Cal Poly Pomona's cybersecurity team repeated last year's win to again take first place at the 2022-23 Collegiate Penetration Testing Competition (CPTC).
After beating nine colleges to win the regionals, CPP's Cybersecurity team took on 15 finalists to win the final competition. Now in its eighth year, the CPTC asks student teams to hack into the business network of a fictitious company and report on their vulnerabilities. This year's industry sector was hotel and hospitality.
The team is made up of computer information systems (CIS) students from the College of Business and computer science (CS) students from the College of Science. This year's team members are team captain Justin R. Covairt, Dylan T. Tran, Taylor S. Nguyen, Derrick T. Tran, from CIS, and co-captain Gabriel Fok and Jasmine Weddle from CS.
When you talk with these students their excitement about cybersecurity is palpable. "If you didn't love it, a competition like this would be very arduous," Jasmine Weddle said. Weddle, a computer science major, is the first woman to land a spot on the team. "The guys have been great, but I do feel a little more pressure being the first," she said.
Weddle is the business and compliance lead. She's concerned with how their technical work impacts the business, and its legal ramifications. Her fellow CS major Gabriel Fok is the co-captain, business lead and Linux/web specialist.
If there was one word to describe what makes this CPP team so outstanding it would be "preparation." The selection of team members starts with an eight-week bootcamp that's designed and led by fellow students who've already competed in the CPTC. The bootcamp culminates in a mock penetration testing engagement. Top performers are asked to join the team.
"Once the team was finalized we met every week up to the competition to work on our techniques and strategies," Fok said. "All of the free time you have, you're thinking about it. We talk over dinner, and share ideas," Weddle said. "None of us is here for a resume bullet point, or out of obligation; we're here because we find it really interesting and we're passionate about it," she added.
One of the secrets to their success is the template they use for creating their report. Weddle refers to it as their "secret sauce" which she describes as a work of art. To prepare for the final competition, some team members did practice labs on sites like HackTheBox while others conducted research.
The regional competition consisted of 8 hours of searching for vulnerabilities. During that time, the team was subjected to injects, which are fictitious employees of the business, making requests or asking for status updates. Then the teams had another seven hours, until midnight, to write and submit their report. Weddle said, "It's grueling concentrating for that long. There's a lot of pressure, but it's great experience because it prepares you for work."
According to faculty advisor Ron Pike, at regionals, CPP submitted a 104-page report that organizers say set a new bar for professionalism. "We have strong academics that provide the fundamentals and our students have benefited from exposure to industry professionals. Most importantly though, we have great students who are very dedicated to learning and supporting one another."
Pike has been coaching cyber competitions since he joined CPP in 2012 and started coaching the CPTC team in 2015. "Dr. Pike was great. He drove us everywhere and made sure we got where we needed to be," Weddle said.
Pike wants people to know that CS and CIS students also won first place in the Fall 2022 Hivestorm competition out of UTSA this fall. The winning team competed against 411 teams and was led by a freshman from CS. CPP had 23 teams in the competition and three of the teams were in the top 10.
The final CPTC competition took place over a 40-hour time period, January 13-15, 2023 in New York at the Rochester Institute of Technology.
After winning back-to-back CPTC titles, Fok said, "Now no one can call us a fluke. Everyone stepped it up this year- the other teams included. I think that just goes to show how talented and dedicated this roster is. It made the hundreds of hours of preparation worth it. My team is truly special, and they truly deserve this win. I'm honored and humbled to experience this win with them. I'm excited to see what happens next year."