Dir. Competition Operations · of the appropriate Competition Staff, the Director of Competition Operations makes recommendations to the Commissioner on competition issues for consideration

CyberPatriot VI

www.uscyberpatriot.org

Competition Rules

The Air Force Association 1501 Lee Highway, Arlington, Virginia 22209-1198 (877)-885-5716 www.afa.org

http://www.afa.org/

CYBERPATRIOT VI COMPETITION RULES (CYBERPATRIOT RULES BOOK)

2

CyberPatriot Program Office Air Force Association

1501 Lee Highway Arlington, Virginia 22209-1198

October 5, 2013 This document serves as the official source of rules and regulations governing CyberPatriot. All registered CyberPatriot participants, to include Coaches, Mentors, and Competitors, are bound by the rules published in this document. A special thanks to the Coaches and Mentors of the CyberPatriot Rules Advisory Group who contributed to the CyberPatriot Rules Book. Their team-level insights and recommendations were fundamental to this document’s development. Their hours of review were critical to its publication. If the rules of the school or organization to which a team belongs are more restrictive than the CyberPatriot rules, then the school’s or organization’s rules will take precedence. Changes to this document will be posted on the CyberPatriot website and distributed via email to CyberPatriot Coaches. Submit recommendations for updates or changes to this document by email to the Director of Competition Operations, CyberPatriot Program Office. Address the email to [email protected] with the subject “Rules Book Recommendation.” The CyberPatriot Rules Book takes precedence over the Frequently Asked Questions document on the CyberPatriot website.

BERNARD K. SKOCH Commissioner CyberPatriot Air Force Association

mailto:[email protected]


3

How to Read the CyberPatriot Rules Book Figure 0-1. Topic Paragraph The CyberPatriot Rules Book is a paragraph-based document. The Rules Book format references rules by paragraph number, instead of page numbers. Paragraph numbering is displayed in Figure 0-1 and described below with the circled numbers in the figure. Topic Paragraph. The key to the paragraph system is the topic paragraph . The topic

paragraph heading is in BOLD UPPERCASE letters and numbered with four digits. The first digit is the chapter number. The remaining digits are the topic number. In the example topic paragraph , 5 is the chapter number and 006 is topic paragraph number of chapter 5. When referencing a topic

paragraph, all subparagraphs are included. Subparagraphs. Specific rules are found in the sub-paragraphs. Each subparagraph is referenced with the topic paragraph. The following are examples from Figure 0-1.

Paragraph 6006.1 Paragraph 6006.1.(a).(2) Paragraph 6006.1.(a) Paragraph 6006.2

1

2

3

4

5


4

TABLE OF CONTENTS

PARAGRAPH INTRODUCTION ............................................................................0001 CYBERPATRIOT PROGRAM OFFICE MISSION STATEMENT ..........0002 GUIDING AND OPERATING PRINCIPLES .......................................0003 COMPETITOR SAFETY AND PROTECTION .....................................0004 CHAPTER 1. CYBERPATRIOT ORGANIZATION AND RESPONSIBILITIES GENERAL ......................................................................................1001 COMPETITION STAFF ...................................................................1002 VERIFICATION OFFICIALS .............................................................1003 COMPETITION DIVISIONS .............................................................1004 NEW ORGANIZATIONS .................................................................1005 CYBERPATRIOT TEAM ORGANIZATION ........................................1006 COACH ..........................................................................................1007 COACH ALTERNATE ......................................................................1008 COMPETITORS ..............................................................................1009 TEAM CAPTAIN .............................................................................1010 MENTOR .......................................................................................1011 TEAM ASSISTANTS........................................................................1012 CYBERPATRIOT CENTER OF EXCELLENCE .....................................1013 CYBERPATRIOT RULES ADVISORY GROUP (CRAG) .......................1014 CHAPTER 2. COMPETITION OVERVIEW GENERAL ......................................................................................2001 COMPETITION SEASON ................................................................2002 REGISTRATION .............................................................................2003 ORIENTATION AND PREPARATION ..............................................2004 COMPETITION ROUNDS ...............................................................2005 THE NATIONAL FINALS COMPETITION .........................................2006 AWARDS PRESENTATION .............................................................2007 CHAPTER 3. REGISTRATION GENERAL ......................................................................................3001 COACH REGISTRATION .................................................................3002 TEAM SITE ....................................................................................3003 MENTOR AND TEAM ASSISTANT REGISTRATION ........................3004 COMPETITOR REGISTRATION .......................................................3005


5

TEAM REGISTRATION FEE ............................................................3006 CHAPTER 4. PREPARATION GENERAL ......................................................................................4001 TRAINING MATERIALS ..................................................................4002 TRAINING RECOMMENDATIONS .................................................4003 PRACTICE ROUNDS .......................................................................4004 TEAM COMPETITION SYSTEM SPECIFICATIONS...........................4005 ONLINE COACHES’ MEETINGS......................................................4006 CHAPTER 5. GENERAL RULES OF COMPETITION GENERAL ......................................................................................5001 COMPETITION WINDOW .............................................................5002 COMPETITION PERIOD .................................................................5003 REGISTERED COMPETITORS .........................................................5004 NO OUTSIDE ASSISTANCE ............................................................5005 ONE INSTANCE PER COMPETITION IMAGE AND SOFTWARE ......5006 SHARING OF COMPETITION IMAGES, SOFTWARE, AND INFORMATION .....................................................................5007 TEAM IDENTIFICATION (TEAM ID) REQUIRED .............................5008 INTERNET RESOURCES ...............................................................5009 PRINTED MATERIAL ......................................................................5010 ELECTRONIC MEDIA AND COMMUNICATION DEVICES ...............5011 SOFTWARE TOOLS ........................................................................5012 OFFENSIVE ACTIVITY AND TAMPERING .......................................5013 OUTSTANDING INVOICE ..............................................................5014 OVERSIGHT ...................................................................................5015 ALTERNATE COMPETITION DATES ...............................................5016 INQUIRIES .....................................................................................5017 PENALTIES ....................................................................................5018 APPEALS .......................................................................................5019 SCORE CORRECTION REQUESTS ...................................................5020 CHAPTER 6. ONLINE ROUNDS GENERAL ......................................................................................6001 QUALIFICATION ROUNDS .............................................................6002 SEMIFINALS ..................................................................................6003 STATE RECOGNITION ROUND ......................................................6004 REGIONAL RECOGNITION ROUND ...............................................6005 COMPETITION REQUIREMENTS ...................................................6006 COMPETITION COMMUNICATION ...............................................6007


6

COMPETITION EVENTS .................................................................6008 TECHNICAL SUPPORT ...................................................................6009 COMPETITION AREA ....................................................................6010 CHAPTER 7. THE NATIONAL FINALS COMPETITION GENERAL ......................................................................................7001 GROUPS ........................................................................................7002 COMPETITION EVENTS .................................................................7003 INTERNATIONAL TEAMS ..............................................................7004 MIDDLE SCHOOL DIVISION (PILOT) ..............................................7005 CHAPTER 8. SCORING AND ADVANCEMENT GENERAL ......................................................................................8001 SCORING .......................................................................................8002 ADVANCEMENT ............................................................................8003 RESULTS PUBLICATION ................................................................8004 CHAPTER 9. AWARDS GENERAL ......................................................................................9001 AWARD AUTHORITIES ..................................................................9002 TYPES OF AWARDS .......................................................................9003 THE NATIONAL FINALS COMPETITION AWARDS .........................9004 REGIONAL AWARDS .....................................................................9005 STATE AWARDS ............................................................................9006 SEMIFINALS RECOGNITION ..........................................................9007 CYBERPATRIOT COACHES AND MENTORS OF THE YEAR .............9008 REGION, STATE, AND LOCAL AWARDS PRESENTATIONS .............9009


7

APPENDICES 1. CYBERPATRIOT COACHES’ AGREEMENT ................................I 2. CYBERPATRIOT STANDARDS OF CONDUCT ............................II 3. SAFETY ...................................................................................III 4. APPEAL AND SCORE CORRECTION REQUEST FORMATS ........IV 5. CYBERPATRIOT MEDIA GUIDELINES .......................................V 6. SPONSORS AND SPONSORSHIP ..............................................VI 7. TECHNICAL SUPPORT .............................................................VII 8. CYBERPATRIOT COMPETITOR CODE OF CONDUCT ................VIII 9. COACH ALTERNATE REQUEST ................................................IX 10. HOME SCHOOL PARENTAL/GUARDIAN APPROVAL FOR CYBERPATRIOT COACH ..................................................X 11. CYBERPATRIOT CENTERS OF EXCELLENCE PROGRAM ...........XI FIGURES 1-1 PROGRAM OFFICE ORGANIZATIONAL STRUCTURE 1-2 COMPETITION ORGANIZATION 1-3 CYBERPATRIOT TEAM 2-1 CYBERPATRIOT COMPETITION SEASON 3-1 COACH REGISTRATION PROCESS 3-2 MENTOR REGISTRATION PROCESS 3-3 COMPETITOR REGISTRATION PROCESS 4-1 MICROSOFT DREAMSPARK WEBSITE 6-1 COMPETITION SYSTEM SCHEDULE 6-2 COMPETITION EMAIL 6-3 IMAGE DELIVERY PROCESS 8-1 CYBERPATRIOT REGIONS 8-2 COMPETITION ADVANCEMENT FLOW 9-1 OVERALL AWARDS

9-2 SERVICE AWARDS


8

(THIS PAGE IS INTENTIONALLY BLANK.)


9

INTRODUCTION PARAGRAPH INTRODUCTION .....................................................................................................................................0001

CYBERPATRIOT PROGRAM OFFICE MISSION STATEMENT ...................................................................0002

GUIDING AND OPERATING PRINCIPLES ................................................................................................0003

COMPETITOR SAFETY AND PROTECTION ..............................................................................................0004


10

0001. INTRODUCTION. The Air Force Association’s (AFA) CyberPatriot Program operates under the premise that all Competitors, Coaches, and Mentors conduct themselves with the highest integrity. To prevent the perception of misconduct that could jeopardize the integrity of the competition, The CyberPatriot Competition Rules (Short Title: The CyberPatriot Rules Book) has been established for the CyberPatriot competition. 0002. CYBERPATRIOT PROGRAM OFFICE MISSION STATEMENT. The mission of CyberPatriot is to attract high school and middle school students to education and careers in science, technology, engineering, and math (STEM). 0003. GUIDING AND OPERATING PRINCIPLES. How well the CyberPatriot competition is executed depends on the individual and collective values, beliefs, and principles of our participants. Since the competition is decentralized, we use the following guiding and operational principles to execute the CyberPatriot competition. 1. GUIDING PRINCIPLES. Our actions and decisions concerning the competition are guided by the following principles. a. Integrity. The foundation of the CyberPatriot competition is the integrity of those administering and competing. We follow the rules and spirit of CyberPatriot in the absence of supervision.

b. Excellence. The CyberPatriot competition promotes excellence among Competitors. We set the conditions for our Competitors to do their best in the competition and beyond.

c. Service. The spirit of CyberPatriot is dependent on the ethos of “service before self” as demonstrated by the CyberPatriot Program Office, Competition Staff, Coaches, and Mentors. We put the well-being and education of the Competitors ahead of our own concerns in preparation for and during the CyberPatriot competition. 2. OPERATING PRINCIPLES. To support the guiding principles, the competition will operate under the following principles. a. Competitor Safety and Protection. Since the vast majority of CyberPatriot Competitors are minors, we take great effort to ensure their safety and protection. Competitor safety and protection are the highest priority of the competition.

b. Fairness. The CyberPatriot Program Office Staff and participants will strive to ensure that the competition is conducted fairly. The Commissioner, CyberPatriot will rule on cases not covered by the CyberPatriot Rules Book or in extreme circumstances.

c. Coaches Are the Cornerstone of the Competition. Due to the nature of online competitions, team Coaches are charged with ensuring that participants follow the rules.


11

d. Privacy of Competitors. Personal information, such as email addresses of Competitors, will be protected by staff and participants who have access to the information. Names of the participants will be published when associated with their team or photographs unless a participant specifically requests that it not be published. Media releases are required for participation in The National Finals Competition.

e. Two-Way Communication. To ensure an efficient competition, the CyberPatriot Program Office Staff and Coaches shall communicate on issues regarding competition. Monthly Online Coaches’ Meetings are one means of two-way communication.

f. Cyber Citizenship. CyberPatriot participants promote good cyber citizenship. Cyber defense is the focus of the CyberPatriot competition. Ethical and safe uses of the Internet are lessons taught to our Competitors. The CyberPatriot competition is not a hacking competition nor does it teach or tolerate hacking. Hacking in the CyberPatriot program is defined as the unauthorized entry, use, or modification of a computer, system, or network by a person, persons, or tools. 0004. COMPETITOR SAFETY AND PROTECTION. Competitor safety and protection must be continuously emphasized. It is our first and most important operating principle. By definition, the CyberPatriot Program involves minors under the age of 18. It is the Coach’s responsibility to ensure the safety and protection of his or her team while involved in CyberPatriot activities. The responsibility includes the team operating in a safe environment that provides protection from unauthorized individuals, ensures appropriate online activity, and involves suitable facility safety and security. In the event that an incident occurs involving the protection or safety of a Competitor, the Coach has the obligation to follow local procedures of reporting the incident to local authorities and stop or mitigate the incident immediately. (See Appendix III for details.)

It is for this reason that Verification Officials are required for all prospective Coaches. If a Verification Official becomes aware of facts or circumstances that call into question the fitness of a Coach to continue to supervise Competitors, he or she should notify the CyberPatriot Program Office immediately.


