In April 2019, the Air Force Association’s 11th annual CyberPatriot National Youth Education Program crowned its champions from a whopping 6,387 teams (5,144 high school and 1,243 middle school teams). CyberPatriot students are put through a series of grueling rounds where they have to identify vulnerabilities in virtual computer operating systems. The competition was more intense than ever having added nearly a thousand new student teams since the previous year’s competition.
We took a look at the past 8 years of CyberPatriot competitions to analyze who the standout groups have been and to see if we could glean any interesting information for teams planning to compete next year. What we found was unprecedented!
For the second year in a row, California high schools dominated the top divisions taking 5 out of 6 awards. In both the 2019 and 2018 competitions, California High Schools took all but one of the top awards across the two divisions, demonstrating their complete control of the CyberPatriot field.
However, it wasn’t always like this. Although California schools have made it to the podium in earlier years, they were not always as imposing of a presence on the leader board. California has only recently staked its claim as the sole dominating state. We can see this in more detail using the Institute of Competition Sciences’ Award Points System. ICS assigns 1000 points to 1st place awards, 750 to 2nd, and 500 to 3rd placements. The table below lays out the whole landscape of CyberPatriot awards over the past eight years.
Fourteen states have had high schools make it onto the CyberPatriot podium. Thirteen of these states are all within a thousand points of the next rank up or down. This means that with just one award in a future competition, they could move up (or down) the ranks. However, California’s imposing dominance is impossible to ignore sitting far atop the CyberPatriot state rankings. 10,000 points separates California from the 2nd ranked state (Colorado) while no other states have more than a 1,000 point difference between their place and the next place up or down in the ranking.
What does this mean outside of the glaring fact that California has become a CyberPatriot beast? For one, it would take the 2nd place state (CO) at least 3 years to un-seat California teams. And that is if Colorado teams won every award for the next 3 years and CA teams took none. This is great to know for people with a lot of state pride, but it doesn’t tell us much about what has happened at the individual school level, and that’s where the interesting information lies for those who are looking at upsetting the leaderboard in next year’s competition.
School Level Dominance
When we break things down to the school level, we get a more clear and informative picture of how the state level rankings come to be what they are over the years. The table below includes all of the high schools that have scored over 1000 ICS points (i.e. a 1st place award, two 3rd place awards, or other higher combinations) in their CyberPatriot competitions between 2012 and 2019.
Here we can see a more granular picture of dominance not just from a particular state, but from particular schools. One of the most interesting things about this picture is that the dominant school has changed over the years. Troy High School, which has been the dominant school over the past 4 years, was no where to be seen on the CyberPatriot podium the four years before that. Whereas, North Hollywood’s podium performances have been spread out from 2014 to 2016, and Montachusett was a regular presence on the podium in the early years.
Four Year Averages
One final way we wanted to explore CyberPatriot dominance is to look at four-year averages for the top teams. Given the fact that students come in and out on four-year cycles in high school, it is logical to think that a team’s performance could change significantly due to an exceptional student coming in or leaving on a similar time scale. Taking a look at the four year average helps us see if this is the case for a school, or if they have dominance lasting more than the 4 years.
The averages also help demonstrate dominance that is due to more than just a few 1-year blips on the podium. The chart below graphs the four-year ICS award point averages for the top 5 teams across the history of the CyberPatriot competitions – the only teams that have received 3 or more awards over the years.
From this information we can gain some great insights about how CyberPatriot teams have dominated in the past, and what that might mean for the future. Here are our top 5 schools in our 2019 CyberPatriot Power Ranking:
Honorable Mention: 2019 was a year for underdogs!
Even though some familiar names remained dominant in 2019, there were strong signs from three upstart high schools that the dynasties may be in jeopardy in the near future. Del Norte High School, Scripps Ranch High School, and Roosevelt High School all showed up on the podium for the first time in 2019 (with Scripps taking one of two 1st place awards out of the hands of our top dynasties). Does this mean one of these underdogs might be ready to start a multi-year run of their own? We'll see when the 2020 season gets rolling!
#5 Montachusett reigned early, but has fallen in recent years.
Between 2012 and 2015, Montachusett Regional Vocational Technical School was a dominating presence on the CyberPatriot scene reaching the podium in 3 of the 4 years in which they picked up two 2nd place and one 1st place finishes. However, from 2016 to 2019, they only reached the podium once with a 3rd place finish in the 2017 competition. With our knowledge of how performance can follow 4 year cycles, is Montachusett ready for a resurgence in the next couple years?
#4 Summit Technology Academy.
It's been 3 years since this school made the CyberPatriot podium; however, in the 3 years before that Summit Technology Academy was a powerhouse! They are just one of 5 schools to have a 3 or more year run on the podium taking 3rd place in 2014 and 2015 and gaining the #1 spot in 2016! While this school hasn't been on the podium since, they remain one of the powerful teams to watch for the future.
