2016 Event Guide

at the National Flight Academy, Pensacola, Florida

and the National Naval Aviation Museum

January 22-24, 2016

Thank You to Our Sponsors!

Premier

Thank You to Our Sponsors!

Diamond

Thank You to Our Sponsors!

Gold

Thank You to Our Sponsors!

Silver

Kevin Schmidt

Additional Supporters and Participants

Booker T. Washington High School Catholic High School Center for Information Dominance

Defense Information Systems Agency

Escambia County School District FBI Florida Department of Law Enforcement George Stone Technical Center Gulf Breeze High School Institute for Human and Machine Cognition

Navy Information Operations Center Pace High School Pensacola Christian College

Pensacola High School Pine Forest High School Radford M. Locklin Technical Center Santa Rosa County School District US Air Force

US Army

US Navy

US Navy Reserves

West Florida High School Volunteer, Mentors, and Parents of our Participants!

Welcome to CyberThon 2016

"Homeland Security starts with Hometown Security" On behalf of the Blue Angels Pensacola Chapter of AFCEA International, the National Flight Academy, our event sponsors and the large number of volunteers from Government, industry and academia, it is my distinct honor and great pleasure to welcome you to CyberThon 2016. CyberThon is a community event designed to give high school and college students hands-on experience in cyber defense procedures with instruction from active industry experts. Cybersecurity professionals from DoD cyber operations and training commands in Northwest Florida have volunteered to mentor and participate in this cyber education and awareness showcase event created to grow Pensacola’s IT and cybersecurity workforce. Cyber experts are needed to fulfill many critical security missions in today’s job market, so by partnering as a community and involving students, our mission is to create a cyber-skilled workforce pipeline for local, high demand careers The CyberThon challenge sessions place the student teams in the position of newly hired IT professionals tasked as the first responders for cybersecurity threat detection and response of a small company. With guidance from their mentors, teams will acquire hands-on experience with security tools and defense tactics, finding cybersecurity vulnerabilities and hardening the IT infrastructure to prevent, mitigate and deter cyber attackers and maintain efficient system and network operations.

Finally, I want to express my sincere thanks and appreciation to our dedicated volunteers and sponsors. Our theme of “Homeland Security starts with Hometown Security” underscores the amount of community sponsorship, effort and participation received in support of this event. This commitment and support has made CyberThon 2016 a reality and ensures this event will inspire students toward careers in cybersecurity or other science, technology, engineering and mathematics (STEM) career paths. Sincerely,

Randy M. Ramos President, AFCEA Blue Angels Pensacola Chapter

About AFCEA Membership in AFCEA International provides access to an unrivaled forum for public and private sector professionals to interact and share ideas in the communications, intelligence and information technology arenas. To this end, AFCEA holds world-renowned conventions, expos, conferences, and symposia to keep its members up-to-date on the state of their industry.

Members also benefit from a subscription to SIGNAL Magazine, AFCEA’s professional journal. SIGNAL is a monthly publication that is available in both print and digital editions and provides in-depth, relevant and timely news in the communications and information technology realms of the defense, intelligence and global security communities.

In addition, AFCEA’s volunteer-run Chapters hold luncheons, networking events, mentorship programs, and more to extend the AFCEA mission to a local level. There are currently over 130 Chapters worldwide that provide this service to almost 35,000 AFCEA members.

The Blue Angels Pensacola AFCEA chapter’s primary goals are to provide a strong ethical forum where C4I professionals can exchange ideas and learn of the latest technologies available in order to satisfy command and control, electronics and intelligence requirements, and to award scholarships to those in pursuit of such endeavors. Our chapter helps foster close cooperative relationships among Government agencies, the military, academia and industry. Chapter events include luncheons featuring distinguished guest speakers, scholarships and awards, CyberThon, annual scholarship fund raising golf tournament, and more. All of these events provide excellent opportunities for members to interface with government, military, commercial industry, and educational foundations to exchange ideas and solutions.

The AFCEA Awards and Scholarship program promotes academic excellence in science, technology, engineering and mathematics (STEM) at the graduate, undergraduate and ROTC program levels with the Blue Angels Pensacola chapter supporting educational and merit endeavors at elementary through high school, community colleges and universities. The mission is to support individual development in STEM career paths through selective motivational awards, prizes and scholarships, and educational grants.

To become a member of the Pensacola Chapter of AFCEA or for more information, please visit http://afceapensacola.org/ or http://www.afcea.org/membership. Frank Smith is Vice-President of Membership for the Pensacola Chapter of AFCEA. You can contact Frank by phone at 850-944-7579 or by email at fsmith@gbsi.com.

The CyberThon Environment

The CyberThon environment received a major improvement this year with the addition of dedicated equipment for the cyber range. This will allow us to build upon the Cyberthon scenarios each year and add functionality as cybersecurity defense continues to evolve. The cyber experts have worked diligently building ESXi servers, allocate storage space on a SAS, building Virtual Switches and much more.