12



13

CHAPTER 1 CYBERPATRIOT ORGANIZATION AND RESPONSIBILITIES PARAGRAPH GENERAL ...............................................................................................................................................1001 COMPETITION STAFF ............................................................................................................................1002 VERIFICATION OFFICIALS ......................................................................................................................1003 COMPETITION DIVISIONS ......................................................................................................................1004

NEW ORGANIZATIONS ..........................................................................................................................1005

CYBERPATRIOT TEAM ORGANIZATION .................................................................................................1006

COACH ...................................................................................................................................................1007 COACH ALTERNATE ...............................................................................................................................1008 COMPETITORS .......................................................................................................................................1009 TEAM CAPTAIN ......................................................................................................................................1010 MENTOR ................................................................................................................................................1011 TEAM ASSISTANTS.................................................................................................................................1012 CYBERPATRIOT CENTERS OF EXCELLENCE ............................................................................................1013 CYBERPATRIOT RULES ADVISORY GROUP (CRAG) ................................................................................1014

FIGURES 1-1 PROGRAM OFFICE ORGANIZATIONAL STRUCTURE 1-2 COMPETITION ORGANIZATION 1-3 CYBERPATRIOT TEAM


14

1001. GENERAL. The CyberPatriot Program is organized to administer and conduct the National High School Cyber Defense Competition. Persons involved in CyberPatriot are divided into the following personnel groupings. 1002. COMPETITION STAFF. The Competition Staff is a grouping that includes all members of the CyberPatriot Program Office, the CyberPatriot Operations Center (CPOC) staff, The National Finals Competition Administration Teams (e.g., Green, Red, White, etc.), and any other support staff. 1. CyberPatriot Program Office. The CyberPatriot Program Office is the AFA department responsible for the organizing and administering the CyberPatriot Program. Listed below are the responsibilities of the CyberPatriot Program Office staff. a. Commissioner, CyberPatriot. The Commissioner, CyberPatriot is accountable to the AFA President for the operation of the CyberPatriot Program. b. Director, Competition Operations. The Director of Competition Operations is responsible to the Commissioner, CyberPatriot for the conduct and oversight of the competition and is the direct interface between the teams and the Commissioner, CyberPatriot. Based on the advice of the appropriate Competition Staff, the Director of Competition Operations makes recommendations to the Commissioner on competition issues for consideration. During competition, the Director provides Tier 2 technical support. c. Manager, Competition Systems and Cyber Training. The Manager, Competition Systems and Cyber Training is responsible for the setup, operation, and coordination of all electronic systems that support the competition and provides Tier 3 technical support. The Manager assists the Director of Competition Operations with oversight of the competition. d. Competition Operations Coordinator. The Competition Operations Coordinator is responsible to the Manager, Competition Systems and Cyber Training for the setup, operation, and coordination of all electronic systems that support the competition and provides Tier 3 technical support. The Coordinator assists the Director of Competition Operations with oversight of the competition.

e. Manager, Program Administration and Competition Events . The Manager, Program Administration and Competition Events is responsible for participant registration and administration and logistics coordination for The National Finals Competition. The Manager provides Tier 2 technical support for the online competition rounds. f. Middle School and Registration Coordinator. The Middle School and Registration Coordinator is responsible to the Manager, Program Administration and Competition Events for middle school program administration, participant registration and administration, and logistics coordination for The National Finals Competition and other events. The Coordinator provides Tier 2 technical support for the online competition rounds.


15

g. Sponsorship and Outreach Coordinator. The Sponsorship and Outreach Coordinator is responsible for assisting the Commissioner with administration, sponsorship, and outreach and provides Tier 2 technical support for the online competition rounds.

Figure 1-1. Program Office Organizational Structure

2. CyberPatriot Operations Center (CPOC). Co-located with the CyberPatriot Program Office, the CPOC provides Tier 1 helpdesk support for CyberPatriot online competitions. The CPOC reports to Director, Competition Operations and coordinates with the Manager, Competition Systems and Cyber Training. The CPOC is established only during CyberPatriot online rounds of competition and may be reached at: 1-877-885-5716 or by Tech Support Chat (see Appendix VII). The CPOC consists of the following personnel.

a. CPOC Staff. The CPOC is normally staffed by temporary staff. Watches are scheduled for times of historically high competition activity during the online rounds of competition.


16

b. CPOC Coordinator. The CPOC Coordinator is the lead CPOC staff member and coordinates watch operations with the CyberPatriot staff. The duties of the CPOC Coordinator include administration of the watch, consolidation of trouble tickets, and trend analysis.

1003. VERIFICATION OFFICIALS. Competitor safety and protection are the highest priorities of the CyberPatriot Program. Verification officials perform the critical function of vetting Coaches for CyberPatriot. The Verification Official’s roles are to: 1. Validate a Coach’s status as a school employee, school district-approved volunteer, or a person with an approved relationship with a school or member of a unit, squadron or other organization for each team a Coach registers.

2. Verify the fitness of individuals to serve as Coaches and to work unsupervised with minors. 3. Immediately notify the CyberPatriot Program Office if facts or circumstances call into question the fitness of a Coach to continue to supervise Competitors. 1004. COMPETITION DIVISIONS. For competition purposes, CyberPatriot teams are divided into three Divisions: Open, All Service, and Middle School (Pilot). The Divisions are administrative with no organization to support them separately. Rules of competition apply equally to the teams in all Divisions. Teams compete only in their Division. CyberPatriot does not conduct inter-Division competition. 1. Open Division. The Open Division was created to give all enrolled high school and senior high school students the opportunity to participate in the CyberPatriot competition. a. Organizations The following schools and organizations may field teams in the Open Division. (1) Public Schools (6) Charter Schools (2) Parochial Schools (7) State-Chartered Virtual Schools (3) Home Schools (8) Scouting Units (4) Private Schools (9) Other Organizations approved by the Commissioner, (5) Magnet Schools CyberPatriot b. Regions. CyberPatriot Regions will only be used as competition entities during the Regional Recognition Round for both the Open and All Service Divisions.


17

Figure 1-2. Competition Organization 2. All Service Division. When CyberPatriot began, the Air Force Association (AFA) reached out through its connections to Civil Air Patrol (CAP) and Air Force Junior Reserve Officer Training Corps (JROTC) units to find students willing to try the competition as a proof of concept. The All Service Division grew from that initial association. Organizations in the All Service Division have entered into memoranda of agreement with AFA that governs their participation in CyberPatriot. a. Organizations. The following organizations field teams in the All Service Division. (1) Army JROTC (4) Air Force JROTC (2) Navy JROTC (5) Civil Air Patrol (CAP) (3) Marine Corps JROTC (6) U.S. Naval Sea Cadet Corps (USNSCC)


18

b. Competition Categories. All Service Division teams compete within their individual categories (i.e., service JROTC, CAP, USNSCC), similar to the divisions in major league sports. 3. Middle School Division (Pilot). The Middle School Division was created to provide enrolled middle school and junior high school students the opportunity to participate in the CyberPatriot competition. The Middle School Division is a pilot program for CyberPatriot VI. There is not an All Service Division equivalent or subdivisions in the Middle School Division. Teams will compete only against each other. Unless specifically approved by the Commissioner, Middle School Division teams may only participate in the following rounds of competition. a. Limited Online Rounds of Competition. Middle School Division Teams will participate fully in the following rounds of competition. (1) Practice Round (2) Qualification Rounds (3) Semifinals (if advanced) b. The National Finals Competition. If advanced to The National Finals Competition, Middle School Division Teams shall participate in events prescribed by the Commissioner. 1005. NEW ORGANIZATIONS. At the discretion of the Commissioner, CyberPatriot, other organizations may be approved to participate in CyberPatriot. Requirements for participation are: 1. Charter. The organization shall have a charter. 2. Mission and Purpose. The organization’s mission and purpose shall be consistent with the principles and values of the CyberPatriot Program and AFA. 3. Designated Official Leader. The organization shall have a leader who is accountable for the organization and is authorized to designate adults to have unsupervised access to minors in the organization. 4. Formal Youth Program. In its charter, the organization shall have a youth program that includes high school-level students. 5. Minor Protection Policy. The organization shall have an official policy for the protection and safety of minors. 6. Minor Protection Training Requirement. Mandatory and formal training shall be required for adults who have unsupervised access to minors. 1006. CYBERPATRIOT TEAM ORGANIZATION. The CyberPatriot teams are the basic organization for competition. Each team consists of the following members.


19

1. Coach (1 per team) 2. Competitors (Roster of up to 10 total, only five may compete at any one time during a competition round. Members not competing may not assist the team.) 3. Team Captain (1 per team, selected from Competitors at discretion of the Coach) 4. Mentor(s) (no limit) 5. Team Assistant(s) (no limit) Note: There is no requirement of U.S. citizenship for participation in CyberPatriot. 6. CYBERPATRIOT TEAM IDENTIFICATION. For official purposes, team identification is standardized to recognize teams, assign scores, maintain anonymity, and avoid misunderstandings in communication. Teams are identified as follows: a. Team Numbers. Team numbers are assigned by the CyberPatriot Program Office at registration and are the primary means to identify a team for competition purposes. Scores are published with team numbers. b . Organization Names. The official name of a team is its school or organization name. Teams belonging to a school, including JROTC units, are identified by school name. Other teams, such as CAP and USNSCC units, are identified by organization name. Organization names may be appended or modified by the CyberPatriot Program Office if they have similar names or the same Coach. Composite teams will have an organization name approved by the authority that approved the compositing of schools or organizations. c. Unofficial Team Names. Teams can create a pseudonym to identify themselves at any time. The names must be in good taste and are subject to veto by the CyberPatriot Program Office. Team names are optional and will not be used to officially identify teams. The CyberPatriot Program Office will collect team names from teams advancing to The National Finals Competition for placement on their team placards. d. Anonymity. Except for the following exceptions, when information related to a team’s performance (e.g., scores, rankings, advancement) is published, the team will remain anonymous, except for its team number. (1) Exceptions. There are two exceptions to the anonymity rule: the Post-Qualification Rounds and The National Finals Competition. (a) Post-Qualification Rounds. Teams that advance to the Semifinals and the top three teams in the State and Regional Recognition Rounds will have their organization names


20

published by the CyberPatriot Program Office along with the team’s Coach’s name. Team scores will not be associated with the school names. (b) The National Finals Competition. Teams that advance to The National Finals Competition will have the following information published without associated scores: - School/Organization Name - Team Name - Coach’s Name - Competitors’ Names The top three teams in each division will have their school names and rankings published by the CyberPatriot Program Office. Competitors of teams that receive awards will have their names published with the associated awards. All International Exhibition teams are identified when they compete in The National Finals Competition. e. Publication. The names of teams as well as their team members that advance to The National Finals Competition may be published in CyberPatriot documents to include: (1) The CyberSentinel, the official CyberPatriot newsletter (2) The CyberPatriot website: www.uscyberpatriot.org (3) The National Finals Competition program (4) Media releases (5) Communications to sponsors (6) Communications to government officials (7) CyberPatriot Facebook and Twitter sites

1007. COACH. CyberPatriot requires an adult to register as a team Coach before any students are permitted to register or compete. Having an adult Coach of record for each team is a non-negotiable requirement. A team shall have one, and only one, Coach of record at any time. An adult may coach up to three teams, but is responsible for the proper adult supervision of their teams during all CyberPatriot related activities. A Coach may assist other teams, but only as a registered Mentor or Team Assistant for the other teams. 1. Eligibility Requirements. CyberPatriot Coaches must meet the following requirements. a. Adult over 18 years of age. b. Not a Competitor or high school-level student. c. Not a member of the CyberPatriot Program Office. d. Be vetted and approved to work with minors by a Verification Official. e. Registered as the Coach for three teams or fewer. f. Agrees to abide by the CyberPatriot Coaches’ Agreement and Standards of Conduct. (See Appendices I and II.) 2. Additional Requirements for Certain Coaches. Additional requirements exist for certain types of Coaches. See below for these cases.

http://www.uscyberpatriot.org/


21

a. Employees of Sponsors and Founding Partners. An employee of a CyberPatriot sponsor or founding partner shall only be a Coach with the consent of the sponsor’s or founding partner’s designated CyberPatriot representative. Since the employee will be registered as a Coach for a school, CAP, USNSCC, or other organization, they are subject to the same vetting process as other Coaches.

b. Civil Air Patrol. CAP Coaches shall be verified by their CAP squadron commander or an officer higher in their chain of command and shall meet all of the following requirements: (1) A Senior Member in good standing with Civil Air Patrol. (2) Completed appropriate cadet protection program training (CPPT). (3) Authorized by their chain of command to have unsupervised access to cadets who are minors. c. U.S. Naval Sea Cadet Corps. U.S. Naval Sea Cadet Corps Coaches shall be verified by their Regional National Headquarters Representative or an officer higher in their chain of command and shall meet the following requirements. (1) An adult member in good standing with the U.S. Naval Sea Cadet Corps. (2) Completed appropriate cadet protection training. (3) Authorized by their chain of command to have unsupervised access to cadets who are minors. d. Home Schools (1) In areas where home schools are subject to local school board or other governmental oversight, Coaches of home school teams shall be verified by a school official or a home school teacher who can be verified by a legally recognized agency that accredits or otherwise approves home school programs. (2) At a minimum the home school team Coach shall meet the following requirements: (a) Authorized by their regulating agency and the students’ parents to have unsupervised access to team members who are minors. (b) Coaches of teams with home school participants shall retain written and signed parental consent forms for minor team members (See Appendix X) for the entire season. (c) Complete a certified youth protection program such as the free Boy Scouts of America’s Youth Protection Training at: www.myscouting.org. e. Other Organizations. Coaches of other organizations shall be verified by their organization’s appropriate official that the Coach meets all of the following requirements.

http://www.myscouting.org/


22

(1) A member in good standing with the organization. (2) Completed appropriate minor or youth protection training. (3) Authorized by their organization to have unsupervised access to members who are minors. 3. Coach Responsibilities a. Competitor Protection. The Coach’s responsibility includes controlling access to minor students in a way that protects them, respects parental prerogatives, and follows legal requirements. Additionally, a Coach shall be:

(1) Accountable for the interaction of Mentors and Team Assistants with the Competitors. (2) Responsible for Competitor safety and protection for all the competition training, events, and rounds. b. Competition Integrity. Ensuring competition integrity is essential to the fairness of the competition. Once the competition begins, the Coach must ensure that their Competitors receive no outside assistance to include assistance from Mentors and Team Assistants and asking questions on forums or other websites. The Coach may continue to provide clarification of rules and permissible actions per this document. The Coach upholds the guiding and operating principles of the competition at the team level.

c. Official Point of Contact. The Coach is the official point of contact for a team. Official CyberPatriot correspondence is emailed to Coaches, who may disseminate it to their teams. It is essential that Coaches monitor their email for up-to-date information because Competitors will not receive it directly from the CyberPatriot Program Office. It is therefore important that Coaches ensure they are capable of receiving messages from the CyberPatriot Program Office ([email protected]) through their chosen email domains. The role of official point of contact may not be delegated to a Mentor, unless the Mentor is appointed as a Coach Alternate (below). 4. No Compensation. Coaches positions are voluntary and do not receive compensation. AFA has no position with respect to gifts received by our volunteers. 1008. COACH ALTERNATE. If a Coach is not available to receive email and supervise a round of competition, then a Coach Alternate may be nominated to the CyberPatriot Program Office for approval, on a case-by-case basis. The Coach Alternate will only act as the Coach for the approved round of competition and not substitute for the Coach during future rounds of competition without going through the approval process again (see Appendix IX). However, the Coach Alternate shall be vetted and approved by the Coach’s school or organization Verification Official before he or she is approved by the CyberPatriot Program Office. Coaches will receive a Coach Alternate Request link in the competition emails.



