NSA cyber exercise hones skills at military academies

An annual cybersecurity exercise run by the National Security Agency for the military academies has put students alongside NSA's red team network hunters for the first time. The goal is to expose the future Defense Department cyber workforce to intrusion techniques they'll be called upon to thwart.

"To learn defense, you have to know offense," said James Titcomb, an NSA official who was the technical lead for this year's Cyber Defense Exercise.

The multiday competition wrapped up on April 14, with the Army's U.S. Military Academy taking first place for the eighth time. (The Air Force Academy has won four times, and the Naval Academy three.)

There were a few noticeable changes in CDX this year: An "ethical hacking" challenge was part of the exercise, as was a session tasking graduate students with securing and exploiting drone communications. Additionally, Army Cyber Command had network defenders participating in the exercise for the first time.

At the beginning, a black pirate flag hung over the exercise's operating room, hosted by a contractor in Columbia, Md., not far from Fort Meade. "We're waiting for the game to start right now," Marine Corps Gunnery Sgt. D'Adrian Mills said. "We probably have a few more tricks up our sleeves, so we're going to write a few more scripts to make it a little bit harder for them today."

Mills was part of the red team of computer specialists who attacked networks set up and defended by the academies. The Royal Military College of Canada also participated in CDX.

Mills and his colleagues developed exploits for Windows and Unix derived from open-source tools. They wreaked havoc overnight, when the network defenders were off-line. The academy teams then had to clean up the networks during operating hours. They were also thrown curveballs such as an assignment to strip an application of malware and deploy it on a specific schedule.

Teams are graded on their ability to keep networks running and protect confidential data, among other metrics.

"It makes it real for them," said Kimberly Beam, NSA's chief of remote deployed operations. "It takes it a little bit out of the academic world in [that] they have a real environment that they're working in and defending."

A fake news network pumped out updates during the simulation to mirror the real-life attention agencies receive when they are breached. The adversary was dubbed Synonymous after the infamous hacking collective Anonymous.

The Naval Academy won last year because "they stuck to the fundamentals," 1st Lt. Christopher Shields said. "At every single step, they used least privilege," meaning system-administering privileges were minimized to prevent attackers from moving laterally within a network.

Shields participated in CDX while at the Air Force Academy and now works at NSA's Information Assurance Directorate, which supplies the network-probing red team.

The Naval Academy's Dennis Devey was back at the competition this year defending his title. He said the inter-service rivalries come to the fore during CDX with the scoreboard in plain sight.

"Everyone has used a computer before, but there's a huge step up from being good at Excel to being able to do this sort of thing," he added, describing the technical acumen required of participants.

Absent from the competition this year was the Air Force Academy, which has a team of cyber cadets that train weekly for this sort of competition.