Building the Workforce through Cybersecurity Competitions

The National Science and Technology Council report, A 21st Century Science, Technology, and Innovation Enterprise for America’s National Security, notes that maintaining “a diverse and robust STEM education pipeline, including providing robust STEM opportunities for the children of military families at home and abroad, is critical for the U.S. national security ST&I workforce.” The challenges faced by all STEM disciplines are amplified in the cybersecurity discipline by the urgency of cybersecurity challenges. Enhancing the cybersecurity of the nation, as envisioned in the President’s Cybersecurity National Action Plan, will require a robust and highly skilled national cybersecurity workforce. Federal efforts to meet this need began with the 2010 establishment of the National Initiative for Cybersecurity Education, and continue with the recent Federal Cybersecurity Workforce Strategy. Competitions complement these efforts by increasing awareness of potential cybersecurity professionals and providing opportunities for experiential learning at all skill levels.

This morning, OSTP hosted a Cybersecurity Competitions Workshop, with participation from volunteers, organizers, and sponsors from three national cybersecurity competitions: CyberPatriot, the Collegiate Cyber Defense Competition (CCDC), and U.S. Cyber Challenge (USCC). Each of the three participating competitions serves a different community and has a unique approach to meeting the Nation’s workforce needs. The Air Force Association’s CyberPatriot program serves youth programs, high schools, middle schools, and accredited home school programs. More than 3,300 teams participated in CyberPatriot VIII’s online challenges, including schools from all 50 states, Canada, and Department of Defense Dependent Schools. In the CCDC, which recently completed its eleventh year, teams from more than 200 schools, including two year, four year, and research institutions, protect a network infrastructure from the competition’s volunteer “red team.” The Center for Internet Security’s U.S. Cyber Challenge is open to all and includes online challenges for individuals and invitational summer camps, where individuals receive classroom instruction and join teams to demonstrate their skills by playing a cyber version of capture-the-flag, and continues year round engagement through the CyberCompEx.org portal.  This portal is open to everyone interested in cyber competitions.

Increasing diversity has been a major challenge in expanding the cybersecurity talent pool. Given the Nation’s cybersecurity workforce needs, we cannot afford to miss out on any dimension of the talent pool. Competitions give students from all geographic locations and walks of life opportunities for awareness about cybersecurity as a vocation and an introduction to the subject matter. Competitions have traditionally been male dominated, but participation trends are promising. CyberPatriot has raised female participation rates from 6% to 23%, and women composed fully half of Brigham Young University’s 2016 NCCDC team. Competitions also support cross-sector flow, another key challenge highlighted in A 21st Century Science, Technology, and Innovation Enterprise for America’s National Security. Cybersecurity competitors at the event included people making career changes, attending college after completing military service, and entering the cybersecurity sector after time in the civilian workforce.

Volunteers and sponsors also play a special and essential role in all of these competitions: coaches and technical mentors support CyberPatriot teams; cybersecurity professionals volunteer to staff the red teams at CCDC events, and serve as mentor for teams at the U.S. Challenge summer camps. Alex Levinson, an Information Security specialist at Uber, was a featured speaker at today’s event. Alex is a past competitor, representing Rochester Institute of Technology in the NCCDC in 2011, and attended one of the 2010 U.S. Cyber Challenge summer camps. Alex continues to give back, volunteering on the CCDC red teams and mentoring at U.S. Cyber Challenge summer camps. Ed Rhyne, Program Manager at Homeland Security Advanced Research Projects Agency (HSARPA) at DHS S&T, shared the benefits that DHS has derived from supporting the development of the CCDC and USCC, including testbeds for experimenting with emerging cyber-defense technologies.

Among the many compelling stories, University of Central Florida’s third straight national championship is one to celebrate. UCF’s cyber-defense team included just two returning members from the 2015 championship, but UCF has created a vibrant cybersecurity community around their team. Over 200 UCF students have joined Hack@UCF, promoting awareness and exposing far more students to the possibilities of a cybersecurity vocation than can be supported by the team alone. Hack@UCF holds workshops and tutorials about vulnerabilities, training the next generation of cyber-defense team members. This may be the greatest secret about cybersecurity competitions—they are a force multiplier. Most schools that have a team also have a cybersecurity club, which means students that aren’t interested in competing are still exposed to opportunities to learn and practice.

Is there a place for you in cybersecurity competitions? If you are a student, or want to enter a new workforce sector, consider becoming a competitor— you may find a new career! If you are a teacher at a school that doesn't participate today, consider starting a cybersecurity team or club‎ and opening some minds to new horizons. If you are a professional in the field, how about volunteering to mentor one of those new teams? And last, but not least, practically every organization needs cybersecurity professionals these days. Consider providing resources to support one of the many worthy competitions; your organization’s future hires will be more skillful as a result.

Tim Polk is Assistant Director for Cybersecurity at the White House Office of Science and Technology Policy