23

Figure 1-3. CyberPatriot Team 1009. COMPETITORS. A CyberPatriot team consists of a maximum of 10 registered Competitors. A registrant becomes a Competitor when they receive consent to compete from a parent or legal guardian. During competition, two to five Competitors may compete at a time. Substitution of team members is at the Coach’s discretion during the online rounds of competition. Special rules apply for substitution during The National Finals Competition. A Competitor shall compete on only one team during a CyberPatriot season. 1. Requirements a. Eligibility. Competitors shall meet all of the following eligibility requirements to compete in CyberPatriot. (1) High School and Senior High School. A Competitor shall be enrolled in a high school or senior high school program (or equivalent if home schooled/in a school that does not make this


24

distinction) as defined by the state in which the students are located for the duration of the competition season. (2) Middle School and Junior High School. A Competitor shall be enrolled in a middle school or junior high school program, as defined by the state or school district in which the students are located, throughout the competition season to compete in the Middle School Division (Pilot). Home schools organizations, CAP squadrons, USNSCC units, and other organizations may field middle school teams if ALL members of the team are enrolled in the equivalent of a middle school or junior high school program. Note: Competitors may compete every season in which they are eligible. b. Open Division Competitors. All Open Division team members shall be currently enrolled in the school or organization sponsoring the Open Division team throughout the competition season (1) Any Competitor in the Open Division may be a team member of only one team, even if he or she is involved in another organization fielding a team. (2) A JROTC, CAP, or USNSCC cadet may compete on an Open Division team if they are not a member of an All Service Division team. A JROTC, CAP, or USNSCC cadet competing on an Open Division Team will not be identified as a member of the JROTC, CAP, or USNSCC. (3) Composite Team. The Commissioner, CyberPatriot may consider the creation of a composite team from more than one school or organization under the following conditions: (a) The schools’ or organizations’ sizes do not support a full CyberPatriot team. (b) The schools or organizations are not fielding CyberPatriot teams. (c) The Competitors belong to a common legally recognized entity, such as a school district, non-profit organization, or municipality. (d) An official from the common legally recognized entity approves the composite team. c. All Service Division Competitors. Competitors on teams in the All Service Division shall be currently enrolled in the respective JROTC, CAP, or USNSCC program before participating in any competition round. (1) All Competitors on an All Service Division team shall be members of the same unit except in cases when the Commissioner approves a composite team to organize and compete. An All Service Division unit is defined as a JROTC Unit, CAP Squadron, and USNSCC Unit.


25

(2) Composite Team. The Commissioner, CyberPatriot may consider the creation of a composite team from more than one unit under all of the following conditions. Organizational chain of command requirements apply. (a) The units’ sizes do not support a full CyberPatriot team. (b) Units to which the Competitors belong are not fielding CyberPatriot teams. (c) The first common senior in the chain of command approves the composite team (e.g., CAP Group Commander, USNSCC Regional Captain). (d) The organization’s National Headquarters CyberPatriot Representative concurs with the creation of the composite team (e.g., Service JROTC Headquarters, CAP National Headquarters, and USNSCC National Headquarters.). 2. Responsibilities. It is responsibility of Competitors to abide by the CyberPatriot Competitor Code of Conduct (see Appendix VIII). 1010. TEAM CAPTAIN. Each Coach shall designate a Competitor as Team Captain for the online competition rounds. Since the Coach and Mentor(s) are not directly involved in competition rounds, the team captain oversees and directs the team’s competition efforts. 1011. MENTOR. A Mentor, also known as a Technical Mentor, is a technical advisor registered with the CyberPatriot Program Office. One or more registered Mentors may be chosen by a Coach to assist with a CyberPatriot team. Teams are not required to have a Mentor, as a Coach may act in the combined role of a Coach and Mentor. A Mentor’s interaction with the team is the responsibility of the Coach.

1. Eligibility. Mentors shall meet all of the following eligibility requirements.

a. Agree to abide by the CyberPatriot Standards of Conduct. (See Appendix II.) b. Be at least 18 years of age on or before the last day of Coach registration. c. Successfully pass a CyberPatriot Program Office background investigation. d. Accept by the team’s Coach, at the Coach’s sole discretion. e. Not be a Competitor. f. Not be enrolled in a high school program. 2. Responsibilities. Mentors shall follow the CyberPatriot Program’s guiding and operating principles and are responsible for: a. Advising the team’s Coach on skills status. b. Developing, with the Coach’s guidance, a plan to teach cyber defense skills and ethics. c. Teaching and assisting Competitors with cyber skills and ethics.


26

d. Meeting with the team only with the Coach’s approval. e. NOT teaching hacking skills or offensive cyber tactics to Competitors. 3. Coaches as Mentors. A Coach may be a Mentor for other teams only if he or she is also registered as a Mentor. Coaches not registered as a Mentor are ineligible for Mentor awards. 4. No Compensation. Mentor positions are voluntary and do not receive compensation. AFA has no position with respect to gifts received by our volunteers. 1012. TEAM ASSISTANTS. Coaches may have one or more adult Team Assistants who provide non-technical support and encouragement to the team, such as assisting with set-up, snacks, and transportation. Team Assistants are required to register on the CyberPatriot website and pass a background check, as they will be working with minors. After passing the background check, Team Assistants can then be linked to the appropriate team. 1. No Compensation. Team Assistant positions are voluntary and do not receive compensation. AFA has no position with respect to gifts received by our volunteers. 1013. CYBERPATRIOT CENTERS OF EXCELLENCE. CyberPatriot Centers of Excellence (COEs) are recognized as leading institutions and organizations in promoting STEM and cyber education. For more information see Appendix XI. 1014. CYBERPATRIOT RULES ADVISORY GROUP (CRAG). The CyberPatriot Rules Advisory Group advises the Director of Competition Operations on competition rules and processes. Coaches and Mentors of different levels of CyberPatriot experience are invited to join the group to provide a depth of opinions of various subjects.


27

CHAPTER 2 COMPETITION OVERVIEW

PARAGRAPH GENERAL ..............................................................................................................................................2001 COMPETITION SEASON ........................................................................................................................2002 REGISTRATION .....................................................................................................................................2003 ORIENTATION AND PREPARATION ......................................................................................................2004 COMPETITION ROUNDS .......................................................................................................................2005 THE NATIONAL FINALS COMPETITION ..................................................................................................2006 AWARDS PRESENTATION ......................................................................................................................2007 FIGURES 2-1 CYBERPATRIOT COMPETITION SEASON


28

2001. GENERAL. This chapter provides an overview of the major events that occur over the course of the CyberPatriot competition season. 2002. COMPETITION SEASON. The CyberPatriot competition season is a year-long process that begins with registration in April and ends with The National Finals Competition. Seasons are identified with Roman numerals (e.g., CyberPatriot VI).

Figure 2-1. CyberPatriot Competition Season 2003. REGISTRATION. The first event of the competition season is registration. It is fundamental to the competition. Participants must be registered to compete in CyberPatriot. Registered participants will receive a CyberPatriot participant kit. 2004. ORIENTATION AND PREPARATION. Teams may prepare for competition at any time. The following resources are available to assist teams in their orientation and preparation for competition. (See Chapter 4 for details.)


29

1. Training Materials. Free training materials are posted on the CyberPatriot website and will be updated as needed. 2. Exhibition Rounds. The purpose of the Exhibition Rounds is to orient new and potential CyberPatriot participants. The round images and tasks are basic, and scores do not count toward ranking or awards. 3. Practice Rounds. Teams can practice with images similar to those in the scored competition during two practice rounds that will be held before both Round 1 and the Regional Recognition Round. 4. Online Coaches’ Meetings. Monthly Online Coaches’ Meetings are held by the CyberPatriot Program Office to provide information on training, administration, and technical issues to new and seasoned participants. 2005. COMPETITION ROUNDS. The competition round is the phase of the competition season in which a competition division competes. A competition round is synonymous with the term “round.” Online competition rounds are three days in duration and are normally scheduled for Fridays, Saturdays, and Sundays in the U.S. Eastern Time Zone. 1. Types of Competition Rounds. CyberPatriot conducts online and in-person competition rounds at the national, regional, and state levels. Each round is progressively more difficult than the previous round. The rounds are divided into the following types: a. National-Level Competition Round Participants (1) Qualification Rounds (Rounds 1 & 2) (Online) All Teams (2) Semifinals (Online) Semifinalists (3) The National Finals Competition (In-Person) National Finalists International Exhibition Teams b. State and Regional-Level Competition Round Participants (1) State Recognition Round (Online) All Teams except National Finalists and Middle School Division (2) Regional Recognition Round (Online) Top State Teams

2. Competition Time Frames a. Competition Window. The time in which a team may compete in a competition round. A competition round may have one or more competition windows.


30

b. Competition Period. A contiguous period of time within a competition window in which a team actually competes. During online competition, the competition period is six consecutive hours, and it is the responsibility of the team to ensure that they do not exceed this time limit.

2006. THE NATIONAL FINALS COMPETITION. The final event of the competition season is The National Finals Competition. It is the highest level of competition in CyberPatriot. Open Division and Middle School Division National Finalist teams are provided transportation, meals, and lodging for the event. All Service Division and International National Finalist teams are provided their transportation, meals, and lodging per their memorandum of agreement with the CyberPatriot Program Office. 2007. AWARDS PRESENTATION. Awards to teams and individuals are presented at The National Finals Competition, AFA Convention, and locally.


31

CHAPTER 3 REGISTRATION

PARAGRAPH GENERAL ..............................................................................................................................................3001 COACH REGISTRATION .........................................................................................................................3002 TEAM SITE ............................................................................................................................................3003 MENTOR AND TEAM ASSISTANT REGISTRATION.................................................................................3004 COMPETITOR REGISTRATION ...............................................................................................................3005 TEAM REGISTRATION FEE .....................................................................................................................3006 FIGURES 3-1 COACH REGISTRATION PROCESS 3-2 MENTOR REGISTRATION PROCESS 3-3 COMPETITOR REGISTRATION PROCESS


32

3001. GENERAL. Registration begins in April and ends before the first competition round, as designated by the CyberPatriot Program Office. Coaches, Competitors, Mentors, and Team Assistants register online at www.uscyberpatriot.org. The Competitor Relationship Management (CRM) System is the program used for registration and is accessed through the CyberPatriot website. (See Chapter 1 for details on registration requirements.) 3002. COACH REGISTRATION. Coach registration begins the registration process. a. Only Coaches may register teams. They may register Competitors after they are validated by their Verification Official and approved by the CyberPatriot Program Office. b. PRE-REGISTRATION. Teams may pre-register for the next CyberPatriot competition season in January. Pre-Registration allows teams to enjoy registration benefits, such as the Exhibition Rounds and other special events, without having to register after the present season has ended. c. Coaches of Multiple Teams. An adult may register as a Coach for up to three CyberPatriot teams from the same or different schools, organizations, or Divisions under the following conditions: (1) No Transfer of Competitors between Teams. Coaches shall not transfer Competitors between their teams after the close of student registration. All Competitors shall be registered before Round 1. (2) Verification. Verification officials shall separately verify a Coach for each registered team. This will require timely response by the Verification Official for up to three separate verification emails. (3) Organization Name. Coaches shall enter a dash followed by a unique identifier at the end of each team’s organization name. If a Coach has already registered one or more teams without an identifier at the end of its organization name, then the Coach shall add identifiers to organization names for all subsequent registered teams. The following are examples of unique organization names. - E. C. Walczak High School - 1 - Smithville Cadet Squadron – Alpha Flight - E. C. Walczak High School - 2 - Smithville Cadet Squadron – Bravo Flight - B. Dalton High School - Cyber Kidz - B. Dalton High School - Trons (4) Unique Email Address. Registration for each team requires a unique email address that may be an alias. If an individual wants to coach three teams, he or she must have three separate email aliases or accounts from which he or she can regularly access (and respond to) team instructions and other information throughout the competition season.


33

3003. TEAM SITE. After a Coach is approved by the CyberPatriot Program Office and the team’s registration fee is paid, a team site is activated on the CyberPatriot website. The Coach uses the team site to register Competitors. Coaches of multiple teams will have a different team site for each team.

Figure 3-1. Coach Registration Process 3004. MENTOR AND TEAM ASSISTANT REGISTRATION. Mentors and Team Assistants follow the same registration process. They register individually without a team assignment. Once a background investigation is complete and the Mentor or Team Assistant is approved by the CyberPatriot Program Office, a Coach may select them from a list on their team site. A Mentor or Team Assistant with a specific team preference should contact the CyberPatriot Program Office to provide a link-up with the team’s Coach. Mentors and Team Assistants are paired with Coaches only with mutual consent.


34

Figure 3-2. Mentor Registration Process 3005. COMPETITOR REGISTRATION. Competitors are registered by their Coach on the team site. Competitors are required to have an email address. Registration is finalized once parental permission is received by the CyberPatriot Program Office. 3006. TEAM REGISTRATION FEE. A team is completely registered when its fee has been paid or waived by the Commissioner, CyberPatriot. The team site is activated when registration is complete.


35

Figure 3-3. Competitor Registration Process


36



37

CHAPTER 4 PREPARATION PARAGRAPH GENERAL..............................................................................................................................................4001

TRAINING MATERIALS .........................................................................................................................4002

TRAINING RECOMMENDATIONS .........................................................................................................4003

PRACTICE ROUNDS ..............................................................................................................................4004 TEAM COMPETITION SYSTEM SPECIFICATIONS ..................................................................................4005 ONLINE COACHES’ MEETINGS .............................................................................................................4006

FIGURES 4-1 MICROSOFT DREAMSPARK WEBSITE


38

4001. GENERAL. Because CyberPatriot is a nationwide competition, team preparation is conducted locally. The CyberPatriot Program Office and CyberPatriot sponsors assist teams by providing training materials, access to MSDN software, and practice rounds. 4002. TRAINING MATERIALS. CyberPatriot training materials are provided free of charge at www.uscyberpatriot.org. 1. Training Modules. The following training modules, provided by the Center for Information Assurance and Security, are available on the CyberPatriot website.

Module 1: Introduction to Information Security (includes computer ethics training) Module 2: Introduction to VMWare Module 3: Introduction to Windows Security. (Windows Operating Systems – Basic Security) Module 4: Threats and Vulnerabilities Module 5: How to Mitigate Module 6: Networking Fundamentals Module 7: UNIX Operating Systems Module 8: Password Security 2. Microsoft Development Network (MSDN) Alliance/DreamSpark. CyberPatriot sponsor Microsoft provides software to all registered CyberPatriot participants for training through MSDN. Access instructions are emailed to registered CyberPatriot participants. a. No Software Transfers. MSDN software shall not be transferred or caused to be transferred to persons who are not registered in CyberPatriot. Transfer of the software to other persons violates the End User License Agreement and may constitute copyright infringement. b. Training. MSDN software allows teams to (1) Download a variety of Windows operating system images. (2) Conduct hands-on exercises with the training modules. (3) Expand their skills with a variety of software (e.g., Vizio, SQL Server, etc.).



