Different kind of 'call of duty': Students fight off hackers
Cyber security team heads to nationals in Texas. Video by Jim Mandelaro
Bryan Harmat, left, and Tyler Fornes are part of Rochester Institute of Technology's Collegiate Cyber Defense Competition team that will be in San Antonio for a national competition starting April 23, 2015.(Photo: Jamie Germano, Rochester (N.Y.) Democrat and Chronicle)
Picture this: You're on your computer, furiously trying to ward off one attack after another from professional hackers.
At the same time, you're attempting to complete multiple tasks from your boss.
Do you sink or swim? Make it or break it?
That's the challenge facing a college team you've probably never heard of — Rochester Institute of Technology's cybersecurity squad.
"It's one giant head game," says Tyler Fornes, a graduate student from Springville, N.Y.
Fornes is one of eight RIT students who will compete in this weekend's national Collegiate Cyber Defense Competition championships in San Antonio. About 180 schools nationwide have cybersecurity teams, but only 10 regional champions reach nationals.
Rochester won the competition in 2013 and finished second last year to the University of Central Florida in Orlando. Joining them will be these schools:
• University of Alaska Fairbanks
• University of California, Berkeley
• DePaul University in Chicago
• ITT Technical Institute - Boise, Idaho
• University of Maryland, Baltimore County in Catonsville
• University of Nebraska in Lincoln
• Southern Utah University in Cedar City
• University of Texas at San Antonio
For these teams, the most points wins — but defense is the only option.
Here's the basic premise:
Student "blue" teams are tasked with protecting a bullet-ridden computer infrastructure — one they've never seen before — while being attacked by "red" teams, industry professionals posing as hackers.
Bill Stackpole of the Rochester Institute of Technology is coach of its Collegiate Cyber Defense Competition team. (Photo: Jamie Germano, Rochester (N.Y.) Democrat and Chronicle)
The students get points, increasing in unknown increments, for warding off the attacks and maintaining their systems. But they also must perform business duties assigned by their bosses, the "white" teams, and must maintain existing mail and Web servers.
If their system falters or crashes, they lose points.
"Those who perform the best get the most points and wins," says Bill Stackpole, associate professor of computing security at RIT and the computing security team's coach.
And just like in all sports, no defense is no foolproof.
"I promise you, the red team is breaking into the box," Stackpole said. "I don't care how good the blue team is. It's not a question of if it's going to get breached, it's a question of when."
This isn't all fun and games. In recent years, cyberattacks have hit major companies such as Anthem (ANTM), Staples (SPLS), Home Depot (HD), JPMorgan Chase (JPM) and Sony Corp. (SNE) subsidiary Sony Pictures — remember The Interview? — and the FBI now considers cybercrime a major issue.
The Collegiate Cyber Defense Competition began in 2004. Sponsorships have grown and now include power companies such as Amazon (AMZN), Facebook (FB), Hershey (HSY) and Microsoft (MSFT). The title sponsor is Raytheon (RTN), a major American defense contractor.
The companies aren't doing this as a goodwill gesture. When the competition ends Saturday night, top company official will recruit Collegiate Cyber Defense team members to work for them for salaries starting in six figures.
"The students bring their résumés with them and everything," Stackpole said.
“It's one giant head game.”
Tyler Fornes, Springville, N.Y.In 2009, Boeing (BA) was a major sponsor of the West Coast regional and hired all six graduating members of the California State Polytechnic University, Pomona team that won.
Students don't need to be geniuses to work on RIT's computing security team, but they do need at least a 3.0 grade-point average. The college advertises the program at the beginning of the academic year and holds tryouts in a giant lab before a team is selected.
The team has 12 members, but only eight will compete this weekend.
The students say they were drawn to computers early in life — and for different reasons. Fornes' uncle was in the Air Force and showed the boy how to build his own computer.
For Stanley Chan, a fourth-year student from Brooklyn, the itch came during middle school "when I realized my computer was broke, and I didn't know how to fix it." He does now.
Banners fly in Rochester Institute of Technology building for its Cyber Defense Competition teams. (Photo: Jamie Germano, Rochester (N.Y.) Democrat and Chronicle)
When the students are placed at 9 a.m. CT Friday in a Marriott hotel room filled with computers and cables, they will see their infrastructure for the first time.
Dozens of white team bosses dispense orders. The red team attacks from 9:30 a.m. to 6:30 p.m., at which point the blue team is removed from the room and the infrastructure stays up.
"You're definitely in a high-stress situation," Chan said. "People get on each other's nerves.
"The best part about being on this team is everyone understands people are going to be on edge and tired," he said. "It's like, 'Let's not hold anything against each other. Let's plow through this together.'"
Bryan Harmat, a fourth-year computing security major from Worcester, Mass., is captain of the RIT squad. His job is to secure the network devices and make sure everyone stays on task.
"It's pretty stressful but a lot of fun," he said. "This is something I love. ... I just want to learn as much as possible."
Communication is vital, and so is chemistry. That's why team members bond by playing video games, board games and even karaoke.
"It's very vital that we all communicate with each other when we change something," Fornes said. "We could end up hacking ourselves if we don't do things in the right order."
Competition resumes Saturday morning, at which point teams get a rough idea of their current ranking. And the winner?
"The winner gets glory and fame," Stackpole said, smiling.
And, most likely, a job that pays six figures.
