A team of five Knights – computer science undergraduates Matthew McKeever and Harrison Keating, digital forensics master’s students Caitlin Cameron and Cameron Whitehead, and cyber security and privacy master’s student Jeffrey DiVincent – placed second at the Raymond James Capture the Flag competition, bringing home a $5,000 cash prize.
A total of 12 schools participated in the invitation-only annual contest, held at Raymond James headquarters in St. Petersburg. Purdue University took first place honors and John Hopkins University placed third.
“Our team performed well in both the traditional CTF challenges involving binary exploitation and web application exploits, as well as the non-traditional physical security involving lock picking and Lego model building challenges,” says CS3 team coach Tom Nedorost.
Unlike a red team versus blue team competition, in which competitors are either defending or infiltrating a system, a capture the flag or CTF competition offers various challenges to solve, all of which are assigned a point value. The contest is set up similar to Jeopardy, where students answer questions for points, choosing from categories such as binary exploitation, cryptography, steganography, reverse engineering and digital forensics with a corresponding point value. The higher point values are assigned to the more difficult challenges.
The ”flag” is a digital string of text in the data that is being presented. If a team is successful, entering the flag onto the scoreboard wins points for a particular challenge.
Nedorost says different skill sets are required for CTF competitions, but upcoming cybersecurity professionals must be accomplished in red versus blue team competitions as well.
“CTF challenges rely on understanding how computers work at the very basic bits and bytes level and typically require strong mathematical reasoning skills,” he says. “Blue teams typically require strong networking administration and operating system administration skills. Red teams also need to know the networking and operating system skills, and have intimate knowledge of how networks and operating systems work at the bits and bytes level.”
The C3 team will next compete at the Southeast Regional for the Collegiate Penetration Testing Competition in Augusta, Georgia, on Oct. 14.