U. Virginia team defends national cybersecurity competition title

The computer network of a fictional agricultural firm is secure for another day, thanks to students from the University of Virginia, who won first place at the 2019 National Collegiate Cyber Defense Competition for successfully thwarting simulated cyberattacks.

The key to success, the team’s captain said, was communication.

For the second consecutive year, UVA’s team won first place at the cybersecurity championship, held on April 25 in Orlando, Florida, prevailing over nine other teams to take home the Alamo Cup. UVA won its initial title in 2018, the first year the university entered the competition.

The competition, sponsored by cybersecurity firm Raytheon, is designed to introduce students to real-world attack scenarios to encourage them to pursue careers in cybersecurity and help to attract talent to fill the predicted 3.5 million cyber job vacancies needed by 2021.

Yonghwi Kwon, a computer science professor at UVA and the team’s faculty advisor, told EdScoop he was confident the team could win again. He said the students went into the competition focused and calm, despite not having as much experience as some of the other teams, who were more familiar with how the competition works.

In the competition’s simulation, UVA’s team defended the network of a fictional agriculture firm from simulated attacks that used the same tactics and techniques as real-world bad actors.

Team captain, Mariah Kenny, said that she and her peers practiced extensively in anticipation for the competition, meeting for two hours twice a week. The team created a defense manual full of contingency plans for possible incident scenarios and then ran through those scenarios. “We would kind of build out our game plan and then do mini-competitions to test our game plan,” she said.

Kenny said several members had taken a penetration testing class, which gave the team a better understanding of how the simulated attacks were carried out, strengthening their team’s technical skills.

“You have to understand how the attackers attack in order to do well and protect the systems,” Kwon said. “You need to understand how the attackers get in, what was the vulnerability and on top of that, you need to know how to fix it.”

The students also had to produce clear, detailed incident reports, which would be sent to an organization’s managers in a real-world hacking scenario. This is one area of cyberdefense operations where communication is critical, he said.

“To write a good report, the students need to know all the details,” Kwon said. But, he added, they also need to know how to communicate effectively with an organization’s stakeholders who, often times, may not have a strong technical background in cybersecurity. He said that if technicians do a poor job of communicating effectively to management, they will ultimately waste time having to re-explain critical information.

All of these tasks are completed in a situation designed to mirror real-world systems defense, Kwon said, giving the students the opportunity to solve complex problems under stress, instead of in a calm classroom.

“In the classroom, you learn more about the theory, but in this competition, specifically, you actually get to put it into practice and test it,” Kenny said. “That application and hands-on component are super important to actually learn the concepts and understanding them.”

Close collaboration between team members was an important skill that the competition made clear is critical to strong cybersecurity.

“I think that’s how our team did so well,” Kenny said. “Yes you need the technical skill, but that teamwork and communication component is critical because if your team falls apart, if you get too frustrated and your not communicating while you’re working together, you’re not going to be able to do as well or efficiently or maybe not solve [the problem] at all.”

As for the goal of attracting new talent to the workforce, Kwon said he believes the competition accomplishes this well.

“It is very important to train our future computer scientists or cybersecurity experts in realistic contexts, under the pressures,” he said.