39

Figure 4-1. Microsoft DreamSpark Website 3. Training Images. CyberPatriot participants may use training images posted on the CyberPatriot website for CyberPatriot activities at any time. Images for Practice and Exhibition Rounds or software tests (e.g., Sneak Preview) are not training images and are covered by the rules for competition images. Linux practice images can be downloaded from the CyberPatriot website or created using open source software. For licensing reasons, CyberPatriot will rarely distribute complete Windows practice images. Windows images can be created using an MSDN license or downloaded from the CyberPatriot website when available. 4. Practice Scoring Engine. The Texas A&M University at Corpus Christi has generously provided CyberPatriot teams with access to a local scoring client that can be used with Windows 7 (Professional, Enterprise, and Ultimate) and Windows Server 2008 images. The client is available to all CyberPatriot teams on the Training Materials page of www.uscyberpatriot.org. Directions for configuration and use of the scoring client can be found in the README.txt file in the compressed archive.


40

5. Post-Qualification Rounds Training Materials. After Round 2, Post-Qualification Rounds training materials will be made available to Semifinals, State Recognition Round, and Regional Recognition Round teams. The RRR materials will include CyberNEXS training. 6. The National Finals Competition. Training materials with information not covered during the online competition will be made available to the teams advanced to The National Finals Competition. 4003. TRAINING RECOMMENDATIONS. The training modules posted on the CyberPatriot website are a starting point for a team's training. To build skills, teamwork, and leadership, each Coach should establish a training plan for their team. If a Mentor is available, the training plan may be developed with or by the Mentor. The training plan may include: 1. Training Sessions. Suggestions for topics include: a. The CyberPatriot training modules. b. Coach or Mentor’s areas of expertise. c. Lessons learned from previous competition rounds d. Hands-on image training e. Guest speakers or cybersecurity experts. f. Careers in cybersecurity or other relevant areas. 2. Competitor Self-Study. Assignment of topics to Competitor for self-study will provide depth to the team’s knowledge base and skill sets. 3. Leadership and Management Mentorship a. Team. Instruction of management and leadership principles will assist the team in its effectiveness during competition. b. Team Captain. Since the Coach and Mentor shall not assist the team during competition, the Team Captain should have some management and leadership skills. Allowing the Team Captain to manage and lead the team during practice, with mentorship, is good preparation for competition. 4004. PRACTICE ROUNDS. There are two online Practice Rounds during the competition, which do not impact team rankings. Participation in Practice Rounds is encouraged, but not required. The Regional Recognition Round Practice Round is restricted to teams participating in that round. 1. Technical Support. During both Practice Rounds, Teams may download and run unlimited instances of the available images. Limited technical support will be available through a chat session between 9:00 am and 5:00 pm Eastern Time. No weekend or holiday technical support will be available.


41

2. Practice Round (CCS). The Practice Round provides all CyberPatriot teams up to 14 days to practice with CCS at their own pace. 3. Regional Recognition Round Practice Round (CyberNEXS). This round provides all CyberPatriot teams advancing to the RRR seven days to practice with CyberNEXS at their own pace. 4005. TEAM COMPETITION SYSTEM SPECIFICATIONS. The minimum recommended specifications for a team’s competition host computer system are listed below. For updated system specifications, go to: www.uscyberpatriot.org.

1. Hardware. The following are the minimum specifications for host computer hardware for CyberPatriot competition rounds. There will be up to three images for a single competition round. One host computer per competition image is recommended to allow students to work on all images at the same time. To participate in CyberPatriot, a team’s host system MUST be able to run VMware Player 6.0.

a. Minimum PC Specifications

(1) 1 GHz Intel x86 compatible processor (2+ GHz dual-core or better with virtualization extensions is strongly recommended) (2) 4 GB RAM (2 GB RAM may work but VMware Player is likely to run very slowly) (3) 20 GB of free disk space (4) 1024 x 768 or higher display

b. Other Hardware. While it may be possible to compete using an Apple or other system, the CyberPatriot Program Office cannot provide technical support for such environments.

Note: Some host systems may meet the above requirements, but are unable to run VMware Player 6.0. If you are not sure whether your system is capable of running VMware Player 6.0, please refer to the VMware Player Documentation. 2. Host Machine or Computer Software. The following are the approved operating systems and software for the CyberPatriot competition rounds. Teams that use other operating systems and software do so at their own risk and do not have grounds for an appeal. a. Operating System (1) Windows. The team’s competition computer must use a Windows operating system to run the competition software without interoperability issues.


http://www.uscyberpatriot.org/Pages/VirtualizationExtensions.aspx

http://www.uscyberpatriot.org/Pages/VirtualizationExtensions.aspx

http://www.vmware.com/support/pubs/player_pubs.html


42

(2) While a Mac OS X 10.4.11 or later may work for the competition, these operating systems have proven to be extremely problematic for CCS in past competitions. For this reason, the CyberPatriot Program Office cannot provide technical support for Mac operating systems. Furthermore, it is recommended that teams with Mac computers use Boot Camp to add a Windows partition to their machine so that they may use VMware Player rather than VMware Workstation. b. ZIP Client. Must be capable of handling encrypted ZIP files (7-zip or WinZip). c. VMware Player 6.0 (for Windows or Linux), VMware Fusion (for OS X). (1) VMware Player 6.0 is the recommended virtualization software for Windows and Linux for the CyberPatriot competition. While teams are not prohibited from using other virtualization products (e.g. VMware Workstation, VMware ESX/ESXi, etc.), the CyberPatriot Program Office will not provide technical support at the hypervisor level for products other than VMware Player. (2) Issues stemming from the use of products other than VMWare Player or VMWare Fusion (for OS X) are not grounds for an appeal. (3) Some virtualization software, such as VMware Workstation, offers functionality that is not available in VMware Player (e.g. system snapshots). During competition rounds, teams are prohibited from using snapshots or any other functionality not available in VMware Player 6.0. Please refer to www.vmware.com/support for complete information on the differences between the various VMware products.

3. Network Connection. It is the responsibility of the teams to provide an Internet connection for their competition computers. The most common difficulty encountered by teams during competition is a school proxy server or firewall blocking their web traffic. All teams will need unrestricted access to HTTP (TCP/IP port 80) to participate. Additionally, teams participating in the Regional Recognition Round require HTTPS (TCP/IP port 443) access. The following are the recommended minimum network requirements.

a. DSL or faster network connection for communication with the scoring server and downloads. b. AT&T Air Cards may be provided by the CyberPatriot Program Office to teams without Internet access for the competition. The request form is located on the CyberPatriot website. Air card failure does not constitute grounds for an appeal. c. Teams should plan for an Internet outage with a back-up plan.

http://www.vmware.com/support


43

d. Ports and Websites. The following ports and websites will require access during competition rounds. The CyberPatriot Program Office recommends that teams coordinate the list with the school or organization IT department. (1) Ports (a) Port 80 (Unrestricted access to TCP/IP for scoring server) (b) Port 443 (Team site login at www.uscyberpatriot.org and MSDN downloads) (2) Websites. The below websites, some of which require secure login, are the minimum Internet access required for the competition (a) uscyberpatriot.org (Competition website) (b) afa.adobeconnect.com (Tech support) (c) microsoft.com (Updates, patches, service packs, security, and OS information) (d) vmware.com (Competition software) (e) 7-zip.org (Competition software) (f) winzip.com (Competition software) (g) IP Address for Scoring Engine ( Varies from round-to-round) (h) XXXXXX.cloudfront.net (Downloads on the Amazon Content Delivery Network to include the competition image. Complete URLs are released before each round.) (i) onthehub.com (Microsoft software downloads) (j) google.com (Client connectivity check) (k) webex.com (Tech support and collaboration) (3) Email (a) [email protected] (Official competition email) (b) Constant Contact 4. Team Equipment Recommendations a. One computer per Image. When working on multiple images, the CyberPatriot Program Office recommends that teams use a separate computer for each image. b. Large Monitor or Projector. Large displays facilitate team collaboration on an image. 4006. ONLINE COACHES’ MEETINGS. Monthly Online Coaches’ Meetings, conducted on WebEx provided courtesy of Cisco Systems are another training resource. The meetings focus on program and competition updates for 45 minutes with questions and answers afterward.




44



45

CHAPTER 5 GENERAL RULES OF COMPETITION PARAGRAPH GENERAL..............................................................................................................................................5001 COMPETITION WINDOW .....................................................................................................................5002 COMPETITION PERIOD ........................................................................................................................5003 REGISTERED COMPETITORS ..............................................................................................................5004 NO OUTSIDE ASSISTANCE ...................................................................................................................5005 ONE INSTANCE PER COMPETITION IMAGE AND SOFTWARE .............................................................5006 SHARING OF COMPETITION IMAGES, SOFTWARE, AND INFORMATION ............................................5007 TEAM IDENTIFICATION (TEAM ID) REQUIRED ....................................................................................5008 INTERNET RESOURCES .......................................................................................................................5009 PRINTED MATERIAL .............................................................................................................................5010 ELECTRONIC MEDIA AND COMMUNICATION DEVICES ......................................................................5011 SOFTWARE TOOLS ...............................................................................................................................5012 OFFENSIVE ACTIVITY AND TAMPERING ..............................................................................................5013 OUTSTANDING INVOICE ......................................................................................................................5014 OVERSIGHT ..........................................................................................................................................5015 ALTERNATE COMPETITION DATES .....................................................................................................5016 INQUIRIES ............................................................................................................................................5017 PENALTIES ...........................................................................................................................................5018 APPEALS ..............................................................................................................................................5019 SCORE CORRECTION REQUEST ............................................................................................................5020


46

5001. GENERAL. The CyberPatriot program operates under the premise that all Coaches, Mentors, Team Assistants, and Competitors conduct themselves with the highest ethical standard. To prevent the perception of misconduct that would jeopardize the integrity of the competition and ensure a fair and equitable competition between all teams, rules have been established to govern the CyberPatriot competition. Coaches are encouraged to work with the CyberPatriot Program Office to resolve questions regarding the competition rules before competition. The following rules apply throughout the CyberPatriot competition season. 5002. COMPETITION WINDOW. Teams shall not compete outside the Friday—Sunday competition windows designated in the competition emails. 5003. COMPETITION PERIOD. The competition period begins when a team successfully opens their first image within their designated competition window and lasts for six consecutive hours. In the case that an image indicates additional time is left in the competition period, the competition period ends exactly six consecutive hours after the first image is opened. The following rules govern the competition period. 1. A team shall have only one competition period to complete ALL tasks for an online competition round. The intent of a multiple image or task round is to test teamwork as well as cyber defense skills.

2. If a team exceeds its six consecutive-hour competition period, then appropriate point-reducing penalties, as determined by the Commissioner, for the excessive time shall be applied.

3. The timer on the CyberPatriot Competition System is for reference purposes only. It is the responsibility of the team to ensure that work on ALL images is completed before the end of the six-hour competition period that begins when the first image is opened.

4. Technical issues affecting a team’s performance will not result in extra time unless the issue is competition-wide.

5. Teams shall not change their competition window without explicit email authorization from the CyberPatriot Program Office.

6. Before a team advances to the Semifinals or The National Finals Competition, their Qualification Rounds and Semifinals competition period times will be reviewed by the CyberPatriot Program Office.

5004. REGISTERED COMPETITORS. Only CyberPatriot Competitors registered with a team shall compete with that team. 1. No less than two and no more than five Competitors may compete for a team in an online competition round.


47

2. During online rounds, a team’s other registered Competitors may be substituted for any of the two to five competing Competitors at the Coach’s discretion. 5005. NO OUTSIDE ASSISTANCE. Competitors are responsible for their team’s performance during the competition. Once a competition period begins, Coaches, Mentors, and other non-team members shall not coach, assist, collaborate, or advise Competitors until the completion of the competition period. Outside assistance includes direct and indirect advice, suggestions, hands-on assistance, and electronic communication such as email, blogs, forums, Yahoo Answers, and other social media. Coaches and Mentors may only assist teams with:

1. Administrative issues before the image is opened. 2. Initial image registration. 3. Time keeping. 4. Local area network outages and other connectivity issues. 5. Issues with the host system unrelated to the competition image itself. 6. Dangerous or threatening situations (e.g. natural disasters) that require adult intervention 5006. ONE INSTANCE PER COMPETITION IMAGE AND SOFTWARE. A team may open only one instance of each image or competition software at a time during a competition round. An instance is defined as each time a competition image or competition software is opened in a virtual machine player or other software program. 1. If a competition round involves more than one image or other competition software, then only one instance of each of those images or software may be opened at a time. 2. Opening more than one instance of an image or software, online or offline, is not permitted and will lead to an appropriate penalty. 3. Shadowing, following, parallel operations, training, or any other use of a second or more instance of an image, online or offline, is NOT permitted. 4. Additional Compressed (NOT UNZIPPED) Image Downloads. Teams may place an additional additional COMPRESSED image download on other host computers. Teams may not copy an image to be used as a backup if the first instance is corrupted or malfunctions. If the host computer fails or the original download is deleted, the team may use this compressed image. Coaches shall ensure that the compressed images are deleted after the round of competition. 5. If an image is corrupted or malfunctions, it must be closed and deleted before the team opens another instance. If the original instance is not closed, the scoring engine will show multiple concurrent instances of the image, which is grounds for an inquiry and a penalty. The competition period time will continue regardless of time required for opening a new image.


48

5007. SHARING OF COMPETITION IMAGES, SOFTWARE, AND INFORMATION. Coaches are entrusted with competition round images and software and should treat them as examination material. CyberPatriot participants shall share images and other information only within their team space to avoid giving a competitive advantage to other teams. Teams may only share information after a competition round is fully complete to include the back-up round. Participants shall: 1. Structure a competition space or procedures so that other teams’ Competitors may not gain useful information or a competitive advantage. In competition areas where competition spaces are in separate rooms, a team’s Competitors may not enter another team’s rooms, except for in extremis circumstances. 2. Strictly limit distribution of CyberPatriot competition and practice images and software to their teams. Coaches shall ensure that the images are deleted after each round per the competition email. All images distributed by the CyberPatriot Program Office are the property of the AFA, not CyberPatriot participants. 3. Not share information concerning the competition images with anyone outside of their team until the competition round is completely over. 4. Not transfer or cause to be transferred copies of images to persons who are not currently registered CyberPatriot participants. Transfer of the images to non-CyberPatriot participants is clearly a violation of the CyberPatriot Competition Rules and End User License Agreement. 5. Coaches shall ensure that images and passwords are not transferred outside of their team. 6. Examples. Some examples of competition image or information sharing violations are: a. A Competitor sharing information with another team that has not competed in the round. b. A Competitor posting specific information on images or other competition software on a social networking site, blog, or other website. c. A Competitor sharing image vulnerabilities via text or email. d. A team using an image or software from any prior competition round for training. 5008. TEAM IDENTIFICATION (TEAM ID) REQUIRED. Validating (setting) the Team ID with the scoring server shall be the team’s first action when opening an image or competition software. Validation of a Team ID with the scoring server is done over the Internet. In CCS the Team ID is also known as a HASH and will be entered into the Set Team ID utility. Note: the Team ID is not the Team Number.


