The members of the Penn State Competitive Cyber Security Organization (CCSO) are embroiled in a game of capture-the-flag. They’re in hot pursuit of the pennant, hoping to find it before their competitors. But instead of dashing across fields and through the woods, they’re gathered in a conference room sharing pizza. And instead of searching for a brightly colored flag, they use their cybersecurity skills to find a “flag” that is actually a special computer file.
Penn State says that this twist on capture-the-flag (called CTFs in the competitive cybersecurity world) is just one of the activities that members of CCSO engage in. The club, founded in 2013, focuses on all things cybersecurity: Members have the chance to attend conferences, listen to speakers and participate in cybersecurity competitions.
“The club is really an opportunity for us all to learn and expand our skill sets,” said George Beatty, CCSO member and a double major in information science design and development and security risk analysis. “The College of Information Sciences and Technology (IST) does a good job of preparing its students for careers in computer science, but the field is so large that sometimes there’s a gap between what you’re learning and what you want to do. The club helps round out our education.”
Gearing up for competition
When Michael Morelli, now the club’s vice president and a senior majoring in security risk analysis, first attended a club meeting, he wasn’t yet familiar with what a cybersecurity competition looked like. But fueled by a passion for security and a strong competitive streak, he joined and started attending meetings and competitions.
He soon learned that CTFs aren’t the only type of cybersecurity competition. In some, a fake network is created and participants are instructed to break in. In others, they’re charged with protecting the network instead of trying to hack in. Sometimes participants compete remotely and other times they travel to the institution hosting the event.
“A big part of these competitions is being put outside of your comfort zone,” said Kevin Houk, president of the club and a security risk analysis major. “You’re supposed to do research and try using different tools to solve the problem, even if you go down the wrong path at first. It’s all about developing your skills.”
After each competition, the club meets to talk about how it went and to bring members that didn’t attend up to speed. Beatty says it’s important to consistently touch base and evaluate everyone’s strengths and weaknesses.
“We’re always asking our members, ‘What did you excel at? What are you struggling with?’” Beatty said. “That way we can more accurately match people up with the types of competitions they’ll hopefully do the best at.”
The team has been steadily improving its placement in competitions.
The past two years, they were finalists and received awards to participate in the finals of the National Cyber Analyst Challenge. Additionally, they placed sixth in the National Cyber League and were 10th out of 98 teams in theMITRE Capture the Flag event. And as members gear up for another season, they hope to get even better.
“Penn State is great at and well known for its athletics programs, but the University is really excelling in these fields within cybersecurity, too,” Houk said. “I think, and hope, this will be the next thing Penn State is known for.”
Preparing for the future
Houk’s prediction is already coming true.
President Eric Barron invited the club to join him for a pregame tailgate before the Nov. 5 football game against the University of Iowa. With only one club from Penn State being invited each year, Houk says it’s a huge honor.
“It’s amazing that we’re doing what we love to do and other people are finding value in it,” Houk said. “Cybersecurity is an important issue right now, so it’s good to be recognized for the work we’re doing.”
Even though the club’s members are still here at Penn State, some of them credit the work they’ve done with CCSO for helping them secure jobs before graduation. Beatty is a consultant for Deloitte Advisory, and Houk works for a small bitcoin company. Chris Masden, a club member majoring in security risk analysis, will be doing vulnerability research, while Morelli has secured a position with Boeing.
“This isn’t actually uncommon in the College of IST,” Beatty said. “They have a really good record of job placement with their students. Many of us have jobs our entire senior year.” As the team prepares for their next event — the fall season of the National Cyber League — Masden says he hopes to continue this kind of work post-college. “In the future, moving on from Penn State, I always want to be doing this,” said Masden. “I don’t want to be management or work on policy. I want to be doing this hands-on work.”
To learn more about the club, visit the CCSO Web site.
