CPTC team wins two awards at globals

March 12, 2024

Dakota State University’s Collegiate Penetration Testing Competition (CPTC) team competed at globals in Rochester, N.Y., winning two awards.

Penetration testing helps companies and organizations know what is and isn’t vulnerable in their network. CPTC allows collegiate cybersecurity students to perform real-world penetration testing with a fictional business.

DSU’s team was tasked with assessing the security of Robert A. Kalka Metropolitan Skyport (RAKMS), a fictitious airport, during this competition.

The team members determined their roles for the competition and practiced report writing. Writing the report requires multiple sections, such as an executive summary for C-Suite employees to talk about compliance, regulations, and more, explained Gage Schacher, a senior on the team.

These reports require participants to go into further detail with narrative of what happened, how they exploited services to gain access, and more specifics about vulnerabilities, Schacher said.

Additionally, the teams had to review vulnerabilities previously patched in both Amazon Web Services (AWS) and on-premise environments to ensure they remained secure.

The competition organizers played the roles of clients during the competition, maintaining their characters when they met with teams. The clients would work with teams to discuss how the assessment is going and to make requests, like sending out a phishing email.

The team must remain in character as well, maintaining professional communication.

Competitions like this provide students with the opportunity to practice their skills and network with other students, industry professionals, and more.

“I like being around other teams and networking with people from different organizations,” Schacher said. 

DSU’s team won the Microsoft 365 Evangelists award for exploiting the exchange server the most out of all the competing teams. They also earned the Close Shave Award for password spraying, being the team with the most failed login attempts on accounts with the least number of lockouts.

“In the real world, when you’re doing penetration testing and trying a lot of passwords, you don’t want to lock everybody out,” said Dr. Tyler Flaagan, faculty advisor. “So having the best ratio of attempts to lockout is a good thing.”

In addition to practicing real-world skills, competitions like these are also good networking opportunities for students.

“Expanding your network really helps you get that interview and get past the initial screening process,” said team member Ryan Kleffman, a junior on the team.

At globals, coaches sit in a separate room to keep the competition fair and equitable. In addition to Flaagan, Assistant Professor Kyle Korman also assisted the team this year. Korman worked with the teams at regionals, and Flaagan attended globals. The CPTC competition provides students with learning experiences they can apply to other situations.

The 2023-24 DSU CPTC team includes:

• Derek Manzella, a junior Cyber Operations major from Eagan, Minn.
• Austen King, a Cyber Defense master’s student from Volga, S.D.
• Ryan Kleffman, a junior Cyber Operations major from Hermantown, Minn.
• Merrill Newman, a freshman Cyber Operations major from Gering, Neb.
• Daniel Sobczak, a sophomore Cyber Operations major from Denver, Colo.
• Gage Schacher, a senior Cyber Operations major from Denver, Colo.