytechnic University, Pomona
• California State University, Fullerton
• Dakota State University
• Fullerton College
• Liberty University
• University of Florida
• University of Massachusetts Amherst
• University of Texas at Austin
• University of Tulsa

The competition allows students to experience a day in the life of a penetration tester—the security professionals hired to test and evaluate an organization’s computer systems and networks to ensure that malicious hackers can’t get in.

In this year’s scenario, students will conduct a security assessment and penetration test for an airport, with special emphasis on people movers and monorails in the facility. The theme sponsor—French mobility technology company Alstom—is helping model and develop the competition environment.

“We are thrilled about this collaboration with our partners at RIT’s ESL GCI to bring students from universities around the world to face off in a battle of ethical hacking, and to attract such high level of talents to such an impactful career path,” said Nadia Zaari, North America Signaling and Infrastructure Systems Managing Director at Alstom. “This collaboration also helps us further our efforts in making our rail system transportation for transit agency, rail agency, and airport people mover authority more resilient in the face of potential cybersecurity threats.”

For the competition, teams of up to six students spend two days interrogating a mock company’s network. They then create and present a report to the judges on their findings, while offering suggestions for mitigating risk in the future.

Competitors might have the chance to assess airport management software, try to phish employees, and evaluate the public Wi-Fi—all while ensuring that their cybersecurity work does not jeopardize the confidentiality, integrity, or availability of the airport’s systems.

“Critical infrastructure protection is the most dire cybersecurity need,” said Justin Pelletier, director of CPTC and director of RIT’s ESL GCI Cyber Range and Training Center. “By presenting a digital facsimile of an airport, we are encouraging the next generation of cyber professionals to explore technologies that they wouldn’t normally see in the classroom.”

Judges and sponsors from the security industry will evaluate the performance of the competitors while under fire. Students will have the opportunity to meet experts, hand out résumés, and do a virtual job fair and interviews with potential employers. Other sponsors include IBM Security, Maltego, Google Cloud, Alpha Virtual, Battelle, Aventiv Technologies, and Paperclip.

Many volunteers work throughout the weekend to ensure that the competition runs smoothly. Alex Nasca, a fourth-year cybersecurity major at RIT, is helping coordinate the in-room monitoring. Room monitors report any rule infraction, distribute injects, and give teams a direct go-between to competition staff should questions arise.

“This event is held in high regard by institutions and industry experts, so we must ensure the integrity of the competition remains unbroken,” said Nasca. “I enjoy this event because I get to work with students from different years and backgrounds who have a common passion for community work and cybersecurity. I think that is a powerful thing to be a part of.”

CPTC has become the premier offense-based collegiate computing security event, after starting at RIT nine years ago. CPTC is a counterpart to the Collegiate Cyber Defense Competition (CCDC), which is the premier defense-based event for college students. The events help students build and hone the skills needed for a job in the cybersecurity industry—an industry that has a severe shortage of qualified professionals.

The competition environment is run through RIT’s ESL Global Cybersecurity Institute (GCI) Cyber Range and Training Center, which is capable of hosting more than 5,000 virtual machines for immersive scenarios.

More information about CPTC is available on the Collegiate Penetration Testing Competition website.