Bit by Byte, Tech Students Learn the Art of Cyber War

Ten University of Cincinnati information technology students recently learned the pressure that comes with the need to be right all the time, every time, no excuses.

These students, from UC’s College of Applied Science, were data defenders in the June 12th close to an Information Security and Privacy course led by Kevin McLaughlin, director of information security with UCit and CAS adjunct professor.

The last day of class was spent in a day-long cyber war in which these defenders were asked to serve as Web warriors, protecting a computer system from another group of students who were seeking to hack into their system and secure sensitive information.

“It’s a hard job for defenders. They have to have layers of defenses and be right 100-percent of the time. Hackers only have to get in once,” explained McLaughlin.

And these hackers – 12 in all – tried for several hours, working in a group, huddled over textbooks and hunched with faces nearly pressed to their computer screens as they ran reconnaissance and probed for weaknesses in the defenders’ system. They were seeking to act just like hackers from around the world do when making the average computer attack – attacks that are made at the rate of 2,200 times a day on the average computer. That translates into an attack once every 40 seconds on the average computer.

At the end of the high-tension day, the good guys won, with the hackers winning a skirmish or two – breaking into two Web sites and obtaining one protected piece of data.

Though, in reality, all the students won because of what they learned. So said IT student Jim Hoeting: “…this pulls everything together in a tangible environment. It’s very useful because this experience will most likely be similar to what we’ll face on the job, protecting valuable and sensitive data.”

The students serving as attackers may have learned even more, according to McLaughlin, who was assisted in the cyber-war games by Karl Hart of Cybercon Security Solutions and Quinn Shamblin, UC information security officer. Said McLaughlin, “The attacking students learn how hackers think, what vectors of attack they might attempt.”

IT student Shawn Pennell, 20, of Germantown, Ohio, said that while that was the case, he admitted to pursuing a “lot of dead ends. But I know I’ll be a better defender for having gone through this exercise.”

By learning now how to find the chinks in a cyber security system’s armor, the students become better prepared to set up protections… and are better prepared to take advantage of a rapidly growing job market. The needs for colleges to graduate students who understand computer security is growing. Agencies involved in tracking cyber security reported more than 90,000 cyber crimes in the United States in 2007.

This kind of cyber-war game just held at UC was first incorporated into the College of Applied Science’s Information Security and Privacy course last quarter. When the UC course is again offered in the fall, another day-long war game will be scheduled, with an added twist. It’s hoped that regional FBI agents working in the area of Internet fraud will team with the students to add expertise and additional elements of realism.

“These games will always be changing,” stated Hart. “In the future, we might have the students form one unified team and cyber attack a team of instructors. That’s because you can't consider the problem of defense without first understanding the problem of attack. We’ll always be mixing up these kinds of realistic practices so our students learn to be the best defenders possible against the bad guys.”

• Learn more about UC’s academic IT programs. 

• Apply to UC’s associate degree or baccalaureate degree academic IT programs.

• Learn more about what the average person can do to improve basic computer security, i.e., Best password practices.

• Check out security updates from UCit.

• Read the latest news from UC.