A team of Cal Poly Pomona students took home the top trophy in the Collegiate Penetration Testing Competition (CPTC) Global Final January 6-9. Stanford placed second and Tennessee Technological University placed third.
This was the first time Cal Poly Pomona won the competition, which challenges the world’s brightest cybersecurity students to put their hacking skills to the test.
In the CIPC Finals, teams from 15 universities competed to see who was best able to break into fabricated computer networks, assess their weak spots and come up with plans to better secure them. This year’s competition was held in a hybrid format at the Rochester Institute of Technology, in Rochester, NY
CIPC has grown into the premier crime-based college computer security event, since its debut at RIT seven years ago. The CPTC is an effective equivalent of the Collegial Cyber Defense Competition (CCDC), which is the premier defense-focused event for college students.
“The cream of the crop is coming to this competition, and it’s really motivating for us and for our future,” said Bob Kalka ’89 (IT), vice president of IBM’s Security Business Unit, which sponsors the CPTC. “We can literally watch the best cybersecurity students around the world at work, doing what they do best. “
The Penetration Testing Competition allows students to experience a day in the life of a penetration tester, in-demand security professionals hired to test and evaluate an organization’s computer systems and networks in order to s ‘ensure that malicious hackers cannot enter.
Teams of six students interviewed the network of a fictitious company. The next day, they reported on their findings and offered their suggestions for mitigating the risks.
This year’s test target was Le Bonbon Croissant, a Paris-based candy and croissants factory and direct selling company. The shell company had suffered a security incident within the warehouse technology team and was looking to ensure that a future breach did not occur.
As competition pentesters, students sought to validate the integrity of custom business processes and customer experience systems, including industrial control systems (mostly running on Modbus) in distribution plants, the program of customer rewards and e-commerce and payment processing applications.
“This year, we came up with an optimized competition for the pandemic long game,” said Justin Pelletier, director of the CPTC and director of the GCI Cyber Range and Training Center at RIT. “It is important for me personally to demonstrate that multiple crises do not require disaster. We can and should be able to coordinate cyber events in austere and contested environments. “
CIPC began in October, when more than 500 students gathered for eight regional events around the world.
The top 15 collegiate teams from the regions have been selected for the ICPC weekend world finals. The participating teams included:
- California State Polytechnic University, Pomona
- Princess Sumaya University of Technology (Jordan)
- Dakota State University
- Carnegie Mellon University
- Rochester Institute of Technology
- University of Florida
- Masaryk University (Czech Republic)
- California State University, Fullerton
- DePaul University
- Drexel University
- Tennessee University of Technology
- Stanford University
- New Haven University
- University of Tulsa
- University of West Florida
Judges and security industry sponsors evaluated the performance of competitors under fire. Students also had the opportunity to meet experts and distribute resumes. Sponsors include Main Sponsor IBM Security, Theme Sponsor Wegmans, Security Risk Advisors, Hurricane Labs, Crowe, HelpSystems, and Airship, among others.
“The lack of cybersecurity skills is a real problem that organizations face,” said Doug Rogers, director of information security at Wegmans. “Competitions such as the CPTC provide a great real-world training environment for future cybersecurity professionals to acquire relevant skills before entering the workforce. Wegmans is proud to sponsor this initiative to work with the next generation of cybersecurity professionals and help broaden the expertise of the community.
The competition environment was managed by RIT’s Global Cybersecurity Institute (GCI) Training and Cyber Center, which is capable of hosting over 5,000 virtual machines for immersive scenarios. Portions of the competition were broadcast on the GCI Twitch channel.
“The GCI is a vital addition to the RIT campus to support our growth and event expansion over the past several years,” said Tom Kopchak ’11 MS (IT Security), CPTC Competition Director and Director of Operations techniques at Hurricane Labs.
More information about the CPIC is available on the College Penetration Testing Competition website.