UVA Engineering Wins Third Consecutive National Cybersecurity Championship

When companies need help defending their critical IT systems from disruptions such as cyberattacks or pandemics, they can turn to the University of Virginia. For the third consecutive year, the UVA School of Engineering has proven it educates some of the best cybersecurity professionals in the country.

UVA’s student Cyber Defense Team earned its third consecutive national championship, topping nine other finalist universities at the National Collegiate Cyber Defense Competition, held virtually May 22-23. The competition is sponsored by Raytheon Technologies.

UVA’s team held onto the competition’s coveted Alamo Cup by successfully defending a fictional auto parts company and securing all of its information technology systems – including company websites, e-commerce portals, e-mail servers and internal business management systems – against ongoing attacks. Teams were ranked for their ability to keep their companies’ systems online and secure for eight hours each day over two consecutive days.

UVA’s team was led by captain Maggie Gates, a computer science master’s degree student; Linux team lead Roman Bohuk, a fourth-year student; and Windows team lead Jake Smith, a fourth-year student. Competing beside Gates, Bohuk and Smith were third-year students Daniel Chen and Calvin Krist; second-year students Jack McDowell, Will Mayes and Conner Steenrod; and first-year students Paul Vann, Nicholas Lin and Emil Baggs. All but Steenrod, who is studying mechanical engineering, are computer science students.

“This was a rigorous competition, in which our students were required to perform highly advanced tasks mirroring the challenges faced every day by the nation’s cyber professionals,” UVA Engineering Dean Craig H. Benson said. “We are exceptionally proud of our students’ leadership and expertise under pressure.” 

Each team was required to provide reports on how well its systems were secured while simultaneously being challenged with additional tasks, such as adding new administrators to the system. Another key element was ensuring uninterrupted service by keeping all company systems up and running smoothly. Participants were graded with “service up-time” scores that suffered penalty deductions any time their systems were down for too long.

“Our biggest challenge coming out of the first day of competition was our service up-time rankings, because we had experienced significant down time on day one,” Bohuk said. “We were struggling to bring up an unstable email server, which took a big hit on our score, but we fixed it by the end of the day and were ready for day two.”

This was Gates’ inaugural year as team captain. In addition to the pressure of following in the footsteps of Mariah Kenny, a Class of 2019 computer science graduate who led the team to its first two victories, there was the pandemic. The competition was held virtually for the first time.

“The whole world was trying to figure out how to work remotely, and no one was prepared,” Gates said. “The organizers of this event did a great job of dealing with the pandemic and its social distancing requirements by building virtual aspects of real business challenges into the competition.”

Specific to the events of 2020, the fictional auto parts company was reinventing its systems for a virtual business model in response to a global pandemic.

“We were competing by doing the same things companies all over the world were doing to secure their systems during this transition to virtual operations,” Gates said. “This is what the competition is all about, creating a real-world experience and testing our skills in that scenario.”

Bohuk and Smith have been team leads in all three years UVA has competed. Smith said he believes communication skills have given the UVA team an advantage in each of its wins, and he is proud of the camaraderie that helps them support one another in tough challenges.

“This competition tests our ability to work under pressure. Our communications and ability to delegate really give us an edge,” Bohuk said. “Every team member knew what their responsibilities were. When anyone needed support, they communicated right away with other team members, who were ready to jump in and help.”

Yonghwi Kwon, assistant professor of computer science, has been the team’s faculty adviser and coach for the past two years. Kwon went into the competition worried about the remote aspects of the challenge, and how the team’s spirit and culture would migrate from in-person to online-only interaction.

“The team is very collegial, so I knew they would do great, but no one had gone through this national competition remotely, so we couldn’t really predict how things would turn out,” Kwon said. “Also, due to the online nature of the competition this year, it would be much easier to know how other teams were doing.”

Fourth-year computer science students Jake Smith, left, and Roman Bohuk have been team leads in all three years UVA has competed in the National Collegiate Cyber Defense Competition. (Contributed photo)

“The perpetual broadcasting of rivals in action could have been a major distraction, but our team retained complete focus throughout the competition,” Kwon said. “They steadily applied their own plans and kept moving forward toward the win.”

Kwon also pointed out that this competition scores the team’s ability to communicate with company stakeholders regarding identified threats and proposed mitigation measures. “Not only did UVA students excel in being able to identify cyber vulnerabilities and attack vectors, they were consistently able to put their findings into constructive reports with streamlined remediation suggestions,” he said.

The team captain plays a lead role in presenting findings to very distressed, albeit fictional, stakeholders. “I was so impressed with Maggie’s professionalism and confidence when pressed in the most challenging situations,” Kwon added. “She reflected competence that built even more trust in the team’s reports and recommendations.”

Gates said she is proud of her entire team, particularly in how they remained focused under pressure going into the second day.

“Coming out of day one, we were in second-to-last place,” she said. “I was so impressed by the strength of my team, and our ability to rally, make changes and press on to win the competition.”

Kevin Skadron, Harry Douglas Forsyth Professor and chair of UVA’s computer science department, said the students deserve praise for their efforts in winning a third time in such a prestigious competition, under the most challenging circumstances.

“UVA students continue to show their ability to perform exceptionally well under pressure,” he said. “In this competition, teams are judged not only on their technical skills, but also on their professionalism and ability to communicate complex concepts in an understandable way, even in challenging circumstances. These are key ingredients in UVA’s engineering curriculum, and we are very proud of these future cybersecurity leaders.”

More than 241 colleges and universities competed regionally across the United States for the chance to be among the 10 finalists to qualify for the three-day national championship. Only one other team besides UVA – from the University of Central Florida – has won three consecutive national championships in the competition’s 14-year history.

Exploration of cybersecurity careers is an important reason the National Collegiate Cyber Defense Competition was created in 2006, allowing students to engage in practical applications of cyber defense skills during multiple stages of competition.

“By 2022 there will be over 3.5 million job vacancies worldwide in cybersecurity. That really puts our nation at a disadvantage to cyber criminals and nation states,” Jon Check, senior director of cyber protection solutions at Raytheon Technologies, said during the 2020 awards ceremony. “I want to thank each of you for participating this weekend – more importantly, for your interest in cybersecurity, and expanding your skills in a field that is constantly evolving. The real-world scenarios you are facing will help you in your future career in cybersecurity.”