RIT team heads to cyber defense championship

‌

A team of RIT computing security students hope their practice will pay off at the National Collegiate Cyber Defense Competition April 13–15 in San Antonio.

When Rochester Institute of Technology’s collegiate cyber defense team gets hacked, they call it practice.

Four days a week, the students can be found in the lab learning about the technical aspects of different computer systems and strategizing how to defend against attackers.

This weekend, the team will put its skills to the test as it takes on teams from the country’s top cybersecurity colleges in the 2017 National Collegiate Cyber Defense Competition, held April 13–15 in San Antonio. The annual championship is part of the nation’s largest college-level cyber defense competition, an extracurricular event that helps to train the next generation of cybersecurity experts.

For the competition, students must defend a mock company’s network infrastructure from a team of industry professionals who are assigned to break in and exploit the company’s information.

“The competition involves a lot of quick thinking and is designed to be as stressful as possible,” said Kyle Carretto, a second-year computing security student and co-captain of the RIT team. “We don’t know anything about the infrastructure we’ll be using until the competition actually starts.”

To prepare for the event, students spend months getting a baseline of every possible computer system that could be used in the competition, learning about the different networks and protocols. They also practice by simulating the attackers, who are known as the red team. They run scenarios to defend against possible attacks, including an attack on their network and the installation of malware—tools used by the red team to gain unauthorized access to the student’s systems.

“Cybersecurity is so broad—there are a million ways to hack into things,” said Cameron Clark, a third-year computing security student and captain of the RIT team. “The best way to practice is to know these systems inside and out.”

Throughout the school year, the RIT team developed several plans of action for what to do during the competition. But these plans will often change during the first few hours of competition and the team has to react very quickly to a variety of unpredictable situations.

In addition to fending off attackers, the students need to please the bosses of the mock company. The team must respond to business injects, which represent the typical activities of a system administrator, including running monitoring software and adding and removing services.

“At times, we have more than 40 services we need to take care of, so we break it up with one person covering each aspect,” said Clark. “One person can’t do it all—working together and communicating as a team is really important.”

For the cybersecurity students, CCDC is a fun space to test the skills they’ve learned both in and out of the classroom. It also serves as a place to meet employers. Raytheon, Walmart, IBM and the CIA are among the many industry sponsors for the event.

In the past, RIT has been among the top contenders at the national competition in San Antonio, placing third in 2015, second in 2014 and winning the national title in 2013. RIT received an automatic berth to the 2017 nationals after winning the Northeast regional competition in March.

Other regional winners competing for this year’s national title include University of South Alabama, Brigham Young University, DePaul University, University of Washington, California State University Northridge, Montana Tech, University of Maryland Baltimore County, University of Tulsa and University of Alaska Fairbanks.

The RIT student team is made up of Clark, who is from Saco, Maine; Carretto, who is from Batavia, N.Y.; Brandon Adler, a third-year computing security student from Pittsford, N.Y.; Joe Graham, a third-year computing security student from New Hampton, N.Y.; Ryan Whittier, a fourth-year computing security student from Rochester, N.Y.; Dave Kukfa, a fourth-year computing security student from Penfield, N.Y.; Ben Bornholm, a fourth-year computing security student from Royersford, Pa.; Micah Martin, a second-year computing security student from Fort Loudon, Pa.; Sean Sun, a second-year computing security student from Fresh Meadows, N.Y.; James Trimer, a computing security graduate student from Rochester, N.Y.; Kristen Tumacder, a third-year computing security student from Aiea, Hawaii; and Hans Johnson, a fourth-year computing security student from Middleport, N.Y.

The RIT team is coached by Bill Stackpole, professor of computing security in RIT’s B. Thomas Golisano College of Computing and Information Sciences.

In 2012, RIT broke the mold of traditional cybersecurity education by creating the Department of Computing Security, the first academic department with both undergraduate and graduate degrees devoted solely to computing security. Today, RIT is helping to fill a national need for qualified computing security professionals as a National Center of Academic Excellence in Information Assurance/Cybersecurity Education designated by National Security Agency and Department of Homeland Security.