World’s best cybersecurity students put to the test at RIT pentesting competition

The world’s best cybersecurity students came together at Rochester Institute of Technology to face-off in the Collegiate Penetration Testing Competition (CPTC) global finals Jan. 18-20. The event wrapped up the largest offense-based cybersecurity competition for college students, which is hosted annually by RIT.

A team of Dakota State University students took home the top CPTC trophy. University of Florida placed second and Penn State placed third.

“We screwed up bad last year and were able to make adjustments to redeem ourselves this year,” said Ryan Kleffman, a captain from the Dakota State University team. “Everyone on our team has a passion for cybersecurity and works hard, even doing this cybersecurity outside of the classroom. We’re so excited for this win.”

At the competition, 12 teams used white hat hacking skills to break into fabricated computer networks, evaluate their weak points, and present plans to better secure them. The pentesting competition allows students to experience a day in the life of a penetration tester. CPTC helps students build and hone the skills for a career in cybersecurity—an industry with a severe shortage of qualified professionals.

This year’s theme was social media, with students conducting a pentest for a mock company about to launch a new product.

“In today’s interconnected world, social media plays a pivotal role in our daily lives, influencing everything from personal interactions to global events,” said Justin Pelletier, director of CPTC and director of RIT’s ESL GCI Cyber Range and Training Center. “As aspiring cybersecurity professionals, understanding the complexities and security challenges of social media platforms is more important than ever.”

One thing that makes CPTC unique is how the competition gives students experience working with technical and non-technical clients in a professional manner. Professionalism—along with technical findings, presentations, and reports—play a key role in scoring well.

Judges and sponsors from the security industry evaluated the performance of the competitors. New this year, the organizers explored the potentials of IBM’s WatsonX as a form of decision support for the competition’s report scoring. They also integrated other artificial intelligence (AI) tools as part of the competition experience.

“There has been a lot of speculation that the future of our planet is going to be defined by humans and AI working together in teams,” said Pelletier. “We see integrating world-class AI resources, such as those provided by IBM’s WatsonX, as an urgent need across cybersecurity. It’s great that we’re able to highlight these potentials to the world’s best cyber students.”

The competition environment is run through RIT’s ESL Global Cybersecurity Institute (GCI) Cyber Range and Training Center, which is capable of hosting more than 5,000 virtual machines for immersive scenarios.

Students also had the opportunity to meet experts, hand out résumés, and interview with potential employers. Sponsors included IBM Security, Black Hills Information Security, Hurricane Labs, and Alpha Virtual, among others.

Ellis Springe, an operator with IBM’s X-Force Red Adversary Simulation team, served as keynote speaker at the competition. Springe conducts red team exercises, penetration tests, and security audits to help improve the security of global Fortune 500 organizations by identifying gaps in current defenses and emulating threat actor techniques.

Throughout the fall, about 500 elite cybersecurity students from 63 schools gathered at regional events across the world. The top 12 collegiate teams from regionals and wild card competitions were selected for the weekend-long CPTC global finals. Participating teams included:

• California Polytechnic University, Pomona
• DePaul University
• Princess Sumaya University for Technology (Jordan)
• Tennessee Tech University
• University of Florida
• University of Massachusetts Amherst
• University of Nevada, Reno
• Dakota State University
• Liberty University
• Penn State
• University of Central Florida
• University of South Florida

CPTC has become the premier offense-based collegiate computing security event, after starting at RIT 10 years ago. CPTC is a counterpart to the National Collegiate Cyber Defense Competition (CCDC), which is the premier defense-based event for college students. More information about CPTC is available on the Collegiate Penetration Testing Competition website.