Will Shackleton, a University of Cambridge student and mobile app developer, took home the title after beating 41 other contestants. Shackleton, who is headed for a summer internship at Facebook, was the youngest contestant in the group.
The Cyber Security Challenge UK is a set of nationwide competitions to bring more talented people into the cybersecurity profession and address a critical skills shortage that affects government bodies, businesses and citizens alike. It began in 2010 as three competitions run by a small group of supporters from industry, government and academia to address the growing skills gap in the UK cybersecurity profession.
A realistic simulation was developed by cybersecurity experts from BT, GCHQ, the National Crime Agency (NCA), Juniper Networks and Lockheed Martin over the course of more than six months of planning. Meanwhile, the Challenge has been running virtual and face-to-face qualifying competitions for the past 12 months to identify the 42 finalists capable of taking on the final cyber battle.
The finalists were divided up into teams and informed of the scenario via a faux “breaking news report” describing a cyber-attack on London's financial district that was making online banking platforms inaccessible, new stock market floatations impossible and compromising BACS [payment] systems. Once the media report had concluded, the finalists were briefed by GCHQ and the NCA on their intelligence about the emerging threat.
While initially it seemed to be a DDoS attack, it turned out that a sophisticated ransomware campaign was at work, beginning with spearphishing emails with downloadable files or malicious links that, when executed, encrypted the contents of mission-critical networks. The class contestants managed to avert the worst-case aspect of the scenario, which was a catastrophic, life-threatening attack on a nuclear power plant.
"Through the National Cyber Security Programme, we are sponsoring initiatives to provide UK businesses with a competitive edge in cyberspace,” said Francis Maude, the Cabinet Office minister with responsibility for the UK cybersecurity strategy, in a statement. “To get ahead in the global race we need more people with the skills and abilities to protect businesses and meet the challenges of the future. The Cyber Security Challenge encourages talented people into cyber security careers, bringing together industry, security services and law enforcement to develop cyber battle competitions.”
The skills gap in the UK persists and is having real ramifications; a recent survey from PwC has revealed that 53% of UK and global companies are not equipped to deal with cyber-attacks, despite 58% indicating that they faced “substantial or critical” cybersecurity risks.
“This Masterclass is the biggest, most realistic and exciting cyber-defense simulation we have ever run,” said Stephanie Daman, CEO of Cyber Security Challenge UK. “The combination of government organizations, multinational technology and defense companies and one of the largest telecommunication companies in the world working together to secure the future of the profession makes [this] a really special occasion. We hope the excitement will not only inspire many of our hugely talented finalists to lend their skills to the cyber security profession, but also encourage many more people from across the UK to sign up with us and test their skills in next year's competitions."
Now in its fourth year, the Challenge has grown its range of competitions, incorporated a schools-specific challenge, and is now backed by over 75 sponsors from across government, industry and academia. With sponsor support, the Challenge has handed out over £200,000 of career-enabling prizes to more than 100 participants.