World’s best cybersecurity colleges face-off in offensive-based competition Jan. 7-10

The world’s best white hat cybersecurity students will be crowned at the Collegiate Penetration Testing Competition (CPTC) global finals Jan. 7–10.

The event is the culmination of the world’s largest offensive-based collegiate cybersecurity competition and will be run virtually through Rochester Institute of Technology. Throughout the fall, more than 500 elite cybersecurity students from 64 schools gathered for eight regional events across the world, to compete in the CPTC regionals.

The top 15 collegiate teams have moved on and will face-off in the weekend-long CPTC global finals. Participating teams are:

• Rochester Institute of Technology, Dubai
• City College of San Francisco
• Rochester Institute of Technology
• University of Central Florida
• University of Ottawa (Canada)
• Drexel University
• Bournemouth University (England)
• Carnegie Mellon University
• California State Polytechnic University, Pomona
• Stanford University
• Penn State University
• California State University, Fullerton
• Princess Sumaya University for Technology (Jordan)
• University of California, Riverside
• University of West Florida

For the first time, the competition will be run through RIT’s Global Cybersecurity Institute (GCI), a new, three-story facility that features a state-of-the-art Cyber Range and Training Center. The competition environment will be hosted by the Cyber Range infrastructure, which is capable of hosting more than 5,000 virtual machines for immersive scenarios, instead of having to use a separate cloud.

CPTC has become the premier offense-based collegiate computing security event, after starting at RIT six years ago. CPTC is a counterpart to the Collegiate Cyber Defense Competition (CCDC), which is the premier defense-based event for college students. The events help students build and hone the skills needed for a job in the cybersecurity industry — an industry that currently has a severe shortage of qualified professionals.

 “Cyberspace is as interconnected as it’s ever been, which is why we have competitors from countries across globe,” said Justin Pelletier, director of CPTC and director of the GCI Cyber Range and Training Center. “Different regions tend to specialize in a particular area and develop out specific tools and techniques. This ability to benchmark against the best in the world is valuable information and skills development for any security professional.”

During CPTC, students attempt to break into computer networks created for the competition, evaluate their weak points and offer plans to better secure them. The competition allows students to experience a day in the life of a penetration tester—the security professionals hired to test and evaluate an organization’s computer systems and networks to ensure that malicious hackers can’t get in.

For the competition, teams of up to six students spend two days interrogating a mock-company’s network. They then create and present a report to the judges on their findings, while offering suggestions for mitigating risk in the future. The whole event is set up to mimic how penetration testing consulting happens in the real world.

“This has been a rough year, as everyone well knows — especially in cyberspace,” Pelletier said. “With the work-from-home shift, systems are as vulnerable as ever. Security competitions and competitors must adapt to this in order to mimic the real world, so graduates can hit the ground running when they enter the workforce.”

In this year’s regional and national scenarios, students test the energy grid infrastructure of a small city, including a hydroelectric dam, a nuclear power plant and a wind farm system that could be connected to a regional power utility company. Each team will get exposure to programmable logic controllers (PLCs), industrial computers that control many of the important components of our critical infrastructure.

“Through this exposure, students will learn about some of the challenges associated with securing these low-bandwidth — often legacy — devices that are being overlooked in our current energy grid,” said Pelletier.

Judges and sponsors from the security industry will evaluate the performance of the competitors while under fire. Students will have the opportunity to meet experts, hand out résumés and do a virtual job fair and interviews with potential employers. Sponsors include IBM Security, Eaton, Hurricane Labs and 780th Military Intelligence Brigade, among others.

“Eaton is targeting the cybersecurity skills gap with long-term investments in education and through partnerships, like our work with RIT that’s helping train the next generation of engineers,” said Max Wandera, Director, Cybersecurity Center of Excellence at Eaton, which is this year’s CPTC theme sponsor. “Our ongoing collaboration with RIT, sponsorship of this competition and active support will attract the brightest students to develop new security strategies for connected devices while preparing them for successful careers within the industry.”

People are invited to view the closing ceremony, to hear a keynote speech from experts at IBM Security and to find out who wins CPTC. The free live stream will be available on the CPTC YouTube channel in the afternoon on Jan. 10. In another live stream event during the day on Jan. 9, representatives from each school will highlight the cybersecurity research and efforts taking place on their campuses.

More information is available on the Collegiate Penetration Testing Competition website.