National competition prepares Blugolds for careers in cybersecurity

| Judy Berthiaume

What happens if you spend your summer exploiting network weaknesses, breaking passcodes and hacking into computers?

You celebrate your successes, nurture the connections you made and look for more ways to build on your newly acquired skills.

Well, at least that’s what you do if you are part of a team of UW-Eau Claire computer science students that was among the top finishers in a national cybersecurity competition that helps prepare people for careers in the information security field.

The Blugold team of Hannah Borreson, Bradley Konsela and Brendan Zember recently placed 25th out of more than 3,250 teams in a four-month NetWars competition.

“It’s impressive that they did so well because it’s the first time our students have done anything like this,” says Steve Ranis, UW-Eau Claire’s Learning and Technology Services’ liaison with the computer science department and the student team’s mentor. “All three students came to solutions in different ways. They all had different ideas, different skills and different histories that they brought to the team, which was interesting to see as they worked on the problems.”

NetWars is a series of interactive scenarios that help people build their skills in information security. The internet-based competition features five levels of increasingly in-depth challenges that participants must solve over a period of several months.

The Blugold team solved all 63 information security challenges in the first four levels. Then, for the fifth level, it was given a computer with four services to maintain and protect from attacks by other teams. Students also had access to a shared attacking computer, where most of the aggressive security activities took place.

Scoring was based on how well services were protected, and by taking control of other teams' services.

There were many times during the competition when the UW-Eau Claire team struggled for days, or even weeks, on a certain problem, making it even more exciting when they’d finally solve it, says Zember, a junior computer science and mathematics major from Fort Atkinson.

“The greatest challenge was coming up with numerous different strategies to crack a password, or gain access to a system, or crack a cipher, only to ultimately have to scrap our idea altogether, and change our thinking entirely to come up with a new and creative approach to the problem,” Zember says. “The most rewarding parts were when we were finally able to solve a problem that had been puzzling us for weeks. The whole experience for me has been surreal.”

NetWars and similar competitions offer innovative ways for students to gain skills, experiences and connections that they can’t get through traditional classroom learning, says Dr. Jack Tan, professor of computer science and chair of the department.

“Participating in this event provided students with an abundance of new security knowledge and experience, but also opportunities to network with information security professionals,” says Tan, noting that the Blugolds’ success in the competition reflects the high quality of UW-Eau Claire’s computer science students. “This competition posed challenges above and beyond our current computer science curriculum.”

Borreson, a junior computer science in software engineering major from Whitehall, says the students are making the most of the opportunities they’ve been given through the information security events.

“The NetWars competition has given us all a foot in the door of cybersecurity,” Borreson says. “Since all of us on team ECR_RED are friends, we can keep learning and pushing each other to be even better.”

Borreson says she had no cybersecurity knowledge until last year when the computer science department sent her and her two teammates to an Information Technology Management Council meeting, where experts discussed different aspects of cybersecurity.

All three students were immediately intrigued by the topic, and determined to learn more, she says.

“I didn’t know anything about cybersecurity so it was eye-opening,” says Zember. “After the conference, I began practicing and teaching myself the subject. I wanted to learn more, and to have an opportunity to apply my knowledge.”

At the end of the conference, the Blugolds participated in a capture the flag-style event, giving them their first experience in a competition that tests peoples’ cybersecurity skills.

They enjoyed the experience and began joining in similar competitions with friends.

Given the students’ interest in the competitions and the computer science department’s desire to create more opportunities for students to learn about cybersecurity, Ranis registered the students for a spring Cyphercon 3.0 competition in Milwaukee.

“The Cyphercon event was much larger than anything we’d done; we were up against over 90 teams of all ages and skill levels,” Zember says. “We split up according to our personal strengths and skill sets, which allowed us to place fourth overall.”

They went into the Milwaukee competition eager to test their skills, but were primarily focused on learning from the other participants who had more cybersecurity knowledge, Borreson says.

At the end of the tournament, they were surprised to find themselves among the top finishers.

“We just wanted to see what the environment was like and to learn from the different challenge villages they had open,” Borreson says. “None of us expected to get fourth place. By landing on the award podium, we were given a subscription to NetWars so we could continue learning and challenging ourselves.”

Since the NetWars competition was a nationwide event with thousands of teams, the Blugolds again went into it expecting to improve their skills but to not finish particularly high in the team rankings.

Once again, they surprised themselves, this time finishing 25th out of more than 3,250 teams.