49

1. Penalty for Offline Work or No Team ID. An image or competition software worked offline or without a validated Team ID will have a score without a matching scoring report history. This is a scoring irregularity, and a team may be the subject of an inquiry and lose all points gained offline or without a valid Team ID. 2. The Internet connection is the sole responsibility of the team, even if the team uses a provided AT&T air card. 3. Teams should have a backup plan so that they can still compete in the event of a network failure. Backup plan examples include the pre-arranged use of a library or a private residence with sufficient adult supervision and deemed safe by the Coach. 5009. INTERNET RESOURCES. Internet resources such as FAQs, how-to guides, existing forums, and company websites are valid for competition use under the following conditions: 1. The resource is free and access to the resource has not been granted based on a previous membership, employment, purchase, fee, credit card, or other monetary instrument. 2. No token, smart card, common access card, etc., is required to access the resource. 3. The resource is publicly and reasonably available to all teams. 5010. PRINTED MATERIAL. Printed or handwritten reference materials (books, magazines, checklists, etc.) are permitted in competition spaces. Competitors shall choose and collect their team’s printed material for the competition round without the assistance of Coaches, Mentors, other teams’ Competitors, or non-Competitors. Competitors are not required to reprint existing material. 5011. ELECTRONIC MEDIA AND COMMUNICATION DEVICES. Coaches shall ensure that their teams compete without outside assistance through electronic media or communication devices. The following stipulations apply to this rule. 1. Online Competition Rounds a. Electronic Media. Because inconsistent Internet connections among CyberPatriot teams may cause teams a competitive disadvantage, electronic media as defined below may be used in the online competition rounds under the following conditions. (1) Permitted electronic media is defined as: memory sticks, flash drives, removable drives, CDROMs, or other similar storage devices. (2) Competitors shall prepare their own electronic media for the online competition rounds. Coaches, Mentors, other teams, and non-Competitors shall not prepare a team’s electronic media.


50

(3) Authorized Documents and Data. Patches, updates, and other Internet resources and software tools authorized by the CyberPatriot Rules Book are permitted on electronic media. (4) Scripts. Only scripts created by the team’s Competitors shall be stored on electronic media for the online competition rounds. Scripts created by anyone other than the Competitors shall not be stored on electronic media used during online competition rounds or used by Competitors during the rounds. b. Communication Devices. Cell phones, smartphones, and other wireless devices are allowed in the competition space, but shall NOT be used to communicate in the competition space. Answering and making calls, texting, etc., shall be done outside of the competition space. c. Staging Resources. Teams shall not stage or access on the Internet, networks, systems, servers, storage devices, communications devices, etc., unauthorized resources. Emailing or otherwise transferring unauthorized tools, scripts, and data to the image host computer via another computer or device is also prohibited. Secure FTP sites may not be used. 2. The National Finals Competition. During The National Finals Competition, NO electronic media or communication devices are permitted in the competition spaces. 5012. SOFTWARE TOOLS. Competitors shall set up and use software tools without outside assistance. Software tools shall only be used under the same conditions as Internet resources. 1. The tool can be found on the public Internet with Google and Yahoo search engines. All Internet users have access to the tool(s). 2. Competitors are authorized to use the Microsoft MSDN DreamSpark, to which all Competitors have access. 3. Software listed in the Team Competition Software paragraph in Chapter 4 is authorized for use in the online rounds of competition. 5013. OFFENSIVE ACTIVITY AND TAMPERING. Participants shall not conduct offensive activity or tampering against other teams, Competitors, the competition system, or non-participants to gain a competitive advantage. Offensive activity includes: 1. Hacking. 2. Interference with another team’s ability to compete. 3. Social engineering or posting of false information to platforms including the CyberPatriot Facebook page, Twitter, text, chat, email, etc.


51

4. Tampering with, copying, or modifying components of competition images, the competition scoring system, or other competition software or hardware. Copying an image in its entirety to be used as a backup is not permitted. 5. Changing or tampering with system, client, or host time keeping devices (e.g., clocks) 6. Tampering with or modifying documents belonging to other participants or the CyberPatriot Program Office. 7. Any other activity aimed at manipulating or deceiving other Competitors or the CyberPatriot Program Office, or competition staff. 5014. OUTSTANDING INVOICE. If a team has an outstanding invoice for the registration fee on the first day of competition, that team will be ineligible to compete in CyberPatriot. Teams should contact the CyberPatriot Program Office if they have an administrative issue with the invoice well before the first round of competition. 5015. OVERSIGHT 1. OVERSIGHT VISITS TO COMPETITION SPACES. Coaches shall allow the CyberPatriot competition staff and AFA officials to visit their competition spaces so that they may observe the conduct of the competition and fulfill their oversight role. Failure of a Coach or team to allow the visit may result in a penalty. An oversight visit does not relieve the Coach of their authority and responsibilities for the team. 2. ENTRY INTO A COMPETITION SYSTEM. During the competition, the competition staff may request to share a view of a team’s system(s) for oversight, competition administration, and troubleshooting purposes. The competition staff will not change the team’s system. Teams shall allow the competition staff immediate access to their system(s) when requested. 5016. ALTERNATE COMPETITION DATES 1. Competition Back-Up Dates. If the Commissioner postpones a competition round due to a weather emergency, other act of God, or any other reason, the competition will take place on the round’s scheduled back-up date. 2. Alternate Team Competition Periods. Through the appeals process, the Commissioner may grant approval for a team to compete on the scheduled back-up date due to a documented

Warning: Unauthorized copying of competition system scoring software components from the virtual machine may damage the systems to which they are copied.


52

local weather emergency, other act of God, or other reasons. Teams with schedule conflicts will NOT be granted approval. 5017. INQUIRIES. In cases of apparent rules violations or scoring irregularities, the Commissioner may appoint a CyberPatriot Program Office staff member to conduct an inquiry. The following items may be part of an inquiry. 1. Competition Images. Images that involve rule violations or scoring irregularities require special handling of competition images by Coaches. a. Security. The Coach of a team that is the subject of an inquiry or who has team members that are subjects of an inquiry shall secure and take measures to prevent access to the competition images. Images shall not be opened, modified, or otherwise tampered with unless requested by the investigator. Forensic analysis of images may be done during the inquiry. b. Transfer or Upload. When required, the Coach shall cause the transfer or upload of the competition images to a designated location. 2. Interviews. Interviews conducted in the course of the inquiry may be held in-person, by telephone, or by other means. 3. Questionnaires. The investigator may request that participants involved in an inquiry respond to a questionnaire concerning the inquiry. 5018. PENALTIES. A team or participant that does not cooperate in an inquiry may incur a penalty to include the disqualification, suspension, or ban of an individual or team as determined by the Commissioner, CyberPatriot. 1. Minor Penalties. In the event of a minor rules violation, the Commissioner may impose competition penalties on a team including: a. Score reduction. b. Time disadvantage in future competition rounds. c. Invalidation of a team’s competition round score. 2. Disqualification. If the Commissioner rules that a participant or team committed a major rules violation, they may be disqualified. Disqualified participants and teams are ineligible for awards and recognition to include sponsor scholarships and internships and are subject to: a. Suspension. The terms and time limit of a participant or team suspension are at the discretion of the Commissioner. b. Termination. A participant or team is immediately terminated from the CyberPatriot Program for the entire season.


53

c. Ban. A ban is the permanent disqualification of a participant or team from the CyberPatriot Program. It is the most severe administrative penalty that can be imposed by the Commissioner. Participant reinstatement is at the sole discretion of the Commissioner. 3. Replacement Teams. If a team advanced to the Semifinals, Regional Recognition Round, or The National Finals Competition is suspended, or banned, a replacement team may be chosen at the option of the Commissioner. In the event the Commissioner decides to designate a replacement team, the following criteria will be considered: a. Open Division. Team with the next highest qualifying score from the preceding round that was not advanced. b. All Service Division (1) Team in the same category with the next highest qualifying score from the preceding round that was not advanced. If a wild card team has the next highest qualifying score in the category, then the wild card team will replace the team removed in the category. (2) If a wild card team is to be replaced, then the team in the All Service Division with the next highest qualifying score from the preceding round that was not advanced will become a wild card team. This rule includes wild card vacancies left by teams that were moved from wild card status to compete in their category. c. Teams that did not compete in the Semifinals shall not be considered for The National Finals Competition. d. If a designated replacement team does not respond with information required for competition or logistics when requested, the Commissioner may revoke the designation of the replacement team. 5019. APPEALS. An appeal ensures competition fairness by considering unforeseen conditions that impact a team’s ability to compete. It is not a vehicle for a team to pursue by other means advancement in the competition. Only Coaches may submit appeals, as outlined in Appendix IV. The following rules govern appeals: 1. Deadlines. Unless otherwise published by the CyberPatriot Program Office, the following are the deadlines for appeals to be received via email at [email protected]. a. Qualification Rounds. The deadline is 4:00 p.m. Eastern Time on the second workday after the team’s division competition round scores are published. b. Semifinals, State Recognition Round, and Regional Recognition Round. Appeals from these rounds require two steps, as outlined below, or else the appeal will not be considered.



54

(1) Before 11:59 p.m. Eastern Time, on the last day of the round in question. The Coach shall notify the CyberPatriot Program Office that they intend to file an appeal, via email at [email protected]. (2) A full appeal must be submitted by 11:59 p.m. on the first working day after the completion of the round in question via email to the CyberPatriot Program Office at [email protected]. 2. Notification of Results. The Coach will be notified of the appeal results via email. 3. Grounds Not Considered for Appeals a. Loss of Internet Connection. Loss of an Internet connection is only a cause for an appeal if it was caused by a documented weather or man-made emergency or act of God that directly affected a team’s ability to compete. b. Failure to Receive Competition Email. Coaches are required to contact the CyberPatriot Program Office if a competition email is not received in a timely manner. See Chapter 5 for approximate email delivery times. 4. Round 2 Appeals. Appeals concerning Round 2 will not be considered if a team would not qualify for the Semifinals if the appeal was granted. 5. State Recognition Round Appeals. Appeals concerning the State Recognition Round will not be considered if a team would not qualify for the Regional Recognition Round if the appeal was granted. 6. One Appeal per Round. A team may only submit one appeal per competition round. 7. Decision Authority. The Commissioner is the final decision authority on appeals. 5020. SCORE CORRECTION REQUESTS. If a Coach believes their team’s score is incorrect when online round results are released, then he or she may submit a score correction request. Unless a Coach can properly document a scoring error, the request will not be considered and the official server score will stand. 1. Deadlines. Score correction requests have the same deadlines as appeals. 2. Originator. A Coach must originate a team’s score correction request. 3. Transmission. (See Appendix IV for the Score Correction Request Format and an example.) Appeals will be accepted by the CyberPatriot Program Office only via email at: [email protected]. The subject line shall read:





55

Score Correction Request: (School or Organization Name) (Team Number) (State/Territory/Province) 2 Letters -- Postal Abbreviation

Examples: Score Correction Request: Metro High School 05-7766 NY Score Correction Request: Chicken Bristle Composite Squadron 05-6324 AR 4. Notification of Results. The CyberPatriot Program Office will email the Coach of the results of their score correction request. 5. Proper Documentation. The following are examples of proper documentation. A strong score correction request will involve more than one document. a. Scoring Files. Scoring data stored on the image (C:\CyberPatriot\ScoringData folder) is the best documentation to prove a scoring error. The data may be copied from the image and emailed to the CyberPatriot Program Office. To ensure that an image is not damaged, Coaches should copy the data and not remove or alter it. b. Full Screen Capture of the Scoring Page. If the screen capture of the scoring page is cut off or modified, it will not be considered in the appeal. The screen capture must be easily readable and include: (1) CyberPatriot Logo (6) Report Generated Time (2) Current Team ID (7) Penalties Assessed (3) Team Hash (8) Known Issues Fixed (4) Score (9) Copyright Information (5) Connection Status c. Competition Scoreboard Screenshot. Complete screenshots are required. 6. Round 2 Score Corrections. Score corrections for Round 2 will not be recalculated if a team would not qualify for the Semifinals given the maximum score requested. 7. One Score Correction Per Round. 8. Decision Authority. The Commissioner is the final decision authority on score corrections.


56



57

CHAPTER 6 ONLINE ROUNDS PARAGRAPH ............................................................................................................................................................... GENERAL..............................................................................................................................................6001 .............................................................................................................................................................. QUALIFICATION ROUNDS ....................................................................................................................6002 SEMIFINALS .........................................................................................................................................6003 STATE RECOGNITION ROUND .............................................................................................................6004 REGIONAL RECOGNITION ROUND ......................................................................................................6005 COMPETITION REQUIREMENTS ..........................................................................................................6006 COMPETITION COMMUNICATION ......................................................................................................6007 COMPETITION EVENTS ........................................................................................................................6008 TECHNICAL SUPPORT ..........................................................................................................................6009 COMPETITION AREA ............................................................................................................................6010 FIGURES 6-1 COMPETITION SYSTEM SCHEDULE 6-2 COMPETITION EMAIL 6-3 IMAGE DELIVERY PROCESS


58

6001. GENERAL. Each team will to compete by fixing vulnerabilities, hardening systems, and performing other tasks in the online rounds. Online competition rounds will be held after the Practice Round. The All Service and Open Divisions will compete on the same weekends. See figure 6-1 for competition dates. 6002. QUALIFICATION ROUNDS. Rounds 1 and 2 are the Qualification Rounds. All teams can participate in both Qualification Rounds. Advancement of teams to the Semifinals is based on the aggregate scores from the qualification rounds. Middle school team advancement to the Semifinals depends on their placement with respect to only other middle school teams. 6003. SEMIFINALS. The Semifinals determine which teams will compete in the in-person National Finals Competition. Middle school team advancement to the National Finals Competition depends on their placement with respect to other middle school teams only. 6004. STATE RECOGNITION ROUND. The State Recognition Round (SRR) is conducted after the Semifinals. Teams from both the All Service and Open Divisions that did not advance to The National Finals Competition may compete in the SRR. The purpose of the SRR is to determine state awards and teams that will advance to the Regional Recognition Round. Middle School Division teams shall not compete in the SRR. 6005. REGIONAL RECOGNITION ROUND. The Regional Recognition Round (RRR) is conducted after the SRR. Teams in the RRR will be chosen from those that participated in the SRR. The top All Service and Open team in this pool from each state and geographic area will advance to the RRR. Teams will then compete against the other teams within their division in their region (See Chapter 7 for the region map). The Middle School Division and shall not compete in the RRR.


