The CyberDragons stand alongside the hacker (seated, center) they captured in the CCDC Regionals.
Last summer, Drexel University’s first-ever competitive cybersecurity team was still focused on fundamentals. The CyberDragons had just formed as a student group and there was plenty of ground to cover. Under the guidance of adjunct coach Chuck Ludwig, the head of information security at Susquehanna International Group LLP, the Dragons were learning about the basics of networking, the internet and system administration — a far cry from holding off hackers and beating back attacks like they would need to do in competition.
After a fourth-place finish in the National Collegiate Cyber Defense Competition’s Mid-Atlantic Regional held March 30 and April 1, a team once sprinkled with novices now has experience in all manner of cybersecurity exercises — and a run of success to show for it.
“Less than a year ago we had no structure for the club,” said Colbert Zhu, who formed the CyberDragons and served as the team’s co-captain, alongside captain Michelle Septak. “We didn’t know where we should start, and we had a lot of beginners.”
More than half the team had never done anything like what is expected in cybersecurity defense competitions, Zhu said — none of the system administration or server management that are crucial to the field. By the spring, though, the team had rounded into shape.
“When I was just starting in this field it was super intimidating,” said Zhu, computer science ’19, who gained experience on a co-op at Security Risk Advisors as a penetration tester. “People are throwing words and acronyms out that you don’t understand. Now I have a pretty good idea of how to handle that and I think we learned a lot from our past year about how to shape this club and move forward.”
The eight-member team, which formed last December out of the student group, rounded into shape around February, Zhu said, when individual responsibilities were sorted out and the team had a chance to acclimate to the rigors of competitive cybersecurity defense. After several months focused on learning the basic technologies at play, security took center stage and the Dragons blossomed.
In other competitions, the Dragons played versions of “capture the flag” that featured various information security challenges. For the Collegiate Cyber Defense Competition (CCDC) earlier this month, teams spent the weekend trying to prevent a team of professional hackers from breaking into their networks. The competition isn’t kind to newcomers — the other two first-year teams in the regional took the last two spots — and Drexel’s group faced a frustrating start when an account lockout cost them two hours of action on first day of the contest, but the team managed to place fourth.
At one point in the competition, the Dragons even got a hacker temporarily “arrested” by submitting a form with evidence of his actions, earning a 10-minute break from his attacks. It was a memorable highlight in an otherwise stressful event, Zhu said.
“In this competition, particularly the regional finals, it’s just a constant bombardment and a non-stop cat-and-mouse game,” said Ludwig. “It absolutely positions them for a career in security because you have real-world experience and quite a bit of it.”
The progress from the team’s early stages was remarkable, Ludwig said.
“At the beginning, there was not a whole lot of practical or real experience and not a great deal of classroom experience on the aspects that are important in a CCDC,” he said. “So to see where they started and where they ended up, there’s been an amazing amount of growth in all of them.”
Zhu is already thinking ahead to next year and fielding increased interest from Drexel students eager to join up. The team has plans to reshape its roles and responsibilities, and its members are digesting lessons from their first foray into the world of competitive cybersecurity. For his part, Zhu said he now recognizes the need to stay calm under duress and clearly communicate at times when it would be easy to get flustered. Even before the team makes adjustments, though, advancing through the CCDC made clear that the Dragons aren’t rookies anymore.
“This competition is pretty different from any other, which is awesome because it’s the most applied,” said Zhu. “If you can get through this, you’re definitely in a good position to go into industry.”