In order to support efficient scalability, the CyberThon Range will operate on one environment, designed to support efficient scalability as teams and participants increase. In doing so, architects can focus on creating fully functional, high performance environments and mentors only need to familiarize themselves with one environment while supporting multiple defense scenarios and gameplay. Incorporating PCI data into the environments supports information defense scenarios. While learning the process of defending a network, participants also learn how to defend information that offenders are trying to acquire.

The CyberThon Tools Other than ESXi and a few Windows VMs, the CyberThon Range uses all open source software. Our preference is to teach theory and methodology over simply teaching the details of a specific tool. Many of these open source tools have more functionality and capability than commercial products, and participants will have access to these tools for continuous learning at no cost. CyberThon participants will be working from a Linux machine, booted from a thumb drive and will have access to the open source toolset. This toolset provides greater opportunities for students to work with log data, full session PCAP data and artifacts. CyberThon gameplay introduces students to the NIST Cybersecurity Frameworks core functions of Identify, Protect, Detect, Respond and Recover. The majority of the active scenarios will focus around the Detect function, with students observing, detecting and collecting artifacts from live exploits. Students will be monitoring an insecure network. The network doesn't have feelings, but in Cyberspace that’s how it is described. This will allow students to see and identify more nefarious activity.

Schedule of Events

DAY 0: Friday, 22 January 2016

DAY 1: Saturday, 23 January 2016

DAY 2: Sunday, 24 January 2016

Student Participants – What to Expect As a cyber-defender brought in to help identify and protect against hackers, you will need to carefully maintain the network functionality and not inadvertently break it. You must adhere to the network owner’s rules as described by your team leader. We recommend that you maintain a strict record of every action you take on the network in order to get full credit for you actions and to help understand what changes have been made. This is very important if you need to back-track your steps to fix mistakes. Each day begins with arrival and check-in at 0800 in the main lobby. At 0830 you will go to your respective team rooms for your daily mission briefing. The active exercise play will be from 0830-1130 where you and your mentor will work to meet your mission goals. Cyber defense is about digging into things, asking questions and exploring. This will be a closed network with limited access to the Internet to search for information to help you. At 1130, all the players will gather for lunch followed by lessons learned for the day’s events and a presentation from an industry expert speaker. Students will be dismissed daily between 2-3pm.

Team Leaders Below are the CyberThon team leaders. In the event you cannot attend a session, please notify your team lead. Blue Team 1 Anthony Pinto Blue Team 2 Eric Fildebrandt Blue Team 3 Ken Melton Blue Team 4 Kevin Schmidt Blue Team 5 Jim Rodgers Red Team (Bad Guys) Phillip Kidd Exercise Control Group Josh Wilson

National Flight Academy Map: Main Deck

National Flight Academy Map: Level 01

National Aviation Museum Deck Map

Special Guest Speakers

Commander Joseph Sears Commander Sears is a native of Lexington, KY and a 1989 graduate of the University of Kentucky receiving a B.A. in Political Science. He subsequently graduated from the Naval Postgraduate School where he earned his Masters of Science in Computer Science in 2004. Originally serving as a Cryptologic Collection Technician Collection (CTR), he completed initial training at Recruit Training Command, Great Lakes and Cryptologic Collection "A" School, Fort Devens, MA in 1991. He served his initial assignment at Naval Security Group Activity Misawa, Japan. In 1994, he reported to the USS GETTYSBURG (CG-64) as cryptologic analyst conducting operations in the Arabian Gulf, Mediterranean Sea and Caribbean Sea. In July 1996, Commander Sears commissioned as a Special

Duty Officer (Cryptology), now Information Warfare Officer. He was designated a Joint Qualified Officer after his joint tour at U.S. Cyber Command in 2013. Assignments have included: National Security Agency (NSA), Information Assurance (IA) Directorate as the Navy Advocate for Information Assurance; Pre-commissioning Detachment ROOSEVELT as the detachment Officer in Charge; USS ROOSEVELT (DDG-80) as the Signals Information Warfare Officer supporting Operation ENDURING FREEDOM and maritime interception operations; Navy Information Operations Command Suitland as the Advanced Projects & Demonstrations Deputy Department Head where he also earned his Certified Information System Security Professional (CISSP) certification; Commander, SEVENTH Fleet as the Cryptologic Resource Coordinator and Collection Manager; U.S. Cyber Command as an intelligence operations planner and Chief, Combat Targeting; and Navy Information Operations Command Maryland where he served as the N3/CTF 1060 Operations Officer directing cryptologic and cyber operations supporting fleet commanders worldwide. He currently serves as the Commanding Officer, Navy Information Operations Command Pensacola. Commander Sears' awards include the Defense Meritorious Service Medal, Meritorious Service Medal, Joint Commendation Medal, Navy and Marine Corps Commendation Medal (2), Joint Achievement Medal, Navy Achievement Medal (4), Good Conduct Medal, National Defense Medal, South West Asia Medal with Bronze Star, Global War on Terrorism Expeditionary medal, Global War on Terrorism Service Medal, Marksman Pistol (expert), and various unit and service awards.

