CyberPatriot

1. This briefing will describe an exciting new initiative by the Air Force Association (AFA) to inspire today’s youth to become the cyber defenders of tomorrow … CyberPatriot Concept Demonstration: National High School Cyber Defense Competition Orlando, FL, 26-27 February 2009 The proof of concept in Orlando demonstrated a viable formula to build a national competition that will excite high school students, instill cyber security awareness, and create career interest. CyberPatriot II will take the concept nationwide.

2. Why is a High School Cyber Defense Competition Needed? Call 2008 the year that cyberspace — its vulnerability, its defense, and its exploitation —passed the point of no return as a major issue for national security officials. • Rebecca Grant, Director, Mitchell Institute The United States is the most vulnerable nation on the face of the Earth to cyber attack for a simple reason — we are the most dependent. • Michael McConnell, Director of National Intelligence • The success of many business enterprises will depend on the degree to which the available pool of workers possesses the right combination of science, technology, and engineering skills. • Bill Gates, Congressional Testimony The rationale for this initiative is simple: cyber defense is one of our nation’s most important national security concerns and the critical factor in building the defense is not technology — it is talented PEOPLE, educated and motivated to serve.

3. A Convergence of Interests This environment produced a remarkable convergence of interests … • The Air Force needs the cyber warriors who can secure the domain as the indispensible prerequisite for air and space dominance • The nation, especially American industry, needs secure networks to compete and security providers reasonably expect an expanding, lucrative market • The linchpin of future network security is education of enough U.S. professionals to meet the expanding requirement—the source of that educated workforce must be students motivated to pursue a career in information assurance and computer security • The Air Force Association: Educates the public, Advocates for and Supports the USAF, the Air Force family and aerospace education Aerospace is Air, Space, and Cyberspace!

4. Founding Partners Common interests created a team of capable and committed partners … Center for Infrastructure Assurance & Security (CIAS) Academic perspective; Network security education; Collegiate competition; Director’s AF relationship (USAFR Colonel) Science Applications International Corporation (SAIC) Diverse industrial perspective (customer & supplier); Proven Cyber Defense Trainer (TeamDefend); Corporate commitment Air Force Junior ROTC (AFJROTC)/Civil Air Patrol (CAP) High School perspective; Local groups with national breadth; Accepted by HS administration; “Built-in” commitment to citizenship/service Air Force Association (AFA) Nonprofit perspective; Relationships with all of the above; Field organization with national breadth; Education mission & national security interest

5. What is CyberPatriot? CyberPatriot is for the students, but also for our nation CyberPatriot is a cyber defense competition that tests the ability of the students to defend a simulated corporate network from external hostile attacks. CyberPatriot is more than just a competition – it will help educate and motivate the next generation of students to become the cyber defenders the nation needs. Three Phases: Concept Demo. Proves: Viable premise ─ excites & educates National Deployment. To prove: Scalability, academic ─competition integration, management scope & process Institutionalize. Full integration with academia, government & industry; self-sustaining path from 9th grade to career.

6. What is CyberPatriot? Phase I was a “Home Run!” • Phase I, Proof of Concept Demo (26-27 February 2009): • Online education/preparation • Eight 5-person teams (AFJROTC & CAP) • SAIC’s TeamDefend Cyber Defense Trainer • Competed at AFA’s Air Warfare Symposium • Winner to National Collegiate CDC at UTSA, TX

7. simulates the hostile Internet environment and attempts to gain unauthorized access to the Blue systems or to disrupt their service. The Competition Environment The Blue Team attempts to ensure the smooth operation of all competition equipment. The Red Team Scorebot is the scoring engine that awards points to the team for successfully patching vulnerable systems and for effectively addressing attacks on their network.

8. Day 1 Winner: Team Spaatz, Osceola HS We were sure this was a winning formula when the first day winner was announced! The Flow of the Competition • Thursday • Morning: Teams 1 & 2 competed • Afternoon: Teams 3 & 4 competed • Evening: The winning team from Thursday was announced • Friday • Morning: Teams 5 & 6 competed • Afternoon: Teams 7 & 8 competed • Evening: The winning team from Friday was announced • Awards Ceremony: The overall winning team – the National Champion – was announced

9. The Venue The Symposium was an ideal venue to showcase the competition and enrich the experience for the competitors AFA’s 25th Annual Air Warfare Symposium 9

10. Distinguished Visitors to CP I • Visitors to CyberPatriot I Included: • Gen Norton Schwartz, CSAF • Gen Kevin Chilton, CDR USSTRATCOM • Gen Stephen Lorenz, AETC/CC • Gen Donald Hoffman, AFMC/CC • Mr. Charles Beard, SAIC CIO • Lt Gen Ted Bowlds, ESC/CC • Maj Gen William Lord, AFCYBER (P) • Brig Gen Teresa Djuric, Holm Center/CC 10

