More than 150 hackers and operators participated in a first-ever International Cybersecurity Exercise on Wednesday, competing simultaneously on the campuses of the University of Pristina, Kosovo and Iowa State University in Ames, Iowa.
Participants came from 17 military, collegiate and high school teams to create 11 teams with names such as “Runtime Terror” and “It’s not a Bug, It’s a Feature” in Kosovo. Six more teams in Iowa had names such as “Hydropump” and “Kuhl Kids.” Alongside these was the Iowa Air National Guard’s 168th Cyberspace Operations Squadron, headquartered in Des Moines, which regularly participates in Iowa State cybersecurity events. The unofficial Air Guard team name adopted for this exercise? “Not Fast, Just Furious.”
According to event organizers, Cyber Defense Competitions (CDC) started in the United States nationwide in the early 2000s, and are based on Cyber Defense Exercises (CDX) first initiated at U.S. military academies. Doug Jacobson, Iowa State professor of electrical and computer engineering, likens the events to games of Capture the Flag, played in virtual sandbox.
“It’s a matter of ‘Kick the hackers out, and keep them out,’” Jacobson said.
The 6- to 8-hour exercises are intended to be stressful, but not cut-throat.
“Although we give trophies and T-shirts at the end, it’s not about winning,” Jacobson said. “It’s a learning model.”
Approximately 30 days before competition, teams are issued a package of potentially vulnerable software tools, along with an exercise scenario. Past storylines have included protecting power grid and distribution systems, health care and governmental data, and financial services companies. Teams are tasked with debugging, updating and hardening the software tools they have been issued — and to monitor and defend those tools throughout the competition.
Adding to competitors’ potential distractions on game day, exercise administrators might also introduce real-world “anomalies” during the event, such as fire drills, casual games and notional press conferences with notional media.
For Master Sgt. Richard Beeson, a former U.S. Air Force intelligence analyst turned cyber-operator, the exercises are opportunities to share knowledge among participants, and to test his skills in a wide range of environments.
“There’s a lot of variety in [the real world],” Beeson said. “Sometimes, you find servers that aren’t secured, or businesses that are running operating systems we don’t often see in the military. Sometimes, they’re lacking patches and updates — maybe the software they’re running is nearing end-of-life and no longer supported.”
Beau Smith is a member of “Team Kuhl Kids,” a group of high school students representing the Waterloo Career Center, and led by coach and cybersecurity instructor Kyle Kuhlers.
“It’s great to get real experience in how to harden a system, put up firewalls and compete against hackers,” Smith said.
He plans to attend Iowa State after graduation, where there are degree programs available in cybersecurity, computer engineering, computer science, Management Information Systems and related fields.
Iowa Air National Guard Lt. Col. Erik “Boss” Howg, commander of the 168th Cyberspace Operations Squadron, says new recruits can likely enlist for training in Information Technology (IT) and support functions before transferring into Air Force Specialty Code (AFSC) 1D7: “Cyber Defense Operations.”
There are Air Guard cyberspace units in at least 13 states, including California, Delaware, Idaho, Iowa, Kansas, Maryland, Michigan, New Jersey, Pennsylvania, Texas, Vermont, Virginia, and Washington.
Iowa State University’s Cyber Defense Competitions started in 2005. The institution’s Center for Cybersecurity Innovation & Outreach (CyIO) now conducts five or six such events annually. The addition of the international event was catalyzed by the Iowa National Guard’s long relationship with the Kosovo Security Force.
RELATED: With cyberattacks on the rise, states turn to National Guard for help
In 2003, Iowa troops first deployed to Kosovo as peacekeepers. The republic declared independence from Serbia in 2008. In 2011, the military Iowa-Kosovo relationship was formally established through the U.S. National Guard’s State Partnership Program (SPP).
In Pristina, Kosovar Minister of Education, Science and Technology Arbërie Nagavci gave the keynote speech for the event, which was shared with the Iowa teams via livestream. Kosovar Minister of Defense Armend Mehaj also provided recorded remarks.
In Ames, Iowa National Guard commander Maj. Gen. Ben Corell and Kosovo Security Force commander Lt. Gen. Bashkim Jashari observed the exercise, and talked with both military and civilian teams.
For more information about ISU’s cyber defense competitions, visit the university website.