59

Figure 6-1. Competition System Schedule 6006. COMPETITION REQUIREMENTS. The following are required for online rounds: 1. Computer. One computer per competition image is highly encouraged. Two to three computers per competition round are optimal for maximum team participation. (For system specifications, see Chapter 4.) 2. Internet Connection. Teams are responsible for their own Internet connection. Teams may request AT&T air cards for connectivity from the CyberPatriot Program Office. 3. Valid Coaches’ Email Address. The Coach must be able to receive emails from Constant Contact. Some schools block emails from Constant Contact or mark them as spam. The CyberPatriot Program Office recommends that Coaches use a personal email address (e.g., Gmail, AOL, etc.) to avoid non-delivery issues. 4. Downloaded Image. Images are downloaded from links in the Download and Instructions Email. Images should be downloaded at least 24 hours in advance of the competition, as they may be 3 GB or larger in size.


60

5. Accurate Host Computer Time. Host machines’ clocks must be set to the correct local time zone, time, and date, and be within ten minutes of the correct time. Teams should check these factors before starting the competition and NOT change the host computer time or date once a round has begun. Teams can use http://www.time.gov to check their local clock. 6007. COMPETITION COMMUNICATION. Email from [email protected] is the official and primary means of competition communication. Official competition information will also be posted on the CyberPatriot website, Facebook, and in the CPOC tech support chat if there are technical issues with official email. 1. Competition Email. Teams will receive three competition emails before each online competition round and one email after. It is the Coaches’ responsibility to ensure that they receive each of the emails listed below. If a Coach does not receive an email in time, they should contact the CyberPatriot Program Office. Failure to receive any of the following emails is not grounds for an appeal. a. Competition Round Preparation Email. Coaches will receive an email with image and

other information (operating system(s), rule changes, etc.) 10-14 days before a round.

b. Download and Instructions Email. On or before the first day of the work week prior to

competition round, Coaches will receive an email with image download information.

Information in the email will include:

(1) How to download virtual images. (3) How to decrypt/decompress images.

(2) Image-specific information. (4) Technical information.

c. Competition Start (StartEx) Email. Just prior to the round’s first competition window, an

email will be sent to all Coaches with the following information:

(1) Image decryption passwords

(2) Changes to instructions since the Download and Instructions Email.

(3) Team ID (Hash)

Note: StartEx (Start Exercise) is the term used to announce the start of the competition

powered by Leidos’ Cyber Network Exercise System (CyberNEXS). For uniformity purposes, the

term StartEx will also be used to start CCS competition rounds.

d. Competition Round Results Email. The Competition Round Results Email will be sent to

Coaches in the Division that competed in the just-completed round. Release of the email is

http://www.time.gov/



61

contingent on a variety of factors to include the outcomes of inquiries or appeals concerning

the round. The goal for release of the email is five working days after the completion of the

competition round. The Round Results Email will contain the following information:

(1) The scores from the just-completed competition round.

(2) A general list of vulnerabilities categories in the images. Specific vulnerabilities will not

be published. The general list of vulnerabilities categories may include:

- Account policy - Prohibited files - Windows Update - Password policy - Malware - Antivirus

- File sharing - Access control - Unnecessary services - Firewall - Advanced Windows security settings

Figure 6-2. Competition Email


62

2. Information and Notifications. Round-specific information may be posted in the following

areas:

a. CyberPatriot Website: www.uscyberpatriot.org

b. CPOC Tech Support Chat: afa.adobeconnect.com/CPOC or http://fedgov.webex.com

(The login credentials will be published in the Competition StartEx Email.)

c. Facebook: www.facebook.com/CyberPatriot

d. Twitter: www.twitter.com/CyberPatriot

6008. COMPETITION EVENTS. The CyberPatriot online competition rounds contain one or more of the following scored events. 1. Network Security Challenge. The Network Security Challenge is a cyber defense event based on finding and fixing security vulnerabilities in operating systems. CyberPatriot uses the following competition systems for the Network Security Challenge: CyberPatriot Competition System (CCS) and Leidos’ Cyber Network Exercise System (CyberNEXS). a. Virtual Machine Image (Image). CCS and CyberNEXS score teams on their discovery and remediation of vulnerabilities in a virtual machine image. Images may contain competition software on the operating system image. A CyberPatriot image is an operating system played on virtual machine player. (1) Host Machine or System. The computer playing the image is known as a host machine or host system. The image can be modified without affecting the host machine’s operating system or software. The host machine or computer is the responsibility of the team. (2) Image Delivery. See Figure 6-3 for the image delivery process. (3) Coaches’ Image Responsibilities. Coaches shall ensure that passwords, competition round images, and competition software are strictly controlled. When the competition round is complete, Coaches will delete the competition images according to guidance published in the competition emails. Coaches of teams pending the outcome of an appeal or inquiry shall maintain their images until the results of the inquiry or appeal is published and then they will delete their images.


http://www.facebook.com/CyberPatriot

http://www.twitter.com/CyberPatriot


63

Figure 6-3. Image Delivery Process b. CyberPatriot Competition System (CCS). CCS is an Internet-dependent competition system used for the Qualification Rounds, Semifinals, and the SRR. CCS uses a client-based scoring system. c. Cyber Network Exercise System (CyberNEXS). The RRR is powered by Leidos’ CyberNEXS. CyberNEXS is Internet-dependent for scoring server feedback to the CyberNEXS client. 2. Digital Forensics Challenge. The Digital Forensics Challenge is conducted with CCS in the Qualification Rounds, Semifinals, and SRR and with CyberNEXS in the RRR. Teams are scored on their ability to identify cyber defense irregularities. The Digital Forensics Challenge runs concurrent with the Network Security Challenge. 3. Networking Challenge. The Networking Challenge is a timed event administered by Cisco Systems, in which teams install a network and operate basic network devices. Teams will be scored on their conduct of basic networking security tasks.


64

4. Digital Crime Scene Challenge. This is a timed event that consists of a digital crime scene and a scenario. Teams are scored on the identification and collection of evidence. 5. Other Competition Events. Other competition events may be added to the competition. However, training materials for a new event will be provided well in advance of the round in which it will be conducted in. 6009. TECHNICAL SUPPORT. Technical support for online competition rounds will be provided by the CyberPatriot Operations Center (CPOC) and CyberPatriot Program Office during competition windows (See Appendix VII). Technical support can be reached as follows: 1. CPOC Tech Support Chat Session: afa.adobeconnect.com/CPOC 2. Telephone: 1-877-885-5716 3. For non-critical technical issues: [email protected] 6010. COMPETITION AREA. The competition area consists of more than one team’s competition space and support spaces in a building or other enclosed area. Coach supervision of the competition area and competition spaces is critical to the integrity of the competition. 1. Online Rounds Competition Area. The competition area in the online rounds of competition is an area where more than one team may compete (e.g., school multipurpose room, computer lab). During their competition periods, team members of different teams competing in the same competition area shall not communicate with members of the other teams. (See Chapter 5.). 2. Competition Space. The competition space is the area in which a single team competes. 3. Other Spaces. If possible, coaches should arrange a spectator area or other spaces for visitors to watch the competition without interrupting the Competitors.



65

CHAPTER 7 THE NATIONAL FINALS COMPETITION PARAGRAPH ............................................................................................................................................................. GENERAL..............................................................................................................................................7001 GROUPS ...............................................................................................................................................7002 ............................................................................................................................................................... COMPETITION EVENTS ........................................................................................................................7003 INTERNATIONAL TEAMS ......................................................................................................................7004 MIDDLE SCHOOL DIVISION (PILOT) .....................................................................................................7005


66

7001. GENERAL. The National Finals Competition is an in-person competition round held in the Washington, D.C. area. A separate document will be published after the Semifinals that will cover rules specific to The National Finals Competition. 7002. GROUPS. The following groups will participate in The National Finals Competition. 1. Competition Staff. (See Chapter 1 for details.) a. CyberPatriot Program Office b. Competition Administration Teams 2. Blue (Competitor) Teams. A Blue Team is a grouping of Competitors competing in the competition. Blue Teams and Competitor teams are synonymous. Blue teams do not include the Coach, Mentor, or chaperone. a. Primary and Alternate Competitors. For teams advanced to The National Finals Competition, Coaches shall designate no less than two and no more than five primary Competitors and no more than one alternate Competitor from the registered team members. (1) Primary Competitors. Primary Competitors participate during The National Finals Competition. When a team is advanced to The National Finals Competition, up to five primary Competitors shall be designated by a team’s Coach from the team’s registered Competitors. (2) Alternate Competitors. Alternate Competitors are those who are not primary Competitors. Only one alternate Competitor may officially attend The National Finals Competition. Unless the alternate Competitor permanently replaces a primary Competitor during The National Finals Competition, the alternate Competitor will not compete. (3) Final Designation. Once the deadline has passed for The National Finals Competition team roster submission, the primary Competitors may not be changed without the expressed approval of the Commissioner. (4) Coach’s Decision. The designation of primary and alternate Competitors is the Coach’s decision. The Coach may change primary and alternate Competitors until the names are required for The National Finals Competition. For maximum training effect, identification of key talent, and conditioning of the team to have five primary Competitors, the Coach may consider using the primary and alternate designations during the online rounds of competition. b. Team Captain. Only one Team Captain per team shall be designated by the team’s Coach for The National Finals Competition. Co-Captains are not recognized at the competition. 3. Team Coach and Chaperone. The team Coach and one chaperone may attend The National Finals Competition as a member of the team. In the event that a Coach has two or three teams advance to The National Finals Competition, he or she shall act as a supervising adult capacity


67

for only one team. The Coach’s verification official shall appoint a supervising chaperone for the other team(s) that qualifies for the National Finals Competition. Other attendees wishing to attend The National Finals Competition may do so at their own expense, but must coordinate with the CyberPatriot Program Office. Family members and other attendees may not share rooms with the CyberPatriot Competitors. 7003. COMPETITION EVENTS. The Nationals Finals Competition will consist of the following events, which will have their scores weighted. 1. Network Security Challenge 2. Digital Forensics Challenge 3. Digital Crime Scene Challenge 4. Networking Challenge 7004. INTERNATIONAL TEAMS. International teams may compete per a Memorandum of Agreement in one of two ways. a. In the Open Division. If an International Team has a qualifying Semifinals score for The National Finals Competition, it will compete in the Open Division at The National Finals Competition. b. International Exhibition. If an International Team does not have a qualifying Semifinals score for The National Finals Competition, it will compete in the same competition events in a separate International Exhibition. 7005. MIDDLE SCHOOL DIVISION (PILOT). Middle School Division teams that advance to The National Finals Competition shall participate in the Network Security Challenge and may observe the other events. They may participate in all non-competition activities.


68



69

CHAPTER 8 SCORING AND ADVANCEMENT PARAGRAPH GENERAL............................................................................................................................................ 8001 SCORING ............................................................................................................................................ 8002 ADVANCEMENT ................................................................................................................................. 8003 RESULTS PUBLICATION ...................................................................................................................... 8004

FIGURES

8-1 CYBERPATRIOT REGIONS

8-2 COMPETITION ADVANCEMENT FLOW


70

8001. GENERAL. The scoring and advancement of CyberPatriot teams are inextricably connected. This chapter will provide an overview of scoring and advancement. 8002. SCORING. Scores considered for advancement include any penalties assessed against teams. The following are the scoring practices for the competition rounds. 1. Practice Rounds. Practice rounds are not scored for record and do not count toward advancement.

2. Qualification Rounds

a. Weighting. Round 1 and 2 scores are added for an aggregated Qualification Round score. Percentages, difficulty, number of vulnerabilities fixed, or other weighting factors will not be used to calculate scores in the Qualification Rounds and will not be considered in the advancement of teams to the Semifinals.

b. Scores. Scores in CCS and Digital Forensics are based on scored security vulnerabilities that are fixed, remediated, or identified in an image. It is possible to reduce a score if a fix to one vulnerability undoes a previous fix, or if a team is assessed a penalty for an action that is not allowed in or conflicts with the scenario for that Round. Points lost to penalties can be recovered by way of corrective action. Not all vulnerabilities in an image are scored. Other events will have their own scoring criteria.

c. Administrative Penalties. Penalties may apply in the following circumstances: (1) Excessive Time. Teams with qualifying scores for advancement to the Semifinals will have their Round 1 and Round 2 competition period times reviewed for irregularities at the end of Round 2. (a) A team found to have exceeded the six consecutive-hour competition period for any the Qualification Rounds, according to the scoring engine, will be penalized. For example, if a team is found to have taken excessive time in Round 1, the team’s score for Round 1 may be less than originally published at the end of Round 1. (b) The final score of a team found to have exceeded the six consecutive-hour competition period will not be greater than the score at the six-hour mark with an appropriate penalty. (2) Other Penalties. Per Chapter 5, other penalties invoked by the Commissioner, CyberPatriot may affect a team’s final score or advancement. d. Tie Score. If teams have a tie score that affects their advancement to the Semifinals, the following tie-breakers will be used to resolve the tie.


71

(1) If teams have a tie score that affects their advancement to the Semifinals, then the team with the highest score in Round 2 will be placed ahead of the other tied team. (2) If the teams had tied scores in Round 2, then the team with the highest score in the Round 2 Network Security Challenge will advance to the Semifinals. (3) If the tied team’s Network Security Challenge scores from Round 2 are tied, then the team that reached their final Network Security Challenge scores in the shortest time will be placed ahead of the other tied team. 3. Semifinals. The Network Security Challenge provides most of a team’s score for the Semifinals. a. Competition Events. The Semifinals consist of three events:

(1) Network Security Challenge. The Semifinals Network Security Challenge will use CCS.

(2) Digital Forensics Challenge. Digital forensics will be scored during the Semifinals, concurrent with the Network Security Challenge. (3) Networking Challenge. The Networking Challenge will be scored during the Semifinals, concurrent with the Network Security Challenge. b. Scoring Methodology (1) Weighting. The Network Security Challenge will be the Semifinals most heavily weighted event.

(2) Scores. CCS and Digital Forensics scores are based on scored security vulnerabilities fixed or remediated, difficulty of fixes, time, and other factors. It is possible to reduce a score if the fix to a vulnerability undoes the protection of a previous fix. Other events will have their own scoring criteria.

(3) Excessive Time. Before teams are advanced to The National Finals Competition, their competition period times will be reviewed. A team found to have exceeded the six-hour competition period, according to the scoring engine, will be penalized. The team’s final score will not be greater than the six-hour score with an appropriate penalty. (4) Tie Score. If teams have a tie score that affects their advancement to The National Finals Competition, the following tie-breakers will be used to resolve the tie. (a) The team with the highest score in the Network Security Challenge will be placed ahead of the other tied team.


