CyberPatriot

​CyberPatriot is the National Youth Cyber Education Program.  At the center of CyberPatriot is the National Youth Cyber Defense Competition. The competition puts teams of high school and middle school students in the position of newly hired IT professionals tasked with managing the network of a small company. In the rounds of competition, teams are given a set of virtual images that represent operating systems and are tasked with finding cybersecurity vulnerabilities within the images and hardening the system while maintaining critical services in a six hour period.  Teams compete for the top placement within their state and region, and the top teams in the nation earn all-expenses paid trips to Baltimore, MD for the National Finals Competition where they can earn national recognition and scholarship money.​

​​​​​​​​All rounds of competition in CyberPatriot, with the exception of the National Finals Competition, take place online. Teams may compete from any location; many participate at their school, organization, or public library. Competitions​​ take place on specified weekends​ throughout the school year. Teams must complete all their work during one (1) ​​six consecutive-hour period on the Friday, Saturday, or Sunday of these competition windows. They may only have one instance of an image open at a time. Here's how it works.

Many of these steps are illustrated in this instructional video​.

​​​​BEFORE THE ROUND

• ​​​​​​Train: Teams should start training for the competition as soon as they can before the first round. Updated training materials are on the dashboard that Coaches and Mentors see upon signing into the website. These training materials are a great place to start, but they do not cover everything. Teams should rely on their Technical Mentors to receive more advanced training. Archived training materials are available​ on the public side of the website. 
• Prepare: All teams should make sure that they have the hardware, software, and network capabilities​ required to compete successfully. As the goal of the program is to have as many teams as possible competing, technical requirements are kept to a minimum.
• Download​​: About a week before the competition begins, the CyberPatriot Program Office sends an email with round instructions and links to download the virtual machine images (operating systems that can be played on top of other operating systems). These files are very large and should be downloaded and well before a team is ready to compete. Teams also verify that their download was successful before the round begins. There are usually two or three images per round.​​​

 

​​​​DURING THE ROUND

• ​Extract​: In the morning of the Friday of the competition weekend, teams receive an email with the password to extract the virtual machine images from their downloads. After doing so, they can load the images in VMware Player and begin competing.
• Identify​: When the images are opened, teams are prompted to enter a Team ID. This is a ten-digit alphanumeric code that is assigned to teams and delivered to them along with the extraction password.

​

​​​​​Team ID Box on a Virtual Machine Image

• ​Fix: The goal of every CyberPatriot competition is to find and fix vulnerabilities in their images. These images range from simple (e.g. giving users strong passwords) to much more complex. Some rounds also include networking challenges in the form of quizzes and Cisco Packet Tracer activities. Teams can also gain points by answering questions about their actions on the image.​
• Score​:​ ​When teams fix a vulnerability that is being checked, they receive points. If they take an action that makes a system less secure, they lose points. Teams can also gain points by answering forensics questions about actions they took to solve their vulnerabilities. Teams can checked their progress on their score report page.

​​​​Score Report Page

• Compare: A live scoreboard is available for teams to see how they stack up against others in the country. These scores are unofficial and undergo review by CyberPatriot staff following the competition.​​

​

Public Scoreboard​

• Ask:​ CyberPatriot staff is available to answer technical support questions during the round by chat​ and by phone at 877-885-5716 during peak competition hours. Instructions for accessing the tech support chat are sent to teams at the beginning of each round. Teams may not ask questions about vulnerabilities during the technical chats

AFTER THE ROUND

• ​​Delete: All virtual machine images should be deleted after the round is over to maintain the integrity of the competition.
• Wait: ​CyberPatriot staff reviews all the scores following the competition and releases official scores and standings to teams within a week after the round is over.

OPEN DIVISION​​​​

Page has been updated to reflect CP-IX changes.

​

 

Qualification Rounds. All Open Division teams can participate in these rounds.  A team's performance in Round 1 does not affect its ability to compete in Round 2. Teams missing Round 1 can participate in Round 2.

Advancement to the State Rounds. Team scores from Rounds 1 and 2 are added together to determine placement in one of the three tiers. Each of these tiers (Platinum, Gold, and Silver) has a State and Regional Round. The Platinum Tier leads to the National Finals Competition. Teams in the top 30% of combined Round 1 and/or Round 2 scores are placed in the ­Platinum Tier. Teams​ in the middle 40% of combined scores are placed in the Gold Tier, and the remaining 30% are placed in the Silver Tier. ​​Tier placement is permanent. Teams may not be promoted or demoted and may not self-select tiers. For awards purposes, Platinum teams are always higher than Gold teams, which are always higher than Silver teams.

State Rounds. All teams may participate in a State Round within their tier placements. The State Rounds have different difficulty levels at each tier. Teams that missed Rounds 1 and/or 2 may participate in the Silver Tier State Round.

​State Awards. The purpose of AFA State Awards is to recognize the top three teams in each state or area. Any team competing in a State Round at any tier level may win a State Award. However, because the level of difficulty is different for each tier and scores are not adjusted for difficulty, Platinum Tier teams are always ranked higher than Gold Tier teams, which are always ranked higher than Silver Tier teams. That is, a Gold team will not outrank a Platinum team, even if it has a higher State Round score. Similarly, a Silver team will not outrank a Gold or Platinum team, even if it has a higher State Round score.

Advancement to the Regional Rounds. Advancement occurs in two stages. First, the top 3 teams in each state at each tier level are advanced (i.e. up to nine teams per state).  All of these teams receive Tier Certificates for their achievement.​ ​Second, for CyberPatriot VIII, the teams with the top 36 highest scores nationwide* in the State Rounds that are n​​ot within the top three for their state advance as Wild Cards.

Regional Rounds. Like State Rounds, Regional Rounds have different difficulty levels at each tier.  

Regional Awards. The purpose of Regional Awards is to recognize the top three teams in each region. State Round performance and awards are not factors in Regional Awards. Any team competing in a Regional Round at any tier level may win a Regional Award. However, because the level of difficulty is different for each tier and scores are not adjusted for difficulty, Platinum Tier teams are always ranked higher than Gold Tier teams, which are always ranked higher than Silver Tier teams. That is, a Gold team will not outrank a Platinum team, even if it has a higher Regional Round score. Similarly, a Silver team will not outrank a Gold or Platinum team, even if it has a higher Regional Round score. 

The top three teams within each tier in each region receive Tier Certificates. 

Advancement to the National Finals Competition. Teams with the top 12 scores in the Platinum Regional Round advance to the National Finals Competition. Geography is not a factor in National Finals advancement.