Hacking competitions seek cybersecurity superstars

A man behind a computer covered in stickers

Related Stories

As cybersecurity becomes a bigger threat for American government and businesses, high school and college students are being recruited early to help fill vacant technical positions. In Virginia, these students compete against one another for top slots.

The attack started a little after 08:00.

Numbers streamed across the computer screens in cryptic order, containing disguised codes that could make the whole system collapse. The mission: find the intruding language, isolate it, and keep the system safe.

In the basement, about 80 young adults, mostly in their late teens and 20s, sat in silence, hunched over laptops, exchanging only a few words of strategy and nods of approval.

As the offensive got underway the sound of hundreds of fingers tapping on keyboards were drowned out by the thumping bass of Swedish House Mafia, blasted from the speakers in the corner.

The battle was the final leg of a four-day cyber camp, hosted by the US Cyber Challenge and Virginia Polytechnic Institute and State University.

As part of the camp, a dozen teams raced against each other in a so-called "capture the flag" competition. In this case, flags are strings of information on websites that don't belong there. Teams score points depending on the difficulty of isolating the rogue data. From the sidelines, future employers watch, waiting to be impressed.

The Snowden effect

Edward Snowden, the private contractor who leaked classified government documents, is a divisive figure within the cyber security community. Many would not discuss him at all.

"Is the system broken, is that what you're asking? Then my answer is a resounding yes," says a government agency official who asked to remain anonymous.

Snowden is not the only person discontent with security measures in general, this official says, and he was an example of resorting to vigilante methods.

Others have empathy for Snowden.

"I think the [National Security Agency] was doing stuff that they shouldn't have been doing, and that made Snowden really upset. So it's a question of ethics in the organization," says Cigital's Gary McGraw.

"As an American citizen, I do not appreciate a nanny state where my email headers are being collected."

American corporations and government entities face cyber-attacks every day, and are in dire need of people to defend them. These college students may be the country's best hope.

With the rest of country facing a 7.6% jobless rate, recruiters assess that the national unemployment gap - the number of vacant positions compared to the number of available candidates - in cybersecurity could be as high as one million, with 10,000 vacancies in the state of Virginia alone.

"The age of the cybersecurity workforce is generally over 40 years of age, and we need new talent," says Samuel Schneider, representative of (ISC)2, a global IT security organisation.

Private contractors and government agencies like the Federal Bureau of Investigation and Department of Homeland Security use the cyber camp to scout for that talent. A student with the right skills can pretty much pick and choose a career.

"Personally, I'm looking at the intelligence community and government," says Jonathan Weber, 22, a student of computer security at East Stroudsburg University, Pennsylvania.

The camp is also a way to introduce potential careers to those with the skills, but without the knowledge of where those skills can take them.

"After coming to this camp, there's so many ways to branch out. I've discovered a lot of options," says Nicholette Fortune, 19, from Brooklyn, New York, and one of the few women among the contestants. "I haven't had hands-on experience, so this is great for a first time," she says.

Academic institutions have beefed up efforts to meet the need for cyber professionals, but the demand is still much greater than the supply, says Diane Miller. She directs Cyber Patriot, a national high-school cyber defence competition that's grooming tomorrow's cyber protectors, presented by the defence technology contractor Northrop Grumman and the Air Force Association.

By designating select institutes "centres of excellence" and awarding scholarships to students, government agencies and private contractors work with academia to try to keep America at the cutting edge of the business.

Students from engineering schools attend, on Meudon, west of Paris, overnight on March 16, 2013, the first edition of the Steria Hacking Challenge. Hacking contests have become an international phenomenon, like this one held in France

"Everybody is scrambling to find that exceptional talent," says Ms Miller. In June, Northrop Grumman launched a cyber-education programme for kids in their early teens. The programme started in Los Angeles, with plans to expand to the entire country.

"The earlier we reach them, the less risk they are at, you know, going out and performing illegal or illicit activities," says Mr Schneider of (ISC)2. He says he is looking to "indoctrinate or incorporate a new security mentality into children".

Instead, potential lawbreakers can put their talents into good use in national interest. "They are going to get into the system, whether you like or not," says Mr Schneider.

Break and build

During the competition, participants use methods of attack, which could easily be used for malicious intent. And that's the point.

"You have to know how to break things to be able to build them really well," says Gary McGraw, a renowned security expert. McGraw serves as chief technology officer for the software security consulting firm Cigital, which he says grew 25% last year, and constantly has vacancies equalling 10% of its workforce.

Are geeks the new jocks?

As cybersecurity becomes more important to the global economy, those who show aptitude at a young age might start to get the type of treatment usually reserved for a star quarterback.

Government institutions like the National Security Agency (NSA) are awarding a growing number of scholarships to students looking to work in cyber security, not unlike the way athletic skills have traditionally opened doors to academic institutions.

And the competitive aspect of cyber security on display at the cyber camp has familiar roots, says Randy C Marchany, IT security officer at Virginia Tech, who coaches volleyball on the side.

"How do we identify people with cyber skills? Well, the sports model is a model that works," he says.

He is not worried about teaching young people techniques that could potentially be misappropriated. Like other companies, Cigital insists it performs rigorous checks on a potential employee's background and ethical conduct.

And once in, Mr McGraw says, employees get a training that is far superior to that of the "script kiddies" - his name for those who attempt rogue attacks on Cigital's clients.

The issue of employee reliability has gained new importance in the past month thanks to former defence contractor Edward Snowden, who claims to have sought employment with the technology firm Booz Allen Hamilton in order to leak classified NSA intelligence.

Among the cyber campers, many condemn his actions outright, and some even warn against turning Snowden into a hero.

"It's added some glamour to the whole thing," says Charisse Scott, 23, as the competition in Virginia wraps up. "My worry is that kids are going to be like, 'That's what I want to do'."

However, in the basement in Virginia, all prestige and glamour falls on Team 3, which wins the competition after taking an early lead. The young adults behind their laptops are - at least for now - more concerned about preventing security breaches than causing them.

More on This Story

Related Stories

More US & Canada stories

RSS

Features & Analysis

Elsewhere on the BBC

Programmes

  • Models of roads and cars on a bridgeThe Travel Show Watch

    A world in miniature - behind the scenes at one of the world’s largest model railways

BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.