By: Andrew Hall, CISSP Information System Security Manager at USAF
April 21, 2020
Prefatory Note: CyberPatriot is the National Youth Cyber Education Program created by the US Air Force Association to inspire K-12 students toward careers in cybersecurity or other science, technology, engineering, and mathematics (STEM) disciplines. At the core of the program is the National Youth
Cyber Defense Competition, the USA’s largest cyber defense competition that puts high school and middle school students in charge of securing virtual networks.
The CyberPatriot program is an established IT cyber security exemplifying one of the outreach efforts on the (CS)2AI projected developments board. We asked Andrew Hall to submit this article on his experience in order to provide some insight into the program for those (CS)2AI members not familiar with it, and also a greater understanding of our organizational objectives in this area.
************************************************
The CyberPatriot program started in 2009 and has grown from eight teams as a test run to now over 6,000 teams. It moved from being limited to Air Force Junior Reserve Officer Training Corps (AFJROTC) and Civil Air Patrol (CAP) units to full open division and now even down into elementary schools preparing children for futures in science, technology, engineering, and math (STEM) as well as cybersecurity.
CyberPatriot competitions were initially geared toward blue team (defensive) as participants fix Red Hat and Windows (desktop and server) images while answering questions about the accounts or system configurations given to the teams within those images. More recently CISCO networking became a bigger part of the program, as well virtual network challenges.
My own first interest into the program came after getting more involved in cybersecurity at work and obtaining my CISSP in 2013. After becoming friends with a mentor in the program (he mentored the winning Clearfield, UT team in 2009) I became a mentor during CyberPatriot VII in 2014-2015 for an open division team in Northern Utah where two of the teams placed in State.
Mentoring a CyberPatriot team is dependent on the Coach and team you are working with as some are experienced while many are new to computers and security. Not all schools are equipped to participate and require computers to compete. A good coach (usually a teacher) will set ground rules for the students and help facilitate the mentoring for the competition. Mentors come from many different backgrounds and experience and it is good to have a few available for teams to utilize. Teams can learn from mentors between competitions, usually in formal weekly training sessions afterschool, but cannot use the mentors or coach during the competition phases.
It is important to have the teams run through practice images and network questions before each competition so they can ask questions to mentors and help them learn. Mentors should also take time to prepare practice images if they are able to or do training on main principles of securing an OS such as; how to restrict accounts, setup a firewall rule, and basic CISCO switch setup. There is a lot of work to help teams prepare and compete in CyberPatriot challenges that is both difficult and rewarding, no matter where the team places in the contests. Schools wanting to participate should push for mentors to commit to multiple years of participation to help those that are interested in cybersecurity continued growth and development while also giving those with interest a place to get their feet wet.
Mentors need to put forth consistent effort to help coaches and teams learn through the contest and make this a yearly activity for the school and get veteran participants encouraging and advising newcomers. Mentors then can focus on providing training at different levels and help the veteran teams get better each year.
Control systems may never become part of CyberPatriot but you can influence the participants through training on all the other areas of cybersecurity while mentoring. I highly recommend working with your local schools to get them involved with CyberPatriot to provide an opportunity to youth interested in cybersecurity.
Comments