John Felker

In August 2015, John Felker assumed day-to-day operation of the National Cybersecurity and Communications Integration Center (NCCIC) at DHS. The NCCIC is the U.S. government’s 24/7 hub for cybersecurity information sharing, incident response, and coordination. Prior to joining DHS, Felker served as Director of Cyber and Intelligence Strategy for HP Enterprise Services. During a 30-year career in the U.S. Coast Guard, Felker served, among other positions, as Deputy Commander of Coast Guard Cyber Command, where he was responsible for the day-to-day staff leadership and also for the stand-up of the Command. He also commanded the U.S. Coast Guard Cryptologic Group, which spanned subordinate units from Hawaii to Afghanistan

performing signals intelligence missions and developing Coast Guard signals intelligence capability. He also served as executive assistant to the Director of Coast Guard Intelligence where he coordinated Directorate activities within the National Intelligence Community management enterprise. His military awards include the Defense Superior Service Medal, the Legion of Merit and the Meritorious Service Medal. Felker graduated from Ithaca College with a Bachelor of Science in 1978 and earned his Master of Arts in Public Administration from the Maxwell School of Citizenship and Public Affairs at Syracuse University in 1995.

Gregory J. Touhill Brigadier General (retired) Gregory J. Touhill is

the Deputy Assistant Secretary for Cybersecurity

and Communications within the National

Protections and Programs Directorate (NPPD) of

the Department of Homeland Security (DHS),

where he focuses on the development and

implementation of operational programs

designed to protect our government networks and

critical infrastructure systems.

General Touhill retired from the U.S. Air Force

in July 2013 after a distinguished career

culminating as the Chief Information Officer and Director of Command, Control,

Communications, and Cyber Systems at U.S. Transportation Command—one of the nation’s 10

combatant commands. A highly decorated combat leader, he served as the United States Defense

Attaché to Kuwait and as the 81st Training Wing commander, where he established the Air

Force’s Cyberspace Operations training programs and led the $1 billion rebuilding of Keesler

AFB, Miss., in the aftermath of Hurricane Katrina.

General Touhill is a distinguished graduate of the Squadron Officer School, the Air Command

and Staff College, and the Advanced Communications Officer Training school, where he

received the Webb Award as the top graduate. He also is a graduate of the Air War College, the

Armed Forces Staff College, the Harvard University John F. Kennedy School of Government

Senior Executive Fellows program, and the University of North Carolina’s Logistics and

Technology Program for Executives.

General Touhill maintains the Certified Information Systems Security Professional (CISSP),

Certified Acquisition Professional, and the Master Professional Director certifications.

Rob Murphy Rob Murphy started learning about computers back in the days of the Tandy computer, Commodore 64, Apple IIe and programs that were written on numbered lines and saved to a cassette tape. Lesson learned: write code in increments of 10 or more, as there’s little room for error otherwise!

Never to take the easy way out, Rob enlisted in the United States Marine Corps after high school and eventually attended college and earned a commission as a Marine Officer. A major milestone for Rob in his Marine Corps career was being selected to attend the Naval Postgraduate School in Monterey, CA and receiving an MS in Information Technology Management. This two-year program provided numerous courses fueling his passion for computer security, ethical hacking and digital forensics.

Rob has spoken at a variety of conferences such as Defcon, DoD Cyber Crime Conference, USMC IA Conference, the NSA Red Team/Blue Team Symposium, MITRE IPv6 Symposium, Redstone Arsenal IA Conference, TechNet Mid-America and more.

Armed with a desire to teach, Rob can be found as a security consultant, mentor and adjunct professor developing and instructing courses in digital forensics and ethical hacking.

In 2014 Rob participated as part of the UMUC Cyber Padawans team that won the EC-Council Foundation Global Cyberlympics Competition in Barcelona, Spain. Rob spends his spare time as a competitor in various cyber security contests and as an architect of the warl0ck gam3z capture the flag competitions.

With over 25 years of experience and dabbling in the computer security world, Rob’s professional certifications include ISC2 CISSP, CompTIA Network+, Security+, CTT+ and EC-Council CEH, CHFI.

Follow Us!

Media Contacts: Tony Ferguson AFCEA/GBSI 850-450-2332 Sena Maddison FloridaWest 850-417-1500

www.facebook.com/CyberThonPcola/

www.facebook.com/afceapns/

www.facebook.com/NationalFlightAcademy/

@CyberThonPcola, #CyberThon, #CyberPcola

@ NatlFltAcademy