Major, well-funded contests entice students to consider cybersecurity careers

Public, private institutions aim to develop cyber professionals to fill national, global shortage

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

As a high school junior in sub­ur­ban Pitts­burgh, Tim Beck­er wasn’t sure what he want­ed to do with his life until he stum­bled into Carnegie Mel­lon University’s pic­oCTF, a free, online hack­ing contest.

Cap­ture the Flags—or CTFs—are a type of com­put­er secu­ri­ty com­pe­ti­tion in which con­tes­tants reverse-engi­neer, break, hack or decrypt infor­ma­tion encrypt­ed or hid­den on servers to which the par­tic­i­pants have access. When com­peti­tors unlock spe­cif­ic infor­ma­tion, they “cap­ture the flag” asso­ci­at­ed with the task and earn points for the team.

Pho­to: David Kel­ly,
Tim Beck­er, a cap­tain on Carnegie Mellon’s stu­dent hack­ing team

CMU’s com­pe­ti­tion had “almost every­thing to do” with Becker’s deci­sion to major in com­put­er secu­ri­ty at the uni­ver­si­ty, he said. He entered the 2013 pic­oCTF com­pe­ti­tion with a team of high school friends and found it simul­ta­ne­ous­ly con­fus­ing and exhilarating.

By the end of the first night, we were in the top 20 teams out of a cou­ple of thou­sand,” Beck­er said. “We real­ly sur­prised our­selves. Pret­ty much for the remain­der of the com­pe­ti­tion, I was com­mit­ted to doing as well as we pos­si­bly could. We end­ed up in third place. After that, I was real­ly sold.”

Reduc­ing dearth of cyber­se­cu­ri­ty pros

Com­pe­ti­tions like CMU’s have sprung up around the coun­try and the globe. Their goal is to encour­age and build a tal­ent pipeline for the boom­ing cyber­se­cu­ri­ty sec­tor by encour­ag­ing the devel­op­ment of com­put­er secu­ri­ty skills by mid­dle and high school students.

Mar­tin Carlisle, direc­tor of aca­d­e­m­ic affairs for Carnegie Mel­lon University’s Infor­ma­tion Net­work­ing Institute

Pic­oCTF is very specif­i­cal­ly designed to help get peo­ple think­ing about careers in com­put­er secu­ri­ty at younger ages,” said Mar­tin Carlisle, direc­tor of aca­d­e­m­ic affairs for Carnegie Mel­lon University’s Infor­ma­tion Net­work­ing Institute.

Relat­ed: Cybersecurity’s peo­ple prob­lem: More mil­len­ni­als needed

The num­ber of open cyber­se­cu­ri­ty jobs were pegged at 1 mil­lion in 2015 in a report by Cisco—a num­ber expect­ed to bal­loon to 6 mil­lion glob­al­ly by 2019, with a pro­ject­ed short­fall of 1.5 mil­lion pro­fes­sion­als to fill the posi­tions, accord­ing to Syman­tec CEO Michael Brown.

The demand is so great and the avail­able work force so small that the pro­fes­sion boasts its own stu­dent orga­ni­za­tion, the Nation­al Cyber­se­cu­ri­ty Stu­dent Orga­ni­za­tion, cre­at­ed express­ly to sup­port the devel­op­ment of cyber­se­cu­ri­ty stu­dents through edu­ca­tion­al pro­grams at aca­d­e­m­ic insti­tu­tions and through pro­fes­sion­al activ­i­ties and networking.

Con­tests such at pic­oCTF increas­ing­ly take advan­tage of the vir­tu­al nature of the tasks by expand­ing their com­pe­ti­tions nation­al­ly and glob­al­ly to attract more par­tic­i­pants. CMU has open-sourced pic­oCTF, enabling schools and com­put­er clubs around the coun­try to run their own ver­sions of the com­pe­ti­tion. Inde­pen­dent con­tests include Phillips Acad­e­my CTF (PA-CTF), at the pri­vate Phillips Acad­e­my Andover in Mass­a­chu­setts; High School CTF (HS-CTF), orga­nized by stu­dent mem­bers of the com­put­er sci­ence club at West Wind­sor-Plains­boro High School North in New Jer­sey; and Thomas Jef­fer­son CTF (TJ-CTF), at the Thomas Jef­fer­son High School for Sci­ence and Tech­nol­o­gy, a mag­net school in Alexan­dria, Vir­ginia. CMU’s 2017 pic­oCTF, which end­ed April 14, attract­ed over 18,000 participants.

Grab them young’

A stu­dent on a hack­ing team in Sta­vanger, Nor­way com­petes in picoCTF.

Entic­ing high school and mid­dle school stu­dents to the field through con­tests such as pic­oCTF is the right way to go, said Robert R. Ack­er­man Jr., founder and a man­ag­ing direc­tor of Allegis Cap­i­tal, an ear­ly-stage Sil­i­con Val­ley ven­ture cap­i­tal firm that invests heav­i­ly in cybersecurity.

Young peo­ple have a set of crit­i­cal think­ing skills in the dig­i­tal envi­ron­ment that go a long way,” Ack­er­man said. “This is an area young peo­ple have grown up in, and their brains are almost wired for it. When we grab them young, over time, their skills build on that ear­ly foundation.”

And com­pa­nies are will­ing to pay for the exper­tise. Cyber­se­cu­ri­ty work­ers com­mand salary pre­mi­ums over oth­er IT work­ers ($6,500 per year, or 9 per­cent in 2015, accord­ing to a study by Burn­ing Glass Tech­nolo­gies). Entry-lev­el cyber­se­cu­ri­ty posi­tions often are as “infor­ma­tion secu­ri­ty ana­lysts,” a posi­tion U.S. News and World Report ranked sev­enth on its 2017 list of best tech­nol­o­gy jobs, and 52nd on the top 100 jobs over­all, with a medi­an salary of $90,120.

Ack­er­man is par­tic­u­lar­ly bull­ish on tap­ping the country’s com­mu­ni­ty col­leges to most quick­ly fill the job pipeline. “When it comes to cyber, you can grad­u­ate peo­ple with mean­ing­ful req­ui­site cyber skills from a two-year, com­mu­ni­ty col­lege pro­gram,” he said. “And these are good jobs. This is an area for qual­i­ty job growth.”

Under­scor­ing Ackerman’s point, Maryland’s Prince Georges Com­mu­ni­ty Col­lege is host­ing the 2017 Com­mu­ni­ty Col­lege Cyber Sum­mit (3CS) June 28–30, the only nation­al aca­d­e­m­ic con­fer­ence focused on cyber­se­cu­ri­ty edu­ca­tion at the com­mu­ni­ty col­lege level.

Pub­lic-pri­vate part­ner­ships vital

Nor­way stu­dents com­pete in a pic­oCTF contest.

Under­stand­ing their cur­rent and future need for cyber­se­cu­ri­ty pro­fes­sion­als, pri­vate com­pa­nies and pub­lic insti­tu­tions beyond col­leges and uni­ver­si­ties also are becom­ing involved. CMU’s pic­oCTF will award more than $30,000 in prizes from cor­po­rate and gov­ern­ment spon­sors includ­ing dig­i­tal, tech­nol­o­gy, con­sult­ing and oper­a­tions ser­vices provider Cog­nizant, Aet­na, Boe­ing, the Nation­al Sci­ence Foun­da­tion and the Nation­al Secu­ri­ty Agency.

NYU’s 2017 con­test award­ed more than $1 mil­lion in schol­ar­ships and was spon­sored by orga­ni­za­tions includ­ing Google, the U.S. Depart­ment of Home­land Secu­ri­ty, IBM, Raytheon, Intel and the NSA. In addi­tion, the NYU Cen­ter for Cyber Secu­ri­ty is offer­ing doc­tor­al schol­ar­ships and fel­low­ships to col­lege-lev­el final­ists who emerged vic­to­ri­ous at the contest’s three glob­al hubs.

Beck­er is now a cap­tain on Carnegie Mellon’s stu­dent hack­ing team, the Plaid Par­lia­ment of Pwn­ing (PPP). The team has won DefCon’s Cap­ture the Flag competition—informally known as the Super Bowl of Hacking—three times in the past four years.

The com­pet­i­tive aspect is one thing, but by far, the most impor­tant thing you get from the com­pe­ti­tion is how much you learn,” Beck­er said.

The 20-year-old junior now is strong­ly con­sid­er­ing grad­u­ate school to study cryptography.

More sto­ries relat­ed to cyber­se­cu­ri­ty jobs:
Help want­ed: More women in cyber­se­cu­ri­ty jobs
Three steps to fix­ing the cyber­se­cu­ri­ty tal­ent shortage
Brown Uni­ver­si­ty launch­es mile­stone exec­u­tive cyber­se­cu­ri­ty program
Schol­ar­ships aimed at clos­ing cyber­se­cu­ri­ty tal­ent gap


Posted in Cybersecurity, Featured Story