72

(b) If the teams had a tied score in the Network Security Challenge, then the team with the highest total score in the Qualification Rounds will be placed ahead of the other tied team. (c) If the teams had a tied highest total score in the Qualification Rounds, then the team with the highest total score in Round 2 will be placed ahead of the other tied teams. (d) If the teams had a tied score in Round 2, then the team that reached their highest scores first in the Network Security Challenge will be placed ahead of the other tied team. 4. State Recognition Round (SRR)

a. Competition Events. The SRR consists of two events:

(1) Network Security Challenge. The SRR Network Security Challenge uses CCS and will be scored by CCS.

(2) Digital Forensics Challenge. Digital forensics will be scored by CCS during the SRR, concurrent with the Network Security Challenge.

b. Scoring Methodology

(1) Weighting. The Network Security Challenge will be the SRR’s most heavily weighted event.

(2) Scores. CCS and Digital Forensics scores are based on scored security vulnerabilities fixed or remediated in an image. It is possible to reduce a score if a fix to one vulnerability undoes the protection of a previous fix. Other events will have their own scoring criteria.

(3) Excessive Time. Before teams are advanced to the RRR, their competition period times will be reviewed. A team found to have exceeded the six consecutive-hour competition period, according to the scoring engine, may be penalized. The team’s final score will not be greater than the six-hour score with an appropriate penalty.

(4) Tie Score. If teams have a tie score that affects their advancement to the RRR, the following tie-breakers will be used to resolve the tie.

(a) The team with the highest score in the Semifinals will be placed ahead of the other tied team. If only one team participated in the Semifinals, then that team will be placed ahead of the other tied team.

(b) If the teams had tied scores in the Semifinals or neither team attended the Semifinals, then the team with the highest score in Round 2 will advance to the RRR.

(c) If the teams had a tied score in Round 2, then the team that reached their final scores in the shortest time in the SRR will be placed ahead of the other tied team.


73

5. Regional Recognition Round (RRR)

a. Competition Events. The RRR is planned to consist of at least two events:

(1) Network Security Challenge. The RRR Network Security Challenge is powered by Leidos’ CyberNEXS.

(2) Digital Forensics Challenge. Digital Forensics Challenge will be scored by CyberNEXS during the RRR, concurrent with the Network Security Challenge.

(3) Other Events. Other events may be added to the RRR at the discretion of the Commissioner.

b. Scoring Methodology

(1) Weighting. The Network Security Challenge will be the RRR’s most heavily weighted event.

(2) Scores. CyberNEXS and Digital Forensics scores are based on scored security vulnerabilities fixed or remediated, difficulty of fixes, time, and other factors. It is possible to reduce a score if the fix to vulnerability undoes the protection of a previous fix. Other events will have their own scoring criteria.

(3) Excessive Time. A team found to have exceeded the six-hour competition period, according to the scoring engine, will be penalized. The team’s final score will not be greater than the six-hour score with an appropriate penalty.

(4) Tie Score. In the event of a tie between teams that requires resolution, the following tie-breakers will be used to resolve the tie. (a) The team with the highest score in the SRR will be placed ahead of the other tied team. (b) If the teams had tie scores in the SRR, then the tied team with the highest Network Security Challenge score in the RRR will be placed ahead of the other tied team. (c) If the teams tied in the Network Security Challenge, then the team with the highest score in the Semifinals will be placed ahead of the other tied team. If only one team participated in the Semifinals, then that team will be placed ahead of the other tied team. (d) If the teams tied in the Semifinals or if the tied teams did not attend the Semifinals, then the team that scored the highest in Round 2 will be placed ahead of the other tied team.


74

6. Final Tie-Breaker. In the event that tie-breaking methodologies still result in a tie for advancement, a coin toss in a manner prescribed by the Commissioner, CyberPatriot will be the final tie-breaker. 8003. ADVANCEMENT. Advancement in CyberPatriot takes two tracks: the National track and the State and Regional track. The National track consists of the Qualification Rounds, Semifinals, and The National Finals Competition. The State and Regional track consists of the SRR and the RRR. 1. Qualification Rounds. All teams may compete. 2. Semifinals. Advancement to the Semifinals is based on the following factors for each Division. a. Open Division. A total of 50 Open Division teams will advance to the Semifinals based on their Qualification Round scores. b. All Service Division. A total of 42 All Service Division teams will advance to the Semifinals: six teams from each of the six categories and six Wild Card teams. (1) All Service Division Categories. The six teams from each of the All Service Division categories (JROTC programs, CAP, and USNSCC) with the highest composite Qualification Round scores advance to the Semifinals. (a) Army JROTC (6 Teams) (b) Navy JROTC (6 Teams) (c) Marine Corps JROTC (6 Teams) (d) Air Force JROTC (6 Teams) (e) Civil Air Patrol (CAP) (6 Teams) (f) U.S. Naval Sea Cadet Corps (USNSCC) (6 Teams) (2) Wild Cards. The six teams with the highest Qualification Round scores that do not qualify as a member of their JROTC, CAP, or USNSCC category will advance to the Semifinals as Wild Card teams, irrespective of their category. c. Middle School Division (Pilot). A total of 10 Middle School Division teams will advance to the Semifinals based on their Qualification Round scores. d. Advancement on Appeal. Teams advanced to the Semifinals on an approved appeal will compete as Wild Card teams and will not displace teams that previously qualified for the Semifinals. 3. State Recognition Round (SRR). All teams except National Finalists and the Middle School Division may compete.


75

4. Regional Recognition Round (RRR). a. Open Division. The team finishing first in their state or geographic area during the SRR will compete in the RRR. If a state/geographic area does not have a team that participated in the SRR, it will not field a team in the RRR. b. All Service Division. Unlike the Semifinals and The National Finals Competition, placement in the RRR for All Service teams is not based upon service category. Advancement will therefore function the same as Open Division advancement (above). c. Regions. Teams advancing to the RRR will compete in one of seven regions based on their location. A map denoting which states and areas belong to each region is below. Note that each region has eight states or areas except for the Midwest, which has nine.

Northeast – Connecticut, Maine, Massachusetts, New Hampshire, New Jersey, New York, Rhode Island, Vermont

Mid-Atlantic – Delaware, Kentucky, Maryland, Ohio, Pennsylvania, Virginia, Washington, D.C., West Virginia

Southeast – Alabama, Florida, Georgia, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee

Midwest – Illinois, Indiana, Iowa, Michigan, Minnesota, Nebraska, North Dakota, South Dakota, Wisconsin

Southwest – Arizona, Arkansas, Colorado, Kansas, Missouri, New Mexico, Oklahoma, Texas

West – California, Idaho, Montana, Nevada, Oregon, Utah, Washington, Wyoming

At-Large – Alaska, Europe (AE), Pacific (AP), American Samoa, Canada, Hawaii, Puerto Rico, Virtual Teams*

*If areas that are not listed field a team, they will be placed in the At-Large region.


76

Figure 8-1. CyberPatriot Regions 5. The National Finals Competition. Advancement to The National Finals Competition is based on the following factors for each Division. a. Open Division. A total of 12 Open Division teams will advance to The National Finals Competition based on their Semifinals scores . b. All Service Division. A total of 14 All Service Division teams will advance to The National Finals Competition: two teams from each of the six categories and two Wild Card teams. (1) All Service Division Categories. The two teams from each of the All Service Division categories with the highest Semifinals scores will advance to The National Finals Competition. (2) Wild Cards. The two teams with the highest Qualification Round scores that do not qualify as a member of their JROTC, CAP, or USNSCC category will advance to the National Finals Competition as Wild Card teams, irrespective of their category.


77

Figure 8-2. Competition Advancement Flow 8004. RESULTS PUBLICATION. The results or links to the results of competition rounds will be published in the following media. The goal is to publish the results within five working days after the end of a competition round. 1. The CyberPatriot website: www.uscyberpatriot.org

2. CyberPatriot Facebook page 3. Email to CyberPatriot Coaches 4. The CyberSentinel



78



79

CHAPTER 9 AWARDS PARAGRAPH GENERAL..............................................................................................................................................9001 AWARD AUTHORITIES .........................................................................................................................9002 TYPES OF AWARDS ..............................................................................................................................9003 THE NATIONAL FINALS COMPETITION AWARDS ................................................................................9004 REGIONAL AWARDS ............................................................................................................................9005 STATE AWARDS ...................................................................................................................................9006 SEMIFINALS RECOGNITION .................................................................................................................9007 CYBERPATRIOT COACHES AND MENTORS OF THE YEAR .....................................................................9008 REGION, STATE, AND LOCAL AWARDS PRESENTATIONS ......................................................................9009 FIGURES

9-1 OVERALL AWARDS

9-2 SERVICE AWARDS


80

9001. GENERAL. The Air Force Association (AFA) recognizes excellence in competition and dedication and support of CyberPatriot with awards and honors. CyberPatriot sponsors may also elect to recognize teams throughout the competition.

9002. AWARD AUTHORITIES. Only the Commissioner, CyberPatriot shall approve other awards to be presented at The National Finals Competition. The Air Force Association Awards Committee shall vet non-competition awards such as Coaches and Mentors of the Year. 9003. TYPES OF AWARDS 1. Team Awards. Teams may receive a National-, Regional-, or State-level award based on their placement at the end of the competition season. They may receive only one of the following awards and will have their placement denoted by a title and stars at the end of the season. Award hierarchy is displayed in figure 9-1.

Figure 9-1. Overall Awards 2. All Service Category Awards. These awards are presented to the top team in each of the four JROTC programs, CAP, and USNSCC.


81

3. Event Awards. These awards may be awarded to the top scoring team(s) in a specific event by the sponsor of the events. Normally, event awards are awarded to National Finalists at The National Finals Competition. 4. Individual Awards. Excellence among CyberPatriot participants is recognized by individual awards. 5. Recognition Honors. Teams, persons, or organizations may receive recognition awards for attendance at The National Finals Competition, CyberPatriot achievements outside of the competition, sponsorship or support of CyberPatriot. 9004. THE NATIONAL FINALS COMPETITION AWARDS 1. Overall Awards a. The President’s Cup. Presented to the Open Division National Champion team. b. The Commander-In-Chief's Cup. Presented to the to the All Service Division National Champion team. c. National Runner-Up Trophy. Presented to the second place team in each Division at The National Finals Competition. d. National Third Place Trophy. Presented to the third place team in each Division at The National Finals Competition. e. National Finalist Award. This award is given to all teams that participated in The National Finals Competition and did not receive one of the above awards. 2. All Service Category Awards. The top team in each JROTC program, CAP, and USNSCC will receive an award and will have their achievement noted with a title and colored stars at the end of the competition.


82

Figure 9-2. Service Awards

3. Event Awards a. Cisco Networking Challenge Award. The Cisco Networking Award is presented by Cisco Systems to the National Finals Competition Team that scores the highest final score in the Cisco Networking Challenge in each division. b. Digital Crime Scene Challenge Award. The Digital Crime Scene Challenge Award is presented by the U.S. Cyber Crime Conference to the National Finals Competition Team that scores the highest final score in the Digital Crime Scene Challenge in each Division. c. Other Awards as approved by the Commissioner. 4. Recognition Honors a. International Exhibition. Each International Exhibition team receives this award. b. Middle School Division. Every Middle School team participating in The National Finals Competition receives this award. 9005. REGIONAL AWARDS. The top three teams in each division for each region will be individually recognized, and all other participating teams will receive Regional Honoree awards. All of the awards apply to each region and will be denoted as such (e.g. West Region Winner, Midwest Region Honoree, etc.) at the end of the competition season. Teams receiving a National Award (above) are not eligible for regional awards.


83

1. Region Winner. This award is given to the top team participating in the Regional Recognition Round from each region for both divisions. There will be seven Region Winners, each denoted by their region name (e.g. Midwest Region Winner, Southeast Region Winner). 2. Region Runner-Up. This award is given to the team with the second-highest score from each region for both divisions. There will be seven Region Runner-Ups, each denoted by their region name (e.g. West Region Runner-Up, Mid-Atlantic Region Runner-Up). 3. Region Third Place. This award is given to the team with the third-highest score from each region for both divisions. There will be seven Region Third Place teams, each denoted by their region name (e.g. At-Large Region Third Place, Northeast Region Third Place). 4. Region Honoree. This award is given to all teams that participate in the Regional Recognition Round and do not receive one of the above awards. There will be up to 35 Region Honoree awards, each denoted by their region name (e.g. Southwest Region Honoree). 9006. STATE AWARDS. The top three teams in each division for each state will be individually recognized. All of the awards apply to each state/area and will be denoted as such (e.g. Minnesota First Place Awardee, Puerto Rico Third Place Awardee, etc.) at the end of the competition season. A team must participate in the State Recognition Round to receive a state award. Teams receiving a National or Regional Award (above) are not eligible for state awards. Additionally, National Finalist teams may not compete in the State Recognition Round or Regional Recognition Round. 1. First Place State Awardee. This award goes to the top team in each state or area. 2. Second Place State Awardee. This award goes to the runner-up in each state or area. 3. Third Place State Awardee. This award goes to the third team in each state or area. 9007. SEMIFINALS RECOGNITION. Teams that participated in the Semifinals, but did not advance to The National Finals Competition will receive recognition for their achievement. 9008. CYBERPATRIOT COACHES AND MENTORS OF THE YEAR. Coaches and Mentors of the year will be nominated and selected by a process that will be published before the next competition season. 9009. REGION, STATE, AND LOCAL AWARDS PRESENTATIONS. Awards may be presented to teams by Region or State AFAs, local AFA chapters, or by other interested parties or organizations, depending on a team’s overall performance, to include the State Recognition Round.


84



85

APPENDIX I

CYBERPATRIOT COACHES’ AGREEMENT

Volunteer Coaches are vital to the success of CyberPatriot. Without Coaches’ voluntary partnership, CyberPatriot will never be able to expand to the tens of thousands of schools and students who are eager to participate – and our nation needs. The CyberPatriot Coach serves in two roles. The Coach (with additional assistance at her/his sole discretion) guides the team through preparation for the competition. As importantly, the Coach is a critical member of the CyberPatriot management team who ensures:

1. Access to minor Competitors in a way that protects them and respects parental prerogatives; and

2. The integrity of the competition during online and in-person competition.

As a CyberPatriot Coach, I agree to uphold the highest standards of integrity, sportsmanship, honesty, and good citizenship. I will encourage my team to compete fairly, honestly, and with a constructive attitude that celebrates our successes as well as those of other teams.

ACCESS TO COMPETITORS

1. Coordinate parental notification and permissions to allow their minor children to participate in the program in accordance with the current “CyberPatriot User Agreement and Privacy Policy” published by the Air Force Association.

