Student Competitions

U Buffalo Students Take Top Spot in Cyber Penetration Testing Contest

• By Dian Schaffhauser
• 11/13/15

A team of cybersecurity students from the University of Buffalo took first place in a competition that offered a new approach to testing their skills. The first "Inter-Collegiate Penetration Testing Competition," hosted at Rochester Institute of Technology last weekend, pushed students to model a real-life penetration test as closely as possible in a competition environment.

The idea of penetration testing is to try to break into a network or other system in order to understand the nature and depth of its vulnerabilities and what those openings put at risk. While the test is supposed to do no harm, it does require the testers to document weaknesses and provide a mitigation plan. Also, the testing is a cooperative venture; participants share information to some extent.

For the recent competition each participating team of three to six students received a request for proposal document in advance of the contest detailing what the "target company" was interested in having done. They were expected to develop and submit a written proposal in response to the RFP before the actual event. On the first day of the event, which ran November 7 and 8, each team had a short meeting with the "management" of the target company to review the proposal and sign a contract. Later that same day, they began performing their penetration testing. At the start of day two they were expected to deliver a final report and presentation materials.

Teams from nine area institutions faced off to break into computer networks, document the weaknesses and offer plans for improving the security. While U Buffalo took home the top trophy, Rochester placed second and Syracuse University came in third.

A panel of judges, which included representatives from sponsors Vectra Networks, Logical Operations and IBM, as well as faculty and professional penetration testers, saluted the winners for their "exemplary positive professional attitudes," excellence in organization and communication skills, both verbal and written.

"I like being a part of cybersecurity competitions because it gives me a chance to test my skills and have fun," said Nick Piazza, a fourth-year computing security major and captain of the Rochester team. "When I approach a network to penetration test, I see it as a puzzle or a maze with many different ways to tackle it."

Bill Stackpole, associate professor of computing security at Rochester and director of the competition, insisted that the competition will take place again next year. "Along with the advisory board, sponsors and teams, we look forward to building the next generation of security professionals so they can meet and exceed the challenges of the future," he said in a press release.