#3 Colorado Springs Cadet Squadron may have resurgence power.
In any normal year of the CyberPatriot competition, Colorado Springs Cadet Squadron would be spoken of as a top “team to beat.” From 2016 to 2018, they didn’t miss getting on the podium, taking down one of the two top spots in 2017. Their performance was only overshadowed by the dominating performances of our #2 and #1 ranked schools. If we looked at just an individual division of CyberPatriot, Colorado Springs Cadet Squadron would be right in the hunt for the top rank because all of their awards came from just one division. So even though they didn't make it in 2019, we cannot count them out for a resurgence on the podium in the coming competitions!
#2 North Hollywood High School has had the most staying power.
Over the course of CyberPatriot’s last eight years no team has had as much staying power as North Hollywood High School. They did not place in 2016 but have reached the podium every other year from 2014 to 2019. A feat no other school has managed! What’s even more impressive, is that unlike Troy High School, North Hollywood had to earn all of their awards in just one division – not having any “All Service” category teams. So, on a per-division basis, North Hollywood may be considered the most dominant team. Like Troy, their peak performance was also in 2018. Will their staying power continue in future competitions?
#1 Troy High School’s dominance is unprecedented!
The sheer amount of placements that Troy High School has earned the past two years has put them literally in a league of their own. Never before in the history of CyberPatriot has a single team achieved such a dominating performance over other teams. What makes this even more powerful is that it has lasted multiple years. However, their peak performance was in 2018 taking home two 1st place and one 2nd place awards. In 2019, they fell slightly picking up a 1st place and 2nd place award. Does this mean that Troy’s dominance is on the wane?
Each year CyberPatriot provides a thrilling competition to see which teams of high school students are poised to be the future cyber-guardians we need. The competition is never dull. Looking at the past performances is a great way to explore which teams have historically risen to the top, but it does not predict who will take the championship next year. Any number of the 6,000+ teams could step up to the podium in the 2020 competition. It’s going to be an exciting season to see if the dominant CyberPatriot dynasties can continue, or if an underdog can shake up the leaderboard next year! Will your school be in the hunt?
Follow CyberPatriot on your free ICS Account.
Visit the Cyberpatriot website to register to compete.
Back in 1983, the film War Games introduced the world to a new hero. He wasn’t big and strong. He wasn’t fast or athletic; not even a little bit. He probably couldn’t have thrown a football if his life depended on it or made contact with a fastball.
He did not look like the traditional hero in any way.
The character played by a young Matthew Broderick was most certainly a hero. If he was not able to figure out how to defeat "Joshua," the super-computer, nuclear war would have destroyed the world. But since he knew what to do when Joshua asked, “Shall we play a game?” the world lived on.
A War of Secrecy
Computers have come a long way since War Games was filmed, as has their potential for good and unfortunately, evil. People may not need to be as concerned about rogue networks launching nuclear missiles anymore. But the possibility of fiery death raining down from the sky is only one of the many problems people could face.
One that every American is aware of today is the 2016 Russian cyber-attacks on the electoral system prior to the 2016 Presidential election. The world will probably never know the full extent of the attacks, but according to one Bloomberg report, they were enough for then-President Obama to personally call Moscow to voice his concerns and pose sanctions on Russia.
The same report claims that election systems in 39 states were affected in some form by the Russian intrusions. Russian officials, of course, deny any involvement but have conceded the possibility a criminal element in Russia could have been involved without the government’s knowledge.
Cyber-attacks and incidents are becoming more and more common.
- May 2017: approximately 45,000 computers in 99 countries were attacked by ransomware. The ‘weapon’ is believed to have been part of a cache of cyber-weapons stolen from the NSA.
- June 2017: a ransomware-attack crippled thousands of computers across the Ukraine. ATMs to stop working, radiation monitors at the nuclear plant in Chernobyl failed, etc. At least 2000 organizations were affected as well as some international businesses.
- July 2017: hackers attempted to hack the business and administration systems of several nuclear facilities but failed.
These computer attacks have disrupted normal business operations to the point where some companies lost hundreds of thousands of dollars and have disrupted the lives of millions of people. It seems like every other month there is a new announcement of a company’s data being breached where we’re all asked to change our passwords again.
“Cyber criminals are becoming more industrialized and more organized,” Derk Fischer, a partner with PwC in Germany who deals in the delivery of cyber security assessment and consulting services, said in a statement (h/t Fox News). “What we’re seeing is the emergence of a new kind of ‘industry sector’ that thrives on the complex connectivity that characterizes the Internet.”
The global cost of cybercrime in 2015 was an estimated $500 billion. According to one study that questioned 383 organizations, the average cost of a cyber-attack was $4 million worldwide and $7 million in the United States. Costs are highest when the healthcare industry is involved (security-intellience.com).
And it’s only going to get worse!