2. Coordinate and provide permission for any student/cadet to register in the CyberPatriot Competitor Relationship Management (CRM) system. 3. Coordinate, arrange, and approve involvement with the team by any “Mentor(s)” [technical advisor(s)] or Team Assistants at the Coach’s sole discretion, whether in-person or online and whether obtained from the CyberPatriot Mentor Databank or any other source. 4. Abide by the CyberPatriot Standards of Conduct attached to this document. 5. Act as the team’s single point of contact for the CyberPatriot Program Office. ACADEMIC PROGRAM 1. Deliver basic network security training to all assigned Competitors as may be reasonably accommodated at the Coach’s sole discretion. Resources for accomplishing this training may be found on the CyberPatriot website at www.uscyberpatriot.org.


86

2. Encourage Competitors to devote some time each week to self-study/preparation for the competition. NOTE: This guidance may seem too flexible, but it is intended to spark creativity. Encouraging Competitors to take a central role in team preparation (with adult guidance and involvement) enhances both team cohesion and performance.

COMPETITION MANAGEMENT

1. Select and designate primary and alternate Competitors for each competition period. The Competitors for any single competition period must be assigned from Competitors registered in the CyberPatriot Competitor Relationship Management (CRM) System. 2. Uphold the integrity of the competition by ensuring that no more than five Competitors at a time in any particular round of the competition and those Competitors do not receive assistance from any external source. 3. Ensure that all rules of the competition as described in the CyberPatriot Rules Book and competition emails are strictly followed.

COMPETITION LOGISTICS

1. Coordinate and support all elements of the preparatory training and online competition rounds, including arranging a competition location and obtaining necessary computer equipment for training/Qualification Rounds of the competition. 2. Provide feedback to the CyberPatriot management team and coordinate feedback from Competitors designed to improve the entire program. 3. Agree to coordinate logistics for the trip with the CyberPatriot Program Office (all expenses except entertainment and personal expenditures will be funded), should the team advance to The National Finals Competition. 4. Agree to accompany the team and be responsible for supervision and guardianship during the travel and onsite at The National Finals Competition. I have read, understand, and agree to discharge the responsibilities described in the CyberPatriot Coaches’ Agreement to the best of my abilities. Signature:_______________________ Date:__________


87

APPENDIX II

CYBERPATRIOT STANDARDS OF CONDUCT Working with young people can be among the most gratifying and impactful endeavors an adult can undertake, but there are also special responsibilities that must be discharged to prevent harm to the minor. As a CyberPatriot Coach, Mentor, or Team Assistant, I promise to strictly follow the rules and guidelines in this CyberPatriot Standards of Conduct as a condition of my providing services to the youth participating in CyberPatriot. As a CyberPatriot Coach, Mentor, or Team Assistant, I will:

Treat everyone with respect, patience, integrity, courtesy, dignity, and consideration;

Emphasize ethical use of the internet and information technology skills and knowledge;

Insofar as practical, avoid situations where I am alone with an individual minor;

Use positive reinforcement rather than criticism when working with Competitors;

Refrain from giving expensive gifts to minors without prior written approval from the parents or guardian of the individual;

Report suspected abuse of any kind to law enforcement, school authorities and the local Child Protection Services agency as required by law; and

Cooperate fully in any investigation of abuse of minors. As a CyberPatriot Coach, Mentor, or Team Assistant, I will NOT:

Smoke or use tobacco products in the presence of minors;

Use, possess, or be under the influence of alcohol at any time while working with the team;

Use, possess, or be under the influence of illegal drugs at any time;

Pose any health risk to others (e.g., no contact with the team when in a contagious condition);

Strike, spank, shake, or slap any youth participating in CyberPatriot;

Humiliate, ridicule, threaten, or degrade any youth participating in CyberPatriot;

Touch a youth in a sexual or other inappropriate manner;

Use discipline that frightens or humiliates any youth participating in CyberPatriot; and

Use profanity in the presence of any youth participating in CyberPatriot. I understand that any action inconsistent with these Standards of Conduct, or failure to take action mandated by this Standards of Conduct, may result in my removal and prohibition from any future participation in CyberPatriot. Signature:_______________________ Date:__________


88

APPENDIX III SAFETY

Safety and Competitor protection are the top priorities of the CyberPatriot Program. A Coach should always consider the health and well-being of his team in choosing a competition environment.

Safety and Competitor Protection Requirements. School, organization, and local directives govern the safety and protection requirements of minors and facility standards. Some safety considerations in choosing a competition space are listed below.

- Facility Security - Crime Areas

- Trip Hazards - Adequate Lighting

- Electrical Safety - First Aid Kit

- Emergency Services Available - Vehicle Safety

- Slip areas caused by ice, snow, water, petroleum products, etc.

- Unsupervised access to Competitors by other adults in public facilities

Coaches should mitigate any safety issues through remedial action or warnings to Competitors and Mentors.

Reporting. In the event of an accident or other incident involving Competitors in a CyberPatriot event; school, organization, and local reporting procedures shall be followed. After notification of proper local authorities, Coaches should notify the CyberPatriot Program Office following a significant incident at a CyberPatriot event. Incidents of interest to the CyberPatriot Program Office are:

- Competitor who is a missing person last seen at a CyberPatriot event

- Injured Competitor requiring hospitalization

- Criminal act against a Competitor, Coach, chaperone, Mentor, competition staff, or CyberPatriot supporter

- Severe weather or natural disaster that could negatively affect the Competitors or competition

Reports to the CyberPatriot Program Office can be transmitted via email to [email protected] or by phone at 1-877-885-5716.



89

APPENDIX IV APPEAL AND SCORE CORRECTION REQUEST FORMATS (See end of appendix for Score Correction Request Format)

APPEAL FORMAT (Email)

From: (Team Coach’s Email Address) Sent: (No later than deadline, ET) To: [email protected] Subject: Appeal: (School or Organization Name) (Team Number) (State/Territory/Province) 2 Letters -- Postal Abbreviation 1. Subject of Appeal. (One Sentence) 2. Requested Action. (One Sentence) 3. Originator. (Team Coach’s Name) 4. Facts Bearing on the Appeal (One fact per subparagraph. Facts must answer the 5Ws.) a. b. c. 5. Additional Comments. (Limit 100 words) 6. Supporting Attachments. (Limit two. Official documents provide the best documentation.) 1. 2.


90

Example of an Appeal From: Shur, Ima [mailto: [email protected]]

Sent: Friday, December 09, 2011 3:48 PM

To: [email protected] Subject: Appeal: Metro High School 05-7766 NY

1. Subject of Appeal. Power Outage Prevented Metro high School Team’s Participation in Round 2.

2. Requested Action. To Compete in Round 3, CyberPatriot IV Competition.

3. Originator. Ima Shur

4. Facts Bearing on the Appeal

a. At approximately 3:00 pm EST, Friday, December 2, 2011, the Metro High School team logged into the Windows XP image for Round 2.

b. At approximately 3:30 pm EST, Friday, December 2, 2011, a snowstorm caused a power outage that shutdown our school’s computer network, until Monday, December 5, 2011.

c. The Metro High School Principal, Dr. Baker, ordered the school closed at approximately 4:00 pm and sent home all people remaining in the school. (See Attachment 1.)

d. Due to the time of day, my team was unable to move to a nearby location to continue the competition.

e. Travel on Metro area roads was becoming dangerous, so I sent the team members home. (See Attachment 2, News Story, 5th paragraph).

f. I contacted the CyberPatriot helpdesk at approximately 4:00 pm, Friday, December 2, 2011, and told the Help Desk Operator, Cadet Merri, that my team could not participate in the Round 2 of the CyberPatriot IV Competition.

5. Additional Comments (Limit 100 words). Any consideration you can give our team would be appreciated. We scored 5th overall in Round 1 and I am sure that we would have done as well or better in Round 2. If there is anything I can do to allow the Metro High School team to re-compete in Round 2, please let me know.

6. Supporting Attachments (Limit 2)

a. Letter from Principal Baker b. News Article (See Paragraph 5.)




91

Metro High School “Home of the Metro Meteorites” 1301 Gamma Drive Metro, NY 1145x December 6, 2013 From: Dr. Joseph R. Baker, Principal To: Commissioner, CyberPatriot Subject: School Closure on December 2, 2011 I ordered the closure of Metro High School, on Friday, December 2, 2011, due to severe weather and a power outage. All weekend activities were cancelled. Metro High School re-opened at 7 am, Monday December 5, 2011.

J. R. Baker Dr. J. R. Baker Principal Metro High School Attachment (1)


92

CP NETWORK Saturday, December 3, 2011 www./MetroSnowStorm14547/2/12/2011

SNOWSTORM SHUTS DOWN METRO AREA

Metro-Zimmerman Airport at 2 pm Friday

Metro, NY — A massive snowstorm shut down the Metro-Zimmerman airport, forced city buses off the streets and closed 165 miles of Interstate 95 on Friday, forcing thousands of Metroites to postpone their weekend plans.

The storm dumped more than a foot of snow in parts of Metro, Martens, and Danner. Forecasters said heavy snow was expected into Saturday evening. The heavier bands of snow were moving into northeastern New York and western Connecticut. Power outages, due to downed power lines plagued the area. More than 20,000 homes and businesses have been without power, since Friday evening.

School districts in the area, including Metro, Martens, and Danner, canceled all Friday and Saturday activities and sporting events.

Ima Shur, a teacher at Metro High School and Coach of the school’s “CyberPatriot” team, expressed disappointment in a phone call on Friday evening. She said, “I have 10 students who poured their hearts into preparing for this weekend’s Round 2 of the CyberPatriot national, on-line cyber defense competition. With the school’s power outage and the severe weather, it appears that our hopes to move on to Round 3 are dashed. It is a shame, since we had one of the highest scoring teams in Round 1.”

The New York Department of Transportation issued a "no travel" advisory for the Metro Area late Friday afternoon. A similar advisory had gone out earlier for western New York All flights in and out of the Metro-Zimmerman International Airport's main terminal were canceled for the rest of the day and Saturday.

Metro Transit began pulling its buses off the streets on Friday evening, after 70 of the agency's 220 buses got stuck.

http://www./MetroSnowStorm14547/2/12/2011


93

Light rail and the MetroQuick commuter line were still in service, and Metro Transit officials said they expected buses would be up and running again Sunday afternoon.

Airport spokesman Pat Skoch said the airport would reopen one runway to flight traffic Sunday afternoon, but by that most airlines had canceled flights anyway.

Getting around in the Metro Area was extremely difficult, as most side streets hadn't been plowed. Danner, Martens, and several other cities called snow emergencies and planned to restrict parking so that plows could clear streets.

A woman walked through Metro’s Rosslyn suburb late Friday night.

Many who tried to drive on city streets got stuck. With no buses, some tried calling taxis, which were in short supply.

"I can't really help them much," said Phil Buckwalter, a dispatcher at Rainbow Taxi in Metro. "We're only able to pick up on snow emergency routes. We can't really pick up on any side streets."

Buckwalter said only one or two taxi drivers out of the usual 50 were braving the roads. Snow totals reached 20 inches in the Metro suburb of Rosslyn by Saturday afternoon. Nearly 15 inches had fallen at the airport, Martens reported 18 inches and Danner had 17.

If the snow keeps up, it will be the largest storm since the famous "Thanksgiving Mega Storm" of 1991, when more than 28 inches of snow fell in the Metro Area and nearly 37 fell in Martens. Saturday night cultural activities were also canceled, including shows at the Zaborowski Theater in Metro.

Many Metro high school students were scheduled to take the ACT college test today, but more than 50 schools -- including those in Martens, Danner, and Dunn -- have canceled the tests.

Arctic low temperatures will follow the snowstorm. Temperatures will drop into the single digits on Saturday night, and well into the double digits below zero on Sunday night across much of the state. Lows could approach 20 below zero in western New York.

(CP Network reporters Rachel Bernie, Buck Laine, and Eric Rose contributed to this report.) Attachment (2)


94

SCORE CORRECTION REQUEST FORMAT (Email) From: (Team Coach’s Email Address) Sent: (No later than deadline, ET) To: [email protected] Subject: Score Correction: (School or Organization Name) (Team Number) (State/Territory/Province use 2 Letter – Postal Abbreviation) 1. Originator. (Team Coach’s Name) 2. Reason for Score Correction Request. (One Sentence, e.g., missing score, incorrect score) 3. Requested Action. (e.g., correct score to ??, publish missing score) 4. Supporting Documents. (Limit three. Scoring data provides the best documentation.) a. (e.g., Scoring Data With Files) b. (e.g., Complete Screen Capture of Scoring Report SCORE CORRECTION REQUEST Example (Email) From: [email protected] Sent: Tuesday, November 18, 2013 2:50 PM (Before Deadline) To: [email protected] Subject: Score Correction Request: Harvard High School, Team # 06-7XX, NY

Attached: CyberPatriotScoringData.zip;

1. Originator (Coach). Jenny Jones 2. Reason for Score Correction Request. Our team’s Windows 7 score on the Round 2 Results Email was listed as 70 points, but our Windows score was 90 points on the scoring report. 3. Requested Action. Change the team’s official Windows 7 score to 90 points. 4. Attached Documentation a. Zipped Scoring Data With Files b. Complete Screen Capture of Scoring Report


95

APPENDIX V

CYBERPATRIOT MEDIA GUIDELINES

CyberPatriot is a great opportunity for your high school or organization, such as JROTC, CAP, and USNSCC, to draw local and state media coverage. Television stations, newspapers, and radio stations are generally interested in good stories of youth doing good things, and CyberPatriot is a terrific example of that. We encourage you to work through your school administration or unit public affairs representative when handling any media inquiries. We also ask that you adhere to the following guidelines:

CyberPatriot should be written as one word, with a capital “C” and a capital “P”

At its first mention, the complete title of the program should be used: “CyberPatriot—The National High School Cyber Defense Competition”

In every release or interview please ensure the following is communicated:

CyberPatriot was established by the Air Force Association.

The Northrop Grumman Foundation is the Presenting Sponsor for CyberPatriot VI.

CyberPatriot’s founding partners are SAIC and CIAS at the University of Texas-San Antonio.

Any use of the CyberPatriot logo or other collateral must be approved by the CyberPatriot Program Office. National media inquiries may be directed to Caity Rogowski of the Air Force Association [email protected], 703-247-5800 ext 4873.

APPENDIX VI

SPONSORS AND SPONSORSHIPS The Air Force Association and its CyberPatriot Program take great care in the branding of CyberPatriot. Our sponsors must have common values with the Air Force Association and make a significant contribution to the CyberPatriot Program before they can be associated with the program. National Sponsors. Our national sponsors provide the resources to sustain the CyberPatriot Program across the United States and the globe. According to their sponsorship level, CyberPatriot’s national sponsors earned recognition in CyberPatriot events, as