An Insider's Look into the 2012 Mid-Atlantic Collegiate Cyber Defense Challenge
- Building a Better Mousetrap
- School of Hard Knocks
- Chink in the Armor
- Man Down
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Another year of the Mid-Atlantic Collegiate Cyber Defense Challenge (CCDC) has drawn to an end, and as I look back at the carnage that has ensued over the four-day event, I'm taken back by just how much the event has grown in breadth of technology, complexity, and prestige.
What is CCDC, you ask? CCDC is an annual competition that faces off seasoned penetration testers and security gurus from around the country against the next generation of IT security professionals. Colleges compete regionally to fight for the right to send a team to the national CCDC event held annually in San Antonio, Texas, and to ultimately hold clam to the title of Cyber Defense Champions.
CCDC isn't your usual college technology event. What once started as small-time events held in the back rooms of restaurants and warehouses with minimal visibility has grown to resemble a modern movie set with camera crews, guest speakers, and an arrangement of accouterments more commonly seen on professional production sets.
CCDC's growth is also evident in the sponsors and attendees to the event.
This year's Mid-Atlantic event was attended by the likes of the Army Intelligence Corp, Lockheed Martin, DHS, MITRE, and the NSA. These organizations come to the event not only to help support the next generation of cyber warriors but to also recruit the best and brightest into their ranks.
CCDC has a simple goal: Provide students who wish to pursue a career in the field of information security a glimpse into a day in the life of a security professional. Not only do the students get to experience the challenges of managing an assortment of IT systems, but they also experience a heart-thumping, hands-on example of the realities and complexities of protecting a corporate computing environment from attackers.
This is the Mid-Atlantic region's seventh year participating in the CCDC events. The region has come to be known for pushing the edge of the envelope by incorporating real-world technologies into the game play, and this year's event was no different.
Building a Better Mousetrap
The Cyber WatchCenter and iSIGHTPartners have a difficult task each year. Along with running the Mid-Atlantic CCDC event, they have the task of devising a challenging environment that will be defended by the "Blue Cell" competing college teams and attacked by the "Red Cell" penetration testers. On the surface, developing this environment may seem to be a simple task until you consider what exactly goes into the making of this high-tech mousetrap.
Each year CyberWatch and iSIGHT plan out the game environment, taking into consideration typical components found in large businesses including emerging technologies as well as changes in the information security industry. "The goal is very simple," says Tim Rosenberg of iSIGHT Partners. "We aim to develop a game play environment that incorporates relevant technologies, and as closely as possible resembles the complexities that a student can expect to encounter in real-world corporate IT." This year's environment did exactly that with a staggering array of Windows domain components, Linux systems, databases, Voice Over IP, wireless, and even the integration of mobile tablet computer devices.
Each year, the competing environment is focused around a theme that is decided on current developments or challenges in the information security industry. This year's theme was hospital and patient care. To make the experiences as real as possible for the students, numerous components that would typically be found in a hospital environment were incorporated into the event. This included patient care databases that contained sensitive PII data as well as patient treatment information. Students must securely control these systems and protect them against compromise in order to ensure the well-being of their imaginary patients.
Adding to the challenge of the event, students must follow a tightly scripted set of "injects" or business tasks that involve an array of responsibilities typical for a hospital IT environment. These tasks range from performing software upgrades and the demands of management to dealing with power outages and data corruption. All this must be done while trying to cope with the onslaught of attacks from Red Cell.