Online Cyber Contest Challenges Students

College students from across the country will soon go head-to-head in a unique cybersecurity competition that challenges them to not only hack into a competitor’s system, but also build a computing platform that can fend off attacks.

The Build It, Break It, Fix It competition - led by faculty and graduate students in the Maryland Cybersecurity Center (MC2) and supported by top cybersecurity organizations - aims to teach students the latest skills in writing, implementing and de-bugging software programs.

“Normal security competitions are just about finding vulnerabilities, bugs or problems in things,” says Michael Hicks, a professor of computer science and member of MC2 who conceived the competition. “Our contest is different in that it brings together both ideas - the building and the breaking side - which can ultimately improve a student’s cybersecurity skills across-the-board.”

The online contest is broken up into three rounds beginning Aug. 28, 2014, with subsequent rounds taking place Sept. 4 and Sept. 12. It is open to undergraduate or graduate students enrolled at any accredited university in the United States.

Hicks, who also has an appointment in the university’s Institute for Advanced Computer Studies (UMIACS), says that more than 150 students have already signed up.

During the Build It round, builders write software for a system specified by contest organizers. In the Break It round, breakers (hackers) find flaws in the programs submitted by other teams. During the Fix It round, the builders attempt to patch any vulnerabilities in their software that was hacked by the breaker teams.

Student teams can compete in either the Build It or Break It category—or they can choose to enter in both.

Participants are judged by a panel of cybersecurity experts who will give two independent ratings: a builder score and a breaker score. These ratings are based on objective measures, e.g., breakers finding more flaws will get more points, while builders whose systems exhibit poor performance or vulnerability to many flaws will be awarded fewer points.

"Normal security competitions are just about finding vulnerabilities, bugs or problems in things..."

Michael Hicks

The highest overall score in each category will take the first-place prize of $4,000, with the runner-up teams getting $2,500.

Contest sponsors include AT&T, Cyberpoint, Trail of Bits, Cigital, Patriot and the National Science Foundation.

In an online blog, Dan Guido, CEO of Trail of Bits, a New York-based information security startup and Gold Level sponsor for the competition, wrote: “ … There are a wealth of opportunities for students to learn to break software, however, there are relatively few that challenge them to build it right …”

Jared Piedt, a rising junior at the University of South Carolina, is competing as both a breaker and a builder. As a computer information systems major, he says he is always looking for ways to improve his skills.

“The contest looked like a fun learning opportunity and a chance to gain some valuable cybersecurity experience,” Piedt says.

- Story by Melissa Brachfeld