NEWS

RIT cyber team goes on defense in national hacker event

Jim Mandelaro
Rochester
  • 10 colleges around nation will compete.
  • Goal is to play defense while completing tasks.
  • RIT finished first in 2013 and second last year.

Picture this: You're on your computer, furiously trying to ward off one attack after another from professional hackers. At the same time, you're attempting to complete multiple tasks assigned by your boss.

Do you sink or swim? Make it or break it?

That's the challenge facing the local college team you've probably never heard of — RIT's cyber security squad.

"It's one giant head game," says Tyler Fornes, a graduate student from Springville, Erie County.

Bryan Harmat, left, and Tyler Fornes are part of RIT’s cyber defense competition team that will be taking part in the Collegiate Cyber Defense Competition. The national event will take place in San Antonio, Texas.

Fornes is one of eight Rochester Institute of Technology students who will compete in this weekend's national Collegiate Cyber Defense Competition championships in San Antonio, Texas. About 180 schools nationwide have cyber security teams, but only 10 regional champions reach nationals.

RIT won the competition in 2013 and finished second to Central Florida last year. RIT posted 5,000 points and lost by 172.

Those schools will be joined in San Antonio by Southern Utah, the University of Nebraska at Kearney,, Alaska-Fairbanks, Texas-San Antonio, ITT Tech Boise, Cal Berkeley, Maryland-Baltimore County and DePaul.

For these teams, the most points wins — but defense is the only option.

Here's the basic premise:

Student "blue" teams are tasked with protecting a bullet-ridden computer infrastructure (one they've never seen before) while being attacked by "red" teams (industry professionals posing as hackers). The students get points, increasing in unknown increments, for warding off the attacks and maintaining their systems. But they also must perform business injects assigned by their "bosses" (the white team) and must maintain existing mail and Web servers.

If their system falters or crashes, they lose points.

RIT’s Bill Stackpole is the coach of its Collegiate Cyber Defense Competition team.

"Those who perform the best get the most points and wins," says Bill Stackpole, associate professor of computing security at RIT and the computing security team's coach.

And just like all sports, there's no foolproof defense. Even Syracuse University's vaunted 2-3 basketball zone couldn't stop hackers.

"I promise you, the red team is breaking into the box," Stackpole says. "I don't care how good the blue team is. It's not a question of if it's going to get breached, it's a question of when."

This isn't all fun and games. Cyber attacks have hit major companies such as Anthem, Staples, Home Depot, JPMorgan Chase and SONY Pictures (remember The Interview?) in recent years, and the FBI now considers cyber crime to be a major issue.

The Collegiate Cyber Defense Competition began in 2004 and was sponsored by the Department of Homeland Security. RIT joined in 2008 and has reached nationals six times, never finishing worse than fourth.

Sponsorships have grown and now include power companies such as Facebook, Microsoft, Hershey and Amazon. The title sponsor is Raytheon, a major American defense contractor.

These companies aren't merely doing this as a goodwill gesture. There's a reception when the competition ends Saturday night, and top officials actively will recruit CCDC members to work for them at starting salaries in six figures.

"The students bring their résumés with them and everything," Stackpole says.

In 2009, Boeing was a major sponsor of the West Coast regional and hired all six graduating members of the Cal Poly Pomona team that won.

You don't need to be a genius to work on RIT's computing security team, but you do need at least a 3.0 grade-point average. The college advertises the program at the beginning of the academic year and holds tryouts in a giant lab before a team is selected. There are 12 members, but only eight will compete at the CCDC this weekend.

Students say they were drawn to computers early in life — and for different reasons. Fornes' uncle was in the Air Force and showed Tyler how to build his own computer. For Stanley Chan, a fourth-year student from Brooklyn, the itch came during middle school "when I realized my computer was broke, and I didn't know how to fix it."

He does now.

The RIT students will fly out Thursday. Friday at 9 a.m., they will be placed in a Marriott hotel room filled with computers and cables and will see their infrastructure for the first time. Dozens of white team members (bosses) dispense orders. The "red" team will attack from 9:30 a.m. until 6:30 p.m., at which point the blue team is removed from the room and the infrastructure stays up.

"You're definitely in a high-stress situation," Chan says. "People get on each other's nerves. The best part about being on this team is everyone understands people are going to be on edge and tired. It's like, 'Let's not hold anything against each other. Let's plow through this together.' "

Bryan Harmat, a fourth-year computing security major from Worcester, Massachusetts, is the captain of the RIT squad. His job is to secure the network devices and make sure everyone stays on task.

"It's pretty stressful but a lot of fun," he says. "This is something I love. There are a lot of different things I can do in this field. I just want to learn as much as possible."

Communication is vital, and so is chemistry. That's why the team members bond by playing video games, board games and even karaoke.

"It's very vital that we all communicate with each other when we change something," Fornes says. "We could end up hacking ourselves if we don't do things in the right order."

Competition resumes Saturday morning, at which point teams will get a rough idea of their current ranking. And the winner?

"The winner gets glory and fame," Stackpole says with a smile.

And, most likely, a job that pays six figures.

JMAND@DemocratandChronicle.com

www.Twitter.com/jmand1

No hack job

What: The 2015 National Collegiate Cyber Defense Competition (CCDC).

When/where: Friday and Saturday in San Antonio, Texas.

Object: Rack up points by fending off computer hackers while completing assigned tasks. The team with the most points after two days wins.

Defending champion: Central Florida.

For more information: Go to nationalccdc.org.

RIT also hosted a Major League Hacking competition weekend April 18 and 19: