CyberDay & CyberTitan: cybersecurity resources for cyberawareness month

The idea of bringing cybersecurity awareness into a public school classroom makes many people uneasy, but as I said in a recent interview, "Cyber is never as complicated as you think it is, don't let the lingo and media scare you off."   There are a couple of events happening in October, which is cybersecurity awareness month in Canada, that'll give you the resources and connections you need to explore cybersafety in your classroom safely and with confidence (!).

CyberDay is the gentle introduction to cybersafety, privacy and cybersecurity.  

It's happening on October 18th and the Knowledgeflow Cybersafety Foundation has been working like beavers to put together interactive resources and talks with experts that'll make cyber accessible to everyone.

CyberDay is all online and you can pick and choose what you want to use in your classroom.  It could be a short lesson, a longer activity or even a whole day event depending on how you want to use it.

Sign up is on the site and you can even do some preliminary learning with it by having students submit questions to experts.  If you don't think you have students in your class who are curious about hacking then you're not getting where they spend most of their time (it's online).  In this event students can ask white hat hackers and pentesters about their work.  That might lead more students to consider cybersecurity pathways which are in such high demand that Canada is looking overseas to bring people in because we're not producing this expertise at home.

As they say on the site, "Cybersafety is a team sport".  You're not alone in broaching this sometimes unnerving subject, you only need to connect to CyberDay to see how much help is on hand.

If ease of access isn't compelling for you perhaps the idea that using interconnecting education technology in our classrooms means we should all be covering cybersafety and privacy with our students is simply good practice.  I attended a conference last week where Michael Canuel from LearnQC trotted out current stats that should make you sit up and take notice:

• 
  (a staggering) 98% of data breaches are caused by user error or cyber-illiteracy. If we took steps to improve cybersafety awareness in education, we would all but solve the current wave of cyber-attacks on the education sector.
• cyber-awareness is vital to protecting our critical infrastructure. Canada now considers information technology to be a critical infrastructure (because it also runs all the other ones)
• cyber-skills are part of a collection of digital literacy skills that extend well beyond coding

The need for better cyber-awareness should be self evident, but what isn't (to me) is why public education seems to go out of its way to ignore it.  While listening to Michael's talk about the poor state of cyber-skills in Canadian education, I couldn't help wondering if it isn't intentional.  Many public education organizations have vested political interests in keeping the status quo.  From a professional perspective I was left desperately hoping that educators aren't intentionally ignoring privacy and cybersafety in order to sabotage eLearning.  CyberDay would be a great first step in proving that skepticism misplaced.

One of the angles I was considering for CyberDay was just how well suited it is as a library activity.  I did a piece for the Ontario Library Association's Teaching LIbrarian online magazine about how cybersecurity (as a digital literacy) makes a perfect connection with the role a modern learning commons plays in our schools.

Library learning commons are often the first point of contact for emerging technology.  Way back in middle school in 1982, I first laid hands on a computer in our school library when we set up Commodore PETs and I saw the neon green wonder of coding for the first time.

I'm hoping I can connect with the OSLA about reaching out to librarians over the next couple of weeks to drum up interest in taking on this latest in a long line of emerging digital literacies.  Cyber isn't as scary as you think it is, and when you do get into it you quickly realize that it's a great opportunity for iterative, genuine learning.

CYBERTITAN:  Canada's student cybersecurity competition

CyberTitan has been running since 2017/18 in Canada as part of CyberPatriot, the US Air Force Association's now international student competition.  If you've read Dusty World before you know that this contest has not only opened up pathways for my students, but also played a major role in my own professional development.  I'm a huge fan of the competition and would love to see more Canadian educators get on board with it.

CyberPatriot has a live map of registered teams on their site.  As you can see, compared to the United States, Canada's engagement with the competition has been... less.

I'm particularly focused on connecting under-represented groups to the competition.  When I coached the first ever top all-female team to the national finals in 2019, I became aware of just how toxically masculine cyber can be.  I'd move mountains to get more female (including non-binary and female identifying) students into it.  I'd move more mountains to get other under represented groups including indigenous students on board too.  The finalist teams all tend to come from major city specialist schools which tend to cater to socio-economically advantaged youth.  Cyber isn't exclusively and urban/wealthy course of study, it's an all-of-us discipline that rural communities, families and businesses are just as in need of.

You can see what the competition is about from this Prezi that the mighty @oksarge and I presented at ECOO summer camp in 2020.  Students learn hands-on defensive IT skills by fixing compromised WIndows and Linux operating systems in virtual machines.

Learning to wrangle virtual machines is a big part of CyberPatriot.  You'll find this technology to be an incredible tool for teaching computer technology. You can abuse VMs in all sorts of ways that'd make your IT department shudder, and when it all goes wrong?  Just close the window.

VMs are simulated computers that happen inside a window, so you could run Apple OSx in Windows, or Windows in Linux using a VM.  Because it's all virtual there is no chance of spreading malware from inside a VM, which is why they're used in cybersecurity.  Learning virtualization technology is really eye opening for students, and it's not nearly as tricky as you think it might be.

Our lab goes full disco during a CyberPatriot round.  It's a six-hour competition window.  Pizza is brought in and snacks are available.  Students dig right to the end, making a mockery of the idea that kids today have no attention span.

The competition is exciting and students genuinely enjoy it, usually returning year after year.  Live world wide scoring pits your team against others from around the world, so if they're competitive they can follow the scoreboard and dig for points, but CyberPatriot can also be played from a purely educational perspective where students still benefit from the teamwork, iterative problem solving and cyber-skills development.  Our junior teams are always reminded that this is a reconnaissance season with no expectation of winning: learn the ropes and have fun with it.  Many become competitive anyway because (here it comes again): cyber isn't as complicated as you think it is.

Sign up is due by October 5th, but no money is due then (fees are waived for non-male teams) and I've always found that SHSM and other student success initiatives are eager to help cover costs (which aren't due until mid-November).  The swag is excellent (t-shirts, medals!) and once students understand how it all works they always say the same thing (here it comes again), "it's not as hard as I thought it would be."

Libraries would be another great focus for CyberTitan, where students could access the technology they need and develop their library and librarian coach into a cyber-aware school-wide resource.  My students have used the skills learned in CyberPatriot to help our school with technical support and many went on to support local businesses as well.  Five years in I'm seeing former CyberTitans working overseas in technical contracts, joining the cyber-side of the Canadian Forces or exploring advanced post-secondary programs.  The benefits from this are many, we just need to get more Canadian educators to take that step and sign up a team. Once they do, their students will thanks them, and they'll be back!

It's still true!  If you'd like to talk about running a high school team, I've got lots of experience and would be thrilled to help you get going.  Krista ran a very successful middle-school team in her first year coaching and can talk you through what to expect in that division.

Building Capacity: Taking CyberTitan from Niche Activity to School Culture

Just over three years ago I stumbled across the inaugural CyberTitan Student Cybersecurity Competition on ICTC's webpage while looking up statistics for the information and communication technology job market.  I managed to convince four of my seniors to take a swing at it.  We got better and better round over round as we honed in on the expectations of the US CyberPatriot competition that CyberTitan works from.

In the competition students are given a virtual machine image (imagine a computer operating system like Windows operating inside a window).  These images are broken, with improper settings and things installed that shouldn't be.  If you've ever had to try and clean a school laptop after a student has used it, you know what sort of messes can occur.

We were already pretty good at IT & Networking and CyberTitan offered us a way to exercise those skills while also discovering a newly emerging aspect of computing:  cybersecurity.  I found that our expansion into CyberTitan directly supported our Skills Ontario preparation - the two things are symbiotic.

We surprised ourselves by getting an email inviting us to the first Canadian National Finals in Fredericton, New Brunswick in May of 2018...

That success made some noise and the next year we had three teams of six students each.  While standing at the student photo for the 2018 finals, Sandra Saric, then VP of Innovation with ICTC, said under her breath, "where are all the girls?"  I took that and ran with it, encouraging my strongest grade 9 girls (I barely keep any of them into senior computer engineering classes) to form an all-female team for the 2018-19 season.

The girls did fabulously well, often chasing down our senior team on points.  Our junior team, the Cybears, also got us into the top tier of the competition for the first time before getting eliminated in the state finals.  The Terabytches offered me an inside look into systemic sexism in education as well as technology and made it clear why so many girls don't pursue technology pathways in high school and beyond.

The Terabytches won the top female team in Canada wildcard spot for the 2018-19 National Finals in Ottawa and did a lot of press which I think (hope?) opened up the possibility of ICT and cybersecurity careers to more girls.

While 2019 was definitely the year of the Terabytches, it was also a good year consolidating our skills and building capacity.  For the first time in 2019/20 we had students returning who were no longer rookies in the competition (our first year team had all graduated).  For the 2020 season I encouraged the most experienced and engaged students to make a senior team with the intent of scoring higher in the competition than we'd ever done previously.  The team consisted of one of the Terabytches from the year before and the junior team who had gone platinum.  They re-branded themselves Kings Guard and tackled the 2020 competition with a focus that can only come from experience.  

In previous years we were usually the best of the rest, getting beaten by specialist, urban schools from the big cities across Canada.  This year Kings Guard beat all but two of those teams for a third place finish in the semi-final round.  We went top-tier platinum and then proceeded to land in the top quarter of the best teams in the world.  We'd never breathed the air up here, and it tasted good!

The Terabytches experienced some turnover, but with three veterans and three  rookies,

consistently beat their national champion scores from the year before.  Our two junior teams also scored well, with Altron in particular punching well above their weight.  Both junior teams made it to the gold tier semi-finals and produced strong results.  Altron finished top 12 in the world out of thousands of teams.  Seeing our little, rural school (it is literally surrounded by farm fields) on a list with some of the top cyber-schools in North America never gets old.

We're waiting on CyberTitan to announce the Canadian finalists for this year's competition as I write this, but regardless of the outcome this year's students have produced outstanding results which point to a way forward for educators across Canada who want to engage their students with a subject that frankly freaks people out.

We aren't magic.  What got us into this was an opportunity to explore an emerging field in technology and make our program more relevant.  If you're curious and willing to give it a whirl, and can find students with the same curiosity, you can get involved with CyberTitan and begin to build capacity in this vital 21st Century fluency too.

Krista Sarginson, who teaches at St Leonard in Manotick near Ottawa, took the plunge this year and had an epic rookie season, finishing second in Canada in the middle school division.  As more teachers get involved with CyberTitan, the network grows, as does the support.

Krista described the competition early on as techy and quite particular, but it didn't take long for her to get a handle on the process and, as you can see from her team's results, they very quickly got good at it!  What could happen next?  Hopefully her Cyberlions all head off to middle school (St Leonard is a k-6 school) and encourage them to participate next year.  Those vets are likely to clinch a national title!  Meanwhile, Krista is encouraging and engaging other teachers in her board.

What does your school get out of CyberTitan?  It teaches students and staff hands on about best cybersecurity practices and raises your digital literacy in meaningful ways.  Your board's IT department will love your participation in it as it helps raise awareness around cybersecurity and promotes a healthier digital infrastructure.  The media glow around it is also very positive.  We've had a lot of attention from local and provincial media who are also very aware of the cybersecurity shortage we're living in.  I won't mention the swag students and coaches receive that includes t-shirts, all sorts of technical support, access to Cisco's Netacademy, along with medals and awards.

You can find lots of statistics on how behind we are on cybersecurity, and education can play a big part in that.  The CyberTitan/Cyberpatriot competition offers students and teachers a well supported and engaging introduction to this exciting field of study, you should give it a go!

This is what nearly 600% growth looks like - it's gone from a niche activity to a culture...

CyberTitan is only in its third year and has seen growth similar to our own, with over 200 teams from across Canada participating this year.  It's my hope that by 2022 there are over 500 teams competing and the national finals is expanded to include three middle school teams who will duke it out for their own national title.

If we're going to depend on ICT infrastructure to run our critical infrastructure (and we increasingly are), then we owe it to ourselves to take securing that infrastructure seriously.  ICTC's CyberTitan helps raise cyber-fluency in our education system which will in turn make for a safer, more secure Canada.


***

Wondering how to support CyberTitan from industry?
https://www.cybertitan.ca/index.php/about/partners-and-sponsors/become-a-partnersponsor/

Wondering how to support CyberTitan from government?
https://www.cybertitan.ca/index.php/about/partners-and-sponsors/national-program-ambassadors/

How CyberTitan works:
https://www.cybertitan.ca/index.php/competition-results-2018-2/how-the-competition-works/

This is the US CyberPatriot competition that CyberTitan works with:
https://www.uscyberpatriot.org/Pages/About/What-is-CyberPatriot.aspx

Here's the presentation I've been doing around Ontario education for the past two years:
https://prezi.com/h4kf8yfkdtyr/?utm_campaign=share&utm_medium=copy

Playing To Win

Last year we were stunned to get an email saying we'd made it through to the Canadian national finals for the first ever CyberTitan student cybersecurity contest.  We knew, on the face of things, that we weren't up at the pointy end of things, though we had made big improvements as we came to see what the competition wanted from us.  We couldn't really understand how we'd finished top two other than the fact that there really weren't many teams in the eastern division.

CyberTitan is the Information and Communications Technology Council (ICTC) of Canada's national competition for Canadian students interested in developing skills in cyber security.  We've become so dependant on ICT infrastructure that it underpins many other critical systems like our food delivery, energy and finance sectors.  Yet this critical infrastructure is taught as an afterthought in Ontario's education system (even as it becomes instrumental in delivering curriculum in all other areas of learning).  Being able to secure and maintain ICT infrastructure isn't a nice idea, it's increasingly a life and death one.

ICTC's creation of the CyberTitan program is a forward thinking move.  With one of the largest job vacancy rates of any field and while other countries create military and civilian agencies to develop this new expression of ill intent, cyber security is being ignored at our own peril, but ICTC is trying to do something about it.

We went to last year's nationals in Fredericton and had a fantastic experience.  Three of our team had never left the province or been on a plane before.  The competition took a radical turn from the Cyberpatriot rounds we'd done previously, but we did our best and managed a fifth place finish being beaten only by teams who have been doing this for years through the American Cyberpatriot competition.

This year we hit the ground running in September.  I'd already arranged a senior team and an all female team, but interest was so high I took the hit and paid the late fee for another team of interested junior students before realizing my department budget had been eviscerated and this would drive me into the red.  Those students named themselves the Cybears and stunned everyone by topping our scores in the first two rounds of Cyberpatriot, the US run competition that CyberTitan follows in the early rounds.  Cyberpatriot tiers the teams after the two opening rounds and then pitches challenges to each tier depending on their ability.  Platinum teams are still in the hunt for the world wide title but lower tiers still get to compete for top of tier and wildcard prizes.

Since this was our first time seeing platinum level challenges, the State Round was a rough ride for our Cybears. They didn't manage to finish in the top 25% of platinum teams worldwide and as a result they are out of the semi-final round coming up next week.  Having to tell our strongest team that they are out wasn't easy, but it did shed light on how we got to nationals last year and how the competition is organized.

Last year we struggled at the beginning but got better and better each round.  We ended up Gold tiered and in the State Round had our best run yet, which is what got us to the Canadian Nationals - CyberTitan only looks at State Round results and doesn't seem to take tiering into account.  Platinum teams trying to climb Everest are considered on equal footing with Gold and Silver teams climbing Blue Mountain or a mole hill.  It would be like having some students write a 4C exam and others a 4U exam and then considering the grades as equal.

This led to an interesting conversation with the frustrated Cybears who, had they backed off on points in the early rounds would have landed in an easier tier and had a direct run to a top score in the State Round.  Do we play dumb and get an easier tier to get higher scores at the end?  That's the path we unknowingly took to the national finals last year.

In talking it through we all eventually came around to the same conclusion:  we go full bore the whole time even if it means a tougher time later on in the competition.  The goal should be to go Platinum and then qualify for the national semifinals and get through the hard way.  This puts us in the best possible place to actually win Nationals.  We could be cunning and play this to get easier tiers and game our way into the Nationals, but just getting to Nationals isn't the point, improving our skills and being competitive in it is.

Next year we're aiming to build an all-star team out of the strongest contenders in this year's three teams.  That team isn't going to try and game its way into a National finalist spot.  We're going the long way around, or not at all.  Meanwhile, our senior team got strong in Windows security management and thanks mainly to the scores of those Windows boys ended up finishing 2nd in Canada in the Gold tier.  Their Cisco networking and Linux results, while slowly improving, are way out of line with other teams around them, so they have an uphill battle to get the points they need to survive the semi-final round.  Since they're in the Gold tier the images won't be as hard as they might be, so points should be findable.  They've gotten better in each round, so a strong national finish is in the cards.