According to current estimates, someone is made a victim of cybercrime every 18 seconds. There are 1.5 million victims a day and 556 million a year (go-gulf.com). Each year there are an average of 27 trillion malicious attacks.
The global cost of cybercrime is expected to reach $2 trillion by 2019 (securityintellience.com).
The global market for cyber security generated $63.7 billion in 2011. Six years later that number is up to $120.1 billion—and it is only expected to get higher.
A new Generation of Cyber-Cops
To stop these attacks, the world is going to need the best and brightest computer hackers and programmers in the world to help fight the good fight. It may not be glamorous or as sexy as being a secret agent—but the need is apparent and growing. It may not involve pulling the damsel in distress out of the fire, but it is heroic nonetheless. Rather than pull her out of the ‘fire,' you can keep it from happening in the first place.
Think of the impact you can make on just a single identity theft victim. Now imagine stopping an attack that had the potential to affect millions. What sort of impact would that make? The good thing is an ever increasing number of students are getting engaged in the fight as more and more programs are being created to help students understand cyber-security.
In today’s education system, Cyber-Security, is not typically on the roster of courses. However, for the passionate students across the country who are taking on this monumental task, the benefits are immense! Careers in the Cyber-Security space are one of the highest paying and highest in demand jobs in the technology industries!
To be the kind of person who can solve cyber-crime, requires an extraordinary amount of technical knowledge and know-how. These students don’t just learn it by listening to lectures in the classroom, they’re the ones jumping head-first into leading Cyber-Security Challenges. ICS has researched a slew of cyber-security competitions. Here we review a few that are helping build a new generation of “white-hat” security heroes to save us from the next big attack. And these academic competitions aren’t limited to students already involved, you too can try your hand— and your skills – at any or all of these great competitions!
The Cyber 9/12 Student Challenge
The Cyber 9/12 Challenge is not a straight-up hacking or coding challenge but tries to get students to see the bigger picture. Can they understand the technical issues going on and then analyze how they impact national security, international relations, and security studies?
Can you understand what is happening when a cyber-attack occurs and craft the necessary public policy to address it?
Students are tasked with responding to a cyber-attack, but they are also challenged with understanding how policy can change and evolve in relation to a crisis. As part of the competition, they will have to recommend policy changes, present them, and be able to justify them. As the attack evolves, they will need to be able to modify their recommendations as necessary and be able to explain why.
An important aspect of the challenge will be explaining the roles played by the government, military, law enforcement, private companies, and civilians.
This competition will not test your hacking skills, but it will give you a chance to apply them in a theoretical sense and understand the larger impact. It’s not a competition for the next CTU analysts on the front lines, but for the computer savvy future senator.
US Cyber Challenge
The Center for Internet Security runs the U.S. Cyber Challenge and does not mince words when it comes to the purpose of the competition. The cyber workforce is in need of talented individuals. What better way can there be to identify the right kind of people than to host a competition for them?
High school and college students that think they have what it takes can compete in a ‘Cyber Quest’ online. Those with the highest scores are invited out to a special week-long camp. As part of the camp experience, they will undergo specialized training by industry professionals, take part in workshops, a job fair, and a ‘Capture the Flag’ competition.
The camp experience wraps up with an awards ceremony that is often attended by cyber security industry pros and government officials.
If you would rather be on the frontlines of the cyber-war than the guy devising a policy to combat cyber-crime, this is the competition for you. Not only do you get to test your skills against the best the country has to offer, but Mom and Dad will love it because you could get a job when the contest is over!
The Cyber 9/12 Challenge identifies future cyber-policy makers. The U.S. Cyber Challenge identifies the next internet soldiers ready to join the battle against cyber-related crimes. CyberPatriot, the National Youth Cyber Education Program, takes it a step further. Its goal is not only to identify those with the right aptitude but to encourage kids to pursue careers in cybersecurity.
Created by the Air Force Association, CyberPatriot has aspects for children of all ages. Kids are introduced to the principles of cyber security and its importance through the Elementary School Cyber Education Program. The AFA began hosting CyberCamps in 2014. Last year they hosted 75 of them across the country.
Like the U.S. Cyber Challenge, CyberPatriot wants to test the skills of tomorrow’s IT professionals and does so with the National Youth Cyber Defense Competition. The competition is open to kids in middle school or high school in the United States. In each round of the competition, teams are given images of an operating system and are tasked with finding the security issues and hardening the system while not losing critical services.
CyberPatriot is a little different in that it wants to teach you before testing you. But in the end, it wants to know the same thing as the rest—who has the skills needed to get the job done?
The future is yours
Picking a career path is a daunting task at any age. What interests you now may not in a year—or five years. What better way can there be to find out if cyber security is a path you want to get started on then to learn about it and test yourself in an exciting competition? You may find yourself quickly on the path to becoming one of the 21st century’s great cyber-security heroes. So go ahead, get in the arena. We guarantee it will lead to something amazing.