Cyber Competition and Skill Development
Cybersecurity Education through Gamification and the US Cyber Games Program
These blogs were first released as a two-part series on the “Behind the Screen” US Cyber Games site. Those blogs, Dreaming Big: US National Team for Cybersecurity Competition and Journey to the US Cyber Team | An Athlete's Perspective can be found at Behind the Screen. Some details are exclusive to those blogs, so go check them out.
Competition. This single word means so much to so many people. Competitive events have been used to develop talent, brands, and almost always some level of character. The world has watched and encouraged competitive games since the very beginning of organized society. From early Roman colosseums to the billion-dollar stadiums of today, people have enjoyed competing and watching others compete. Nearly all of us in America have watched the Olympics on TV. Perhaps the biggest “games” of all, the Olympics bring nations against each other to determine who has the top athletes in the world. As children, we all dreamed of one day competing for our country in events to be crowned “the best in the world.” There seemed to be no greater honor than to stand on a platform, representing your country, and receiving a medal.
For most of us (unless you were blessed with incredible genes, work ethic, and opportunities) this dream quickly faded away. As the competition grew, at some point you learned that you were not the best on your own team or in your city, much less the world. But, if you were like me, even that realization did not stop you from giving your all to your sport and team. Now take a second to remember those dreams, goals, and memories you have from your athletic career. Imagine what would have happened if there was no competition. Maybe you would have had no desire to improve, you might not have challenged yourself, or missed out on meeting friends along the way. Many of us had these chances through traditional sports, but what about the people who have other talents? Must they miss out on the opportunity to compete simply because they prefer a different skill? While there are competitions for many of these other talents (think Scripps, AMC, BOA, UCA, and many others) these all require some sort of an organized program or body that helps identify and judge talent and determine competition victors. This is what The European Union Agency for Cybersecurity (ENISA) has become at the international level.
There is a fairly large demand for cybersecurity competition. From the National Cyber League (NCL) to CTFs, it’s not difficult to find a place to test your skills, meet people, and learn. Places like SANS, major cybersecurity conferences, and vendors often sponsor competitions. If there’s a challenge coin involved, even better! Lots of cool options, but, have you ever wished there was a US national team for competition in your specialty? Is your specialty cybersecurity? Well if so, you’re in luck!
What Are the US Cyber Games?
The US Cyber Games are a program created to “bring together talented cybersecurity athletes, coaches, and industry leaders together to build an elite US Cyber Team for global cybersecurity competition.” The program is open to athletes age 18-24 in the United States. Once identified, a team is formed, trained, and prepared to compete on the international level at the International Cybersecurity Championship (ICC). The US Cyber Games was founded by Katzcy®, in cooperation with the NICE program at the National Institute of Standards and Technology (NIST). The US Cyber Games are a strategic program to assist in development of the next generation of diverse and well-qualified cybersecurity talent. The inaugural season for the US Cyber team was in 2021, with the creation of the Season 1 team.
In short, the US Cyber Games are the main opportunity to represent your country while competing in cybersecurity competitions. Think of Cyber Patriot or the National Cyber League (NCL) but with over 8 months of practice, talented coaches, and the support of your country.
What is the ICC?
The International Cybersecurity Challenge (ICC) encourages students and young professionals to pursue a career in cybersecurity by providing them with an opportunity to compete and collaborate with others in the cybersecurity industry across the globe.
The cybersecurity championship tournament is composed primarily of capture-the-flag and attack-and-defend games. It is an annual challenge that moves from country to country each year and is organized by the ENISA International Cybersecurity Challenge Program (ICC). Teams representing global regions travel to this multi-day event to compete in challenges related to web application and system exploitation, cryptography, reverse engineering, hardware challenges, and attack/defense. The ICC competition (formerly called the European Cyber Security Challenge) has been hosted by ENISA since 2016. More information on the ICC can be found on the official website: IC3 Games.
How to Make the US Team?
Just like any other competitive program, progression-based try-outs are used to determine the US Cyber Team athletes. A mix of CTFs, assessments, and interviews are ultimately used to select the team.
The first step is to join the US Cyber Open event. Each year, the US Cyber Games program begins with cyber athletes competing in the US Cyber Open™—a FREE, Capture the Flag (CTF) competition—where all ages and all skill levels are welcome.
Based on their CTF scores and application, a select number of cyber athletes (128 in 2023), ages 16 to 25, are then invited to participate in the US Cyber Combine™ where several virtual learning opportunities, hands-on exercises, and competitions are held over a 2-month period.
The selection and drafting of the Season III, US Cyber Team® members (30 competitive athletes, 6 OPS team members in 2023) takes place in October during a LIVE Draft Day event. The team and coaches will now begin preparing for the ICC via scrimmages, training camps, and more.
Ultimately, select members (currently 15) of the US Cyber Team will represent the United States at the International Cybersecurity Championship (ICC). The US Cyber Team season will typically last from January to October, with a previous 4-5 months (May - August) of participation/activities to make the team.
What Are the Requirements?
Athletes should meet these marks to be seriously considered for the team:
Cyber athletes invited to the US Cyber Combine and potentially drafted onto the US Cyber Team must be no older than 25 years of age come August of the following year, and a U.S. Citizen with the ability to obtain a U.S. passport.
Should enjoy competing in real-world scenarios to test your aptitude and abilities.
Have the willingness to learn and invest the time for world-class coaching.
Enjoy teaming with others with solid communication skills.
Want to learn from world-class cyber-skilled coaches.
Complete the online application to request an invitation.
Applicants DO NOT need to be students or part of any collegiate cybersecurity program to play.
The US Cyber Team season lasts about a full year.
If you want to get a sample of the action, the Open CTF is available to anyone that has interest in online cyber competitions, has access to a laptop or PC with a modern web browser and internet connection, and wants to test their limits and learn more about cybergaming. The Open CTF is an easy, no-commitment way to see where you stack up in the rankings and learn more about the program and cyber competitions in general.
Why Join?
Some of the perks of being on the US Cyber Team include:
Training opportunities via coaching, mentors, and access to learning platforms such as Hack The Box Academy and potential certification vouchers.
Ability to meet and network with top peers and professionals in the country. This is probably the top benefit for your future, in my opinion.
Potential employment opportunities and the ability to get in front of organizations.
Learn skills in areas such as reconnaissance, cryptanalysis, operations security, forensics analysis, web security, attack and defense skills, and malware analysis.
Earn digital badges as a tangible certification for social profiles, applications, and resumes.
Win prizes and receive swag boxes.
Athletes chosen for the US Cyber Team will have chances to compete on behalf of the United States at the international level.
A cool story to tell.
Ultimately an athlete will get out what they put into this experience. Someone has said something along the lines of “There is nothing worth doing that is not worth doing well.” Of course, you can get by on many things with talent, but passion, work ethic, and a team-first mentality are what will set the great athletes apart from the rest.
For people who are seriously considering taking a chance at the US Cyber Games, absolutely do it! Should you make the team, you can expect to spend up to 10 hours + a week practicing and spending time learning and building. So you’ll absolutely want to make sure you enjoy cybersecurity competitions, but you probably wouldn’t have gotten this far already if you did not.
SIII USCG Team
Now I want to cover in detail the road to joining the SIII US Cyber Team. You’ll get specifics on each step of the process and some athlete perspectives on their journeys.
For context, the image below lists the schedule of the main USCG events in 2023. The ICC for the Season 3 team will be held in October of 2024.
Let’s take a walk through each event and what you can do to give yourself the best odds of making the team.
Season III, US Cyber Open
Each year, the US Cyber Games program begins with the US Cyber Open™. The Open is a free, Capture the Flag (CTF) competition for all ages and all skill levels. Anyone can join this event, encompassing two sections, a Beginner’s game room, and a Competitive CTF.
BEGINNER'S GAME ROOM
The Beginner's Game Room is an entry-level part of the US Cyber Open and is included when registering for the CTF competition. Athletes can start here, and then move to the CTF whenever comfortable, or stay in the game room and play. The beginner’s game room was open for 10 days. This is a great opportunity for people new to CTFs and competitive cyber challenges. It’s a stress-free way to try out your skills and practice solving some challenges.
COMPETITIVE CTF
The Competitive CTF consists of virtual cybersecurity challenges across a variety of cybersecurity domains, such as cryptography, forensics, binary exploitation, reverse engineering, web, and more. Prizes are awarded to the top scorers in each CTF category and to the overall champion. Along with prizes, all participants will receive digital badges that can be displayed on social profiles, applications, and resumes. The Competitive CTF lasted for 7 days.
You can check out the season 3 open leaderboard here: https://www.uscybergames.com/season-3-cyber-open-ctf-leaderboard
Some stats on the participants in the SIII Open can be found in the image below.
Both sections of the Open are for individual competitions, they are not team games. If you want a better shot at making the Combine, definitely take part in the Competitive CTF. This isn’t a hard requirement, but if you place well you are very likely to make the Combine.
Open Recommendations: Compete in the Open, and submit the Combine application. Pretty simple really. Of course, if you place high in the Open CTF you’ll have great odds of making the combine, but also spend some time displaying what you bring to the table in that application. It’s not long, but you shouldn’t be afraid to include details.
Season III, US Cyber Combine
Based on individual CTF scores and the Combine application, a select number of cyber athletes, ages 16 to 25, are invited to participate in the US Cyber Combine™. The Combine houses several virtual learning opportunities, hands-on exercises, and competitions over 2 months.
The US Cyber Combine is similar to a sports combine in which athletes undergo a cyber aptitude evaluation, interview with multiple coaches and technical mentors, train weekly in cybersecurity skills via games, and compete in advanced CTF scrimmages to build their portfolio for the US Cyber Team Draft.
The US Cyber Combine is where you will do your best to shine and show the coaches why you should be selected to be a member of the Season III, US Cyber Team. The Combine is designed to test you, but also to provide top athletes with a unique experience to hear from leading experts in their field. The selected coaching staff will use this time to get to know each athlete and to understand their skills and competencies. Athletes who perform well during the Combine will have the opportunity to accumulate digital badges for performance and skills.
If you think you have what it takes and want a position on the US Cyber Team, make sure to register for the US Cyber Open CTF and complete your Combine application request. The Combine invitation request applications are more important than US Cyber Open CTF scores.
Combine Recommendations: Make sure to separate yourself somehow. Be as active as possible, things such as attending as many lectures as possible, communicating in the group chat, completing the assignments, and athlete observations. There are lots of talented people here, it’ll take work to make the team.
Season III, US Cyber Team Draft
The selection and drafting of the Season III, US Cyber Team® members took place in October 2023 during a live Draft Day event.
Following the US Cyber Combine, the coaches meet to select which top cyber athletes are invited to join the Season III, US Cyber Team. Athletes will be evaluated based on their applications, aptitude, interviews, effort, attitude, and skill. The final US Cyber Team will be purposely diverse bringing different backgrounds and skills to play key roles on the team. Once the team is formed, members get the opportunity to represent the United States at a variety of global scrimmages and the International Cybersecurity Championship, taking place in 2024. The Season 3 Team consists of 30 athletes.
Athletes can expect their time commitment to vary between 4-8 hours per week depending on their role and the progress of the season. The more practice you put in, the better you will be. I’ve found that there is a pretty direct link between skill and time spent learning and pwning boxes. A passion for CTFs is definitely an important characteristic for athletes.
If you are not one of the lucky 30, you can still potentially earn a spot on the Pipeline program. This is a 4-month program designed to teach high-performing athletes in hopes of obtaining future team spots.
My Journey
Let me give a quick overview of my experience with the USCG. Unlike most of the other athletes on the SIII team, I’m part of the USCG Program SIII Team in a different manner, with the Tiger/OPS (Operational Program Support) team. This team is composed of 6 individuals who bring immense value to the program, and while not a part of the competitive team, are working with the team members in various methods to help them be best prepared for the ICC. I got here entirely through my Combine application. I had done the Open in 2022, and didn’t make the Combine. At some point, I must have unsubscribed from USCG emails and that caused me to miss the email for the SIII Open. I signed up for it online, but just never received info on how to access the CTF. A bit embarrassing, but luckily I was able to make the Combine still. I’ve been able to earn a decent amount of certifications and do have CTF experience, so that helped my application. During the Combine I knew I wasn’t the most skilled member, there are some CTF wizards out there, but I did bring blue team cybersecurity experience that made me unique. I also had a decent social media presence on Linkedin, and that has helped me to learn a lot, and grow in helping others by sharing resources, ideas, and knowledge. I did interview fairly well and I guess I made an impression on someone. It has been a blast working with the SIII team so far, and I’m excited to help them bring home gold in October.
Just the Beginning
The team and coaches are now preparing for the ICC via scrimmages, training camps, and more. Ultimately, select members of the Season III, US Cyber Team will represent the United States at the International Cybersecurity Championship (ICC) in 2024. All travel expenses will be paid for those athletes who make the US Cyber Team and are chosen for international competition. The ICC team is made up of 15 athletes in 2023. The ICC consisted of a series of challenges such as web application and system exploitation, cryptography, reverse engineering, hardware challenges, and attack/defense challenges.
You can apply for the Open and submit a Combine application here: USCG Website.