11. Competitors were engaged & “All In” And Excited!!! 11

12. CyberPatriot I ― Day 2 Winner Team Wilson Civil Air Patrol Florida Composite Wing 12

13. CyberPatriot I ― Champion Team Spaatz AFJROTC FL-921 Osceola H.S. 13

14. Feedback from the Competition Participants and advisors were asked to provide feedback after they finished competing. Some highlights (based on a scale of 1 to 5, Strongly Disagree to Strongly Agree): Advisors (8): My team enjoyed the competition: 4.75 We would like to participate again: 4.75 As a result of this competition, my students learned more about securing a network: 4.75 Participants (37): I enjoyed the competition: 4.78 I would like to participate again: 4.78 As a result of the competition, I learned more about securing a network: 4.78 54% of the students stated that they are more likely to attend college as a result of this competition 14

15. What is the Future of CyberPatriot? The Vision for the competition is to grow to the point that any high school in the nation that desires to field a team will be able to participate in the program. This will require a multi-tiered competition leading to the national championship event: • Phase II, National Deployment (2009-10 School Year): National AFJROTC/CAP competition; Enhanced academics; Prelim. rounds select regional competitors; 18-19 Feb 2010 Orlando Finals; Champion to April 2010 NCCDC • Phase III, Grow to the Need (2010-11 on): Expand to non-JROTC/CAP; Integrate with NCCDC & Institutionalize

16. Future:Integration with the NCCDC Future “CyberPatriots” will not simply go to the NCCDC as a first prize …. We’ll see a generation of NCCDC winners who went to college and studied CompSci because they were “CyberPatriots”

17. CyberPatriot II Structure(dates approximate except Finals) • Apr-Jun 09: Publicity and competitor identification and unit registration: Goal: 50-300 units • Jun-Aug 09: Instructor/Advisor (Team Coach) Preparation: Information push, feedback/questions through assigned AFA Area Participant Coordinator (APC) to “community of interest,” modest time required, student preparation permitted ─ not required. Goal: ready to go on school day one. • Sep-mid Oct 09: Basic academics/competition preparation, primary/alternate team members selected – all can participate. Goal: ready for Round 1. • Late Oct: Round 1: DVD “Image” of virtual windows network downloaded on any computer, six-hour, Saturday exercise to diagnose. Log into the scoring host at SAIC. Goal: 30 teams graduate to “medalist flight;” all others in “consolation flight” competition. Feedback through “task solution” presentation.

18. CyberPatriot II Structure(dates approximate except Finals) • Mid-Nov 09: Consolation Flight competition: intervening tailored preparation. DVD six-hour exercise similar to round one; 1st, 2nd, 3rd place awarded. Goal: all receive feedback and are encouraged to follow medalist competition. • Early/mid-Dec 09: Medalist Flight competition: Tailored preparation for more complex virtual network image (Windows + UNIX). Six-hour exercise similar to round one. Goal: eight finalists identified; all receive feedback and are encouraged to follow competition. • Jan 10: Prep. for finals. Goal: Finalists at peak of their game. • 18-19 Feb 10: Orlando CyberPatriot II Finals in conjunction with AFA’s 26th Air Warfare Symposium. Goal: competitors demonstrate learning, capability, and HAVE FUN! • Apr 10: CyberPatriot II Champions travel to San Antonio, TX, for NCCDC and participate as White/Red Team members.

19. CyberPatriot II Structure(timeline) CyberPatriot II Finals Medalist Flight Competition Finalists (8) Medalist Flight (30) Sign-Up CP II (n = 50-300+) Instructor/Advisor Prepare Academics Student Prep. (22) Champion to NCCDC Consolation Flight (n - 30) 1st, 2nd, 3rd Place Awards All follow competition 19

20. CyberPatriot II Structure(considerations) • Team Coach need not be “computer whiz” (students are already smarter about this stuff). Coach must be committed to some additional effort and communication. • Competitors (students) must be in an accredited high school program in grades 9-12 (recognized home schoolers OK). • No additional computer/network equipment is required (some permissions from school SysAdmin for Internet connection may be necessary). • Entire class may prepare and learn, but Coach must choose competitors (five maximum). • No additional cost beyond incidentals for personal items for those eight teams that travel to the finals (traveling teams will be limited to: five competitors (students), one Coach, and one gender chaperone).

21. SIGN UP NOW!!! • Online registration is now open! Prospective Coaches only (JROTC SASI/ASI or CAP COs) should sign up now, but no later than 29 May 2009. Please provide your contact information, including an e-mail and phone number for contact throughout the summer. • There is no obligation in registering. You will be asked to make a firm commitment only after you have reviewed additional informational materials and a more detailed description of participant expectations. • After registering at: https://registration.afa.org/reg/reg1.aspx?event=cyber2010&regtype=RequestInfo you may expect additional information within two weeks. 21

22. 18-19 February 2010 Orlando, FL CyberPatriot II BE THERE! II