“I never imagined we would do as well as we did,” Zember says. “I went into this with the mindset that this was a learning experience above all else, not a competition. When we solved every problem and placed 25th out of nearly 3,300 teams nationwide, I was pleasantly surprised to say the least. I'm sad it's over, but I had the time of my life, and I'm so grateful I had the opportunity to participate in this event.”

The competition was difficult and at times frustrating, but it was worth the time and effort it took to solve all the challenges, the students say.

“Many of the attack vectors we had to exploit were unknown to any of us, so we either had to spend a lot of time researching potential vectors or swallow our pride and take available hints,” says Konsela, a junior computer science major from Holmen. “We prioritized learning over placement so we weren't afraid to take hints if we needed them.”

Borreson agrees, noting that initially it was hard knowing that some teams already were far ahead in their knowledge, but her team was determined to make the most of their opportunity to compete.

“We only had our dedication and wits to pull us through the challenges,” Borreson says. “Yet, in the end, our hours of studying seemed to pay off. When we did well during the challenges, I felt inspired and refreshed. I would by no means call myself a genius so these competitions gave me motivation to keep working hard to build up my skills and to keep using my determination to reach my goals.”

Thanks to the competitions, Zember says he now can confidently navigate and exploit networks and services, and has learned to use a variety of tools and methods to carry out penetration testing, all skills that will help him in his future career.

Konsela says in addition to new cybersecurity skills, he also gained an appreciation for the value of collaboration, even among competitors.

Participants shared information, ideas and strategies across teams, helping everyone build their base of knowledge and skills, Konsela says.

“We had the opportunity to network with two other participants in our final challenge of the competition, the first being someone who hacked us, and the second someone who we hacked,” Konsela says. “We had excellent discussions with both individuals about how to better attack and defend our computers.

“Having someone help us, and then being able to immediately pay it forward a few days later, was incredibly gratifying. These communications contributed to our eventual success in this challenge.”

Participating in NetWars and other information security competitions has given students a peek into the world of the cybersecurity field, which is helping her think more broadly about how she wants to use her computer science degree after she graduates, Borreson says.

“I gained a lot of confidence in my abilities, but also an idea of how I can help others using my computer science knowledge,” Borreson says. “I plan to use what I learned from NetWars and Cyphercon as a stepping stone to another kind of education. I will participate in more learning opportunities concerning cybersecurity and other related subjects in the next few years to further strengthen my abilities.”

For Konsela, the competitions have reinforced his interest in pursuing a career in penetration testing.

“For the most part, I find coercing computers to behave strangely to be more satisfying than programming them to behave properly,” Konsela says. “Penetration testing is a logical step for me. New exploits are created every day, and are most often made public before becoming obsolete. My interest is in penetration testing, the aggressive side of information security. I want to find exploits and create viruses to help the systems become more secure.”

Students like Konsela, Borreson and Zember will find many opportunities in a variety of industries because the demand for information security professionals is extraordinarily high, Tan says.

“Cybersecurity experts are needed in health care, finance, global manufacturing, academia and governmental agencies,” Tan says. “ISACA, a nonprofit information security advocacy group, has predicted that there will be a global shortage of cybersecurity professionals in the next year. The number of information security analyst jobs that are unfilled every year is over 400,000.”

The computer science department provided funding for the students to participate in the competitions, part of its efforts to better prepare its students for careers in the information security field, says Tan, noting that the computer science department also is working to recruit a new faculty member whose academic and research expertise is in information security.

With funding from a UW System Innovation Program grant, the computer science department, in collaboration with LTS, also now is building a cybersecurity lab on UW-Eau Claire’s campus.

The lab will help identify and resolve weaknesses in UW-Eau Claire’s information systems, giving students real-world experiences while also helping to protect university resources, says Ranis, who will oversee the lab.

Initially up to four students — including Konsela, Borreson and Zember — will work in the lab, but that number will likely grow to eight students in the spring. Eventually, Ranis says, he would like an entire computer science class to be active in the information security lab.

“Anytime you give students practical experience it will help them when they get into the workplace,” Ranis says. “These students will walk into their workplaces with the skills they need to immediately do their jobs. They’ll already know best practices and how to avoid pitfalls, which is something that will be very helpful to their future employers.”

Photo caption: Blugolds earned high honors in a national cybersecurity competition. The team included (from left) Brendan Zember, Bradley Konsela, Steve Ranis (advisor) and Hannah Borreson.