Our junior team is actually our girls' team. Most of them were grade 9s last year with only two in grade 11.  The contest stressed them early but they showed incredible resilience and adaptability, pulling themselves up into the Gold tier and finishing right behind the senior Cybeavers, 3rd in Canada in their tier.

Last year's nationals was a very male centric contest.  This doesn't surprise me as finding females willing to stick with digital technologies has been an ongoing struggle at my conservative, rural school.  The all-female staff of ICTC people at the Nationals noted the lack of female competitors.  Getting women into technology is an ongoing battle, but more than a wildcard entry, I'd love to see the Terabytches win their way into the National finals and be the first all female team to do it.  I'd then like to see them take a serious run at winning it.

Unlike last year when we built a team of graduating seniors who all left us for university, this year we only have one or two graduating seniors.  We have already seen a significant step forward in terms of raising our skills and knowledge of cybersecurity (all three teams beat last year's team's State Round score).  By being able to cultivate talent and build experience year over year, our future teams in this competition look promising indeed.

Two Gold Tier finishes in the 2019 State Round - nice to see!

The Cyberpatriot competition does a lot of things that align with Ontario's computer technology curriculum.  Joining it gives you access to Cisco's Netacademy while also encouraging focus on what to get better at quickly.  The maintenance work we do in Windows 8.1, 10 and Server aligns with Skills Ontario's IT & Networking scope, acting as a great review for our Skills competitors.  We struggle with Linux, but understanding Unix based operating systems is vital for web development, another Skills Ontario scope we're chasing, so getting better there is no bad thing.

With so much student interest, our successes to date, and how complementary CyberTitan is with our other activities, I don't see us dropping it any time soon, though it was mighty difficult to tell the hardest working, most focused and most successful team that they are out because they qualified too well.  Spending the $400 on registration and then another couple of hundred feeding my CyberTitans while they were battling in this cyber-marathon is also hurting now that I'm looking at an eviscerated department budget.

Friday, February 1st, while everyone else is writing day four exams thanks to some nasty winter weather, I've arranged to have all my competitors' exams bumped to Monday and we'll be in a six hour battle to see if we can win our way to the National Finals for the second year in a row.  I hope both teams show up ready to do their best work.  As long as we're running at 100% of our capacity, the results don't really matter, though when we're this close it'd be nice to win!

It looks like at least two eastern division teams are ahead of us
on points, so it looks like our 2018-19 CyberTitan drive is at an end.

As a quick follow up, it looks like we're finally out of the competition after the semi-finals.  The Terabytches did great work in Windows and Cisco, but struggled in Linux and fell short in the semi-finals.  Doing this round we've never seen before in the middle of exams made it very difficult for the everyone, but especially the juniors, to focus on preparing for semis.  The Terabytches (for the first time in the contest) seemed ruffled, making mistakes they hadn't previously when managing images and working within the competition framework.  The penalties received were all good experience though and will only make for a more resilient team next year.  Now we've seen what can go wrong, we know how to avoid it in the future.

The Cybeavers were as strong as ever in Windows, where they were consistently near or at the top of the country.  They struggled in Linux but came in at about the State Round average number of points in that category, so held their own.  The Cisco networking once again stumped them, causing us to lose places and ultimately fall short of at least two other eastern division teams, which means we're probably finished.

Creating senior teams that are strong across all sectors of the competition (Windows OS and Linux OS security management and Cisco networking) is going to be the goal for next year, and looking at our two junior teams, we're spoiled for choice.  Up until last year I was still getting bumped into teaching English and wasn't even a full time ICT teacher.  Computer science at our school is only a couple of sections and digital technologies in general struggle to reach a sustainable level in our building.  That our peripheral program in our rural school is able to produce results like we do is very satisfying and shows my students what they can do if they work together and apply themselves.  We'll keep doing that, one way or another, even if it means winning the hard way.  Next year we'll be doing it with our first ever veteran teams.

If you're trying to drum up interest in ICT in your school, this is a good way to do it!