Cybersecurity Course in City College’s of Chicago (CCC) Continuing Education Program Provides Platform for Students to Compete in National Cyber League’s Capture the Flag Event

As the pandemic was unfolding, planning for a new program was underway in the spring. One that would have students competing in the National Cyber League’s biannual cybersecurity competition known as a Capture the Flag competition.  By the fall of 2020 a select group of students at CCC came together in a beta course at Wilbur Wright College to prepare for this challenge. The class and competition provided exposure to the demanding field of cybersecurity that they need if they pursue careers in it. As one of the students, Marcin Landowski, said, “it’s intimidating until you do it.” By the end of the course, the students would bond with each other, take their knowledge and skills to a new level, and they would rank in the top 11 percent of the schools at the competition.

For those unfamiliar with the cybersecurity industry, one of the proving grounds for developing and demonstrating industry expertise is the National Cyber League’s biannual cybersecurity competition for high school and college students. It’s described by Infosecurity Magazine as providing “an exciting virtual environment in which students of all levels can apply their cybersecurity skills to real-world scenarios encountered by professionals in the cybersecurity industry.”

This highly competitive event brings together teams made up of more than 10,000 students from over 300 colleges and universities across the U.S. During the course of the event, students are given challenges described by the National Cyber League (NCL) as both “hands-on, realistic, industry skill-based challenges across multiple learning domains and designed to test and build their cyber skills.” Companies scout these events looking for talent and participants who intend to pursue careers in cybersecurity are expected to show their experience along with a portfolio of it on their resumes.

At CCC, technology programs are among its fastest growing programs, Robert Clarke, Continuing Education director, pointed out. The Continuing Education department develops new courses to meet demand, and Pamella Andersen, training operations manager, was aware of the technology industry expectations for hands-on experience. “Students need hands-on experience to get in the door at companies,” Andersen said.  She was keen to provide that hands-on experience to students enrolled in CCC’s cybersecurity program as part of their overall preparation for a career in the field of cybersecurity.

With this goal in mind, Andersen approached Christy Lemmon, an alumna of the CCC Cybersecurity Boot Camp, to develop a course on it. Lemmon was new to course development but eager to take the lead. She first wanted to enhance her own capture-the-flag (CTF) knowledge and skills and so participated in NCL in the spring 2020 season to learn the ins and outs of the competition. Her experience, Lemmon said, convinced her that “it would be an exciting opportunity for our students.” She quickly turned her experience around to create the foundation for the inaugural National Cyber League (NCL) course at CCC.

The response to the announcement of the program was overwhelming. There were 40 students who immediately applied to join the NCL-CTF Skills & Experience course. The students who applied were among a group who had already shown interest and were contacted about their willingness to participate in a new and demanding course that offered so much potential. From those applications, an initial cohort* of 20 was selected, with 19 completing the course. Students like Jalil El, Adrian Aponte, and Leesa Raby were enthusiastic about participating.

Although each student has his or her own reasons for joining the class, there were some common themes that emerged when asked about their interests. “I wanted to learn tools and skills employers are looking for” said El, who has already been participating in hackathons. For Aponte, it was career direction. He said, “the class really helped me figure out what I want to do in cybersecurity.” For Raby, new to the field, it was good experience, and she could learn from professionals.

Patrick Shaughnessy, Alumni Instructor in the Department of Continuing Education – Cybersecurity, was enlisted by Lemmon to act as the course facilitator or coach. Instead of a traditional lecture format, he facilitated a student-led course. The class met once a week on Tuesdays online with an optional online lab on Thursdays for 12 weeks.  Typically, the classes had an industry expert speak and that was followed by a Q & A session.

As the event approached three teams were formed based on the amount of time each student was prepared to invest instead of based on their skill level. Shaughnessy said, that “while it became immediately obvious that the more skilled player might not learn as much technically from the new player, the more experienced person provided a key role as teacher and mentor.” It was an opportunity for the senior player to learn and grow skills such as communicating, teaching, and mentoring. These soft skills are outside of the usual focus on technical skills but are critical to their professional development. Students new to the field contributed fresh eyes, unique thinking, and thought-provoking questions, he said, that helped the more experienced examine why they did things the way they do.

Next the students were tested by NCL and assigned a bronze, silver or gold level based on their abilities. The highest scorer on a team would determine at what level that team would compete.

Although students were meeting online for the class and lab, their shared interests and willingness to commit to the demands of the course created a strong bond among them.

In their first foray into the competition, one of them, Adrian Aponte, tested at the gold level. Aponte was offered the opportunity to join another team with other gold level participants to improve his performance at the competition, but he chose to stay with his team at CCC because of the bond among the classmates that had developed over the course.

The actual competition is 56 grueling hours over one weekend. Typically, the students would meet in person for the duration but because of the pandemic they continued to meet online to work with each other. AS NCL describes it, in the Capture-the-Flag (CTF) competitors participate in a type of computer security game where: players race to solve security-related challenges, often searching for digital “flags” hidden on servers, in encrypted text, or in applications. Challenges within the CTF are open-ended and require expertise and skills in a wide range of security-related topics: computer forensics, cryptography, network penetration testing, web security, system or network administration, more. When a player submits a flag (or correct answer), they receive points for solving the challenge. The player or team with the highest cumulative score at the end of the game wins.

Although this CTF was their first experience as a team, they were determined to do their best. More than one student said they woke in the middle of the night with an answer and couldn’t go back to sleep until they got up and wrote it down. Many students were balancing demands of jobs and families with the demands of the competition. One student, Jalil, was working out the problems on a Greyhound bus on the way to his out-of-state job. Their passion for the cybersecurity field shines through in their commitment despite obstacles they faced.

In the end, the participants left their mark. Overall, CCC ranked in the top 11 percent or 109 out of 957 teams. In the Central region, they ranked 29th overall. Their placement, however, is less important to them than what they learned from their experience. One student, Dennis Estrada, summed it up by saying it was the “power and strength in community” that meant so much to him. He added that he is better prepared to deal with cybersecurity challenges in his job because of his experience.

Many of them intend to come back in the spring. There are two seasons each year. For those who are interested in learning more about the program, see https://bootcamp.ccc.edu/ncl-ctf/.