Educational Value of CompetitionHow Cyber Defense Competition Prepares Students for Careers
Does cyber defense competition help prepare college students for real-world jobs in information security and risk management? Dan Likarish and Rick Cisneros of Regis University say yes.
Regis University, based in Colorado, is the Rocky Mountain regional host of the National Collegiate Cyber Defense Competition, an annual contest that gives information assurance students a chance to compete with their peers in an exercise designed to test their abilities to manage and secure a corporate information system.
Like a collegiate sporting event, the competition shines a spotlight on the host schools, but mainly it's about showcasing the students, says Likarish, an assistant professor at Regis.
"It's all about the students, so [they] can learn by being in competition," Likarish says. "Significantly, we also incorporate vendors. You can imagine: Here you are in this pressure-cooker competition, and the hiring influencers are there keeping an eye on who does well under pressure."
Cisneros, a project scientist at Regis, says the cyber competition absolutely helps schools such as Regis prepare students for careers in the real world.
"The competition provides schools with a playing field where they can get feedback and determine how well they're doing - what improvements they need to implement," Cisneros says. "And being part of the competition may result in [the students] earning gainful employment with employers who are looking for [security] professionals."
In an interview about the educational value of competition, Likarish and Cisneros discuss:
- Critical skills taught through Cyber Defense Competition;
- How the competition prepares students for the real world;
- How these competitors will impact the information security profession over the next decade.
Dan Likarish is an assistant professor in the School of Computing & Information Sciences with responsibility for Information Assurance program coordination, students and research at Regis University. He is Director of the Colorado Front-range Center on Information Assurance Studies. His research and teaching interests are in the design and implementation of student cyber security competitions, security of critical SCADA infrastructure and virtualization of student lab exercises. He has installed and is calibrating a Radio Telescope for use as a K-Collegiate teaching instrument and directs the Rocky Mountain Collegiate Cyber Defense Competition. He is the recipient of various state, industry and federal grants and awards.
Rick Cisneros is the Project Scientist for the Regis University School of Computer and Information Sciences. He works directly with Dan Likarish and the Software Engineer and Applications Development Practicum group. Responsibilities include working with the CIS faculty to determine the future direction of the Academic Research Network Environment networking resources and continued strategic planning for local and regional cyber competitions. He recently retired from Metro State College of Denver after completing 27 years of service in Information Technology.
What Competition Means to Regis
TOM FIELD: Regis is a regional center now for the National Collegiate Cyber Defense Competition. What does this designation mean to Regis?
DAN LIKARISH: It means a couple of things. It allows the program, the school and the university to be exposed at a regional and national level. [It's] very much like an athletic competition. We also are able to have our own competition and that happens in March of each year and then from our regional competition you go on to the national. The other thing it does is it leaves the left behinds which are pretty interesting because they help us with our virtual environment. We learn how competition helps student learning, so it has really been spectacular.
RICARDO CISNEROS: Being a project scientist, my perception is a little bit different than Dan's, and it's more on the technical side of the infrastructure. Regis being the regional center for the Collegiate Cyber Defense Competition requires us to make sure that we build a solid infrastructure so that the competition runs flawlessly. That means that we're investing in our infrastructure. We're investing in newer technology. We're making sure we're on top of the latest and greatest technology that allows us to implement virtual technology, as Dan mentioned, and it also provides us resources to our students who help maintain the infrastructure and build out the cyber competition.
As Dan mentioned, if we were to talk about an athletic competition, when you're designated in a regional site, you're known as the site that provides the best possible playing field for the competitors. I think that's what we're getting at Regis, being in the regional competition for cyber defense.
How Competition WorksFIELD: Tell us about the competition, please, what the mission is and how it operates.
LIKARISH: It started with Dr. Greg White and Dwayne Williams back in 2003. Time passes and now we have ten regions roll up into the national competition in San Antonio in April. It looks very much like an athletic competition - golf tournament, NASCAR - but its mission is to have fun. It's all about the students, so the students are going to learn by being in competition.
Significantly, we also incorporate vendors and companies. Here you are in this pressure-cooker competition and the hiring influences are keeping an eye on who does well under pressure. The way it operates is we've got ten regions. Our region has a two-day competition and some do three days. We also have a virtual competition that's hosted by the University of Alaska Fairbanks. It's a fairly large operation. It's a business competition rather than a capture-the-flag or head-to-head competition. What we're trying to do is build up the ability to sustain a business. Isn't that right, Rick? Is that how you see it?
CISNEROS: That's right Dan. I'm glad you mentioned that because we handle it as a business approach internally as well for our students. We begin planning for the competition in the summer prior to the competition the following spring. We do best practices, business best practices; we look at the competition. We look at our infrastructure, as I mentioned before. We look at assigning tasks and creating leads for the different groups that are required to build out the infrastructure.
As we get closer to the competition, we start looking at simulation competition to make sure that we have the capacity to support the business groups or the teams that are competing all the way up until the day of the competition. The day of the competition is where we actually provide the service support for the team as a business would to any operation. The students are on-site providing instantaneous feedback to the groups, instantaneous troubleshooting to problems that pop up and arise as it would in the business environment. But in this case, it's a competition so we have to be at the top of our game with our students, and if we lose or if we're down 15 minutes that will severely impact the competition and its outcome.
LIKARISH: The way you win the competition is you keep your services up and you keep the evil doers off of you. Then all of this is judged by the judging team, by the observers that are in the room. There are a lot of moving parts but it all comes together and it ends up being a great experience for the students.
Benefits to StudentsFIELD: You've hinted at this, but what do you find to be the competition's key benefit to the students themselves? What are they getting from this?
LIKARISH: I've asked that of students, as well as faculty, because those are the two stakeholders in the competition, and what the students have said is, "I want to find out how good I am." They have been at this since middle school and high school and, for once, now have the ability to compete head-to-head against their peer group.
They put together their team in the fall of the year. They meet on their own schedule and then they come to us in the regional in March. They're all ready to go. They've got their operational structure put together. They've determined how they're going to address the issue. And frankly, the issues they're looking at, they don't know what the problem is until I release a general description of what they're going to be up against. It's all a bit of a surprise, especially the activity of the red team. We treat this as a zero-day incident, so it's exciting to see them prepare. But it's even more exciting to see how they address what we throw at them.
CISNEROS: I think the other key benefit is that they get feedback. And in any competition, whether you win or lose, you want to know where you can improve, what changes you want to make as you prepare for the next competition the following year. The feedback we get is very important, and we provide feedback that they want to consider and best practices, as I mentioned beforehand.
A Way to LearnFIELD: The question I asked upfront is why has competition proven to be such a successful way for students to learn. I'd love to hear your perspectives on that.
LIKARISH: There's quite a bit of educational research that says competition is key [for] men and women to be able to find out how good they are, and there's pretty good evidence for that. We're studying that. That's an area of research. It's not overlooked. We knew that it was out there, but we've gone through such bloody hell to get all the regions up and running that now it's time to be able to have feedback based on surveys and interviews, based on longitudinal work that we do, and make sure that we're most effective in workforce development and education of our young people.
FIELD: What do you find to be the critical skills that you're teaching through competition?
LIKARISH: At the end of the day, it's not the technical skills. It's organizational, the ability to work with others. We've seen so many variations across the teams, in my opinion. The significance is the ability to put eight people together in a pressure-packed situation, keep your cool and be able to grasp what comes at you. Frankly, there's no perfect solution to what happens during the competition. You've got to just keep things up and running and that's very unusual within the 18 to 22-year-old group of people. They really haven't experienced that, and that's what's significant about the competition. You put them in what looks like a very reasonable business intrusion simulation. Rick, you might want to talk about the technical skills they leave with.
CISNEROS: As I mentioned before with technical skills, the students have taken curriculum or are taking the courses in different disciplines - networking systems, administration and software development - all these courses that they've taken to complete their degree program. They use those skills and that knowledge as they're starting the competition.
But I also want to follow up with Dan. I think the most important thing outside of the technical perspective is that what businesses are always looking for - and you've seen this over and over in reports and news we get - are students who can communicate, troubleshoot and do analysis. Those are really the more important aspects of what students gain from this competition. Dan is right. They have to work as a team. They have to provide verbal and written communication responses that are required of each student, and working as a team is critical, because you can imagine the pressure that's put on a team. If they can't communicate amongst each other, they're not going to make sure that their systems stay up. As a result, if they were working in a company, the company would fail or they would lose services and potentially lose business that generates income.
Real World PrepFIELD: I like where you're headed there Rick, projecting about the work experience, because that's where I wanted to go. How does the competitive experience in the academic setting help these students when they get into positions in the real world?
LIKARISH: What they learn in the competition is unique, but it's the run-up to the competition that, for a lot of them, the learning happens. They get the tools. They get the teamwork. They get a playbook put together, and that takes months. We see them at the top of the game. What they're learning is a constant emphasis on fine-tuning. What happens if the scenario goes this way? How do we address that? What if we end up with different hardware? I don't want to say too much because I almost gave away some of the tricks we're going to pull this year. But the competition to me means when they go after each other in their club setting, when they learn how to bring up their own VMs or virtual blocks, those are the skills that employers want.
Two things that we need to do is we need to generate a more sharper, intelligent, tool-oriented and problem-solving set of students for the workforce, and these are the young people who do that. They're mostly adults. They're traditionally students who can compete, and that's what we saw last year, when the Air Force won our regional and went on to second in the nation.
CISNEROS: I think that's correct. I'll also give you an example. Some of the students who help this competition are employed and are IT employees of an organization. The challenges they face in their organization is they're limited to the resources and the ability to test and try new technology. In this competition, in the world that we build, students have full access to all and any technology that we see fit to build out the competition. What that means is, the students who have experience in Windows Active Directory but are limited in their workplace can come to this competition and build out an entire Windows Active Directory solution, try new techniques, try new solutions, break the system if that happens and then rebuild it.
FIELD: Let's come back to Regis. How does the competition help Regis University and other schools prepare students for the work experience? How is it extending what you're trying to do academically?
LIKARISH: What it does is it provides us a more competitive environment that we can roll into our classrooms. The surprise that I learned last year is that students learn through competition, and I know I'm a bit slow to the game but we've always known that. The stadiums are full on Saturdays. What happens during the week is that the football, basketball, baseball and soccer teams are learning the skills, tactics and strategy, and the same thing goes here. What it does for Regis though is it allows us to roll out this virtual environment, put it into the classroom, and then the students go through the same thing. It is tactical work, tools and strategy, and we've had good results from it.
CISNEROS: I agree. I think also as we prepare our students for the work experience, businesses are in need of security professionals. When we attended the nationals, we know that the military is looking for a huge amount of IT professionals to come on and help them secure our nation's networks. The competition rises in schools and the playing field that they can get feedback and determine how well they're doing and what improvements they need to implement the following year. They look forward to being part of the competition that may result in gainful employment with employers who are looking for IT professionals.
Women in SecurityFIELD: Going in another direction here, one of the profession's challenges is attracting women. How are you working to attract women to the competition and, by extension, to the information security profession?
CISNEROS: What we have to do as the leaders in the field is provide a safe, reasonable environment for both men and women, but primarily address the issue that women learn differently. They're motivated by different success factors. One of my colleagues back in the D.C. area was recently talking to middle school girls. What she was able to put in front of them was that you get to have a good job, it is interesting work and it pays well. That's the message we've got to get out, but not to the high school women. You do that to the middle school girls before they make decisions on whether to go into science, technology, engineering and math - the STEM fields - or head in a different path. That is where we're losing half of the labor force. That's another area that we're working on at Regis, to make certain we've got a very attractive environment for current women and then develop that flow that's virtually untouched.
CISNEROS: I have been working in the IT profession for over 30 years, and this has been a challenge throughout the IT profession for many, many years. I remember 15 years ago there were more women involved in information science and gaining degrees in that field, and we've seen that decrease over the years. One of the things that I think we're specifically doing here at Regis in regards to the competition is trying to build a less intimidating environment for the students who are supporting the competition, not intimidating in the sense that they can't do it. What I mean is, and as Dan mentioned, the way that women and men communicate are different, so we're aware of that and we're trying to provide a better environment.
In general, I think we need to attract younger women way before high school. Start getting them involved in some of these competitions in middle school and maybe even elementary school so they at least become aware of it, that there's this avenue for women and potential career paths for them as they move forward in their academic careers.
Look at the FutureFIELD: Looking at the competitors in today's competition, how do you see them being able to impact the information security profession in 5-10 years based on the experiences that they're gaining now?
LIKARISH: That's what we're all about. We know that there are criminal/terrorist activities, nation-states and so on, and that's been in the press for the last few years. The competitors leave with the confidence and the skills, the ability to be able to troubleshoot and to get the problem solved. Once they have that, it stays with them for the rest of their life and I think the significant change that you're going to see is competitions are going to bleed through into high school and middle school. They already have and there are quite a few out there, but it's going to become part of the middle school scene. What that requires then is this becomes a life-long thing. How good are my skills? Am I keeping up-to-date? As an academic institution, that's what we do. We give workers the ability to go back in and upgrade their skills. And because of the Internet and all that's going on in education, this becomes a continuous environment and the competitive environment just fits into that so naturally.
CISNEROS: I think that the competitors today will eventually be the leaders of businesses in 5-10 years, having gone to the competition and becoming clearly aware of security. I remember maybe 5-10 years ago, security wasn't really important in the IT role and department. Although we were aware of security issues, it would take a lower priority in terms of services. That has changed dramatically with the media and everything that has happened in cyber - cyber attacks across the country and internationally. These competitors will be the leaders in 5-10 years and will be directors, CIOs and CTOs, and companies will understand that security is probably one of the most important priorities in IT and we make sure they maintain their system and that the informational data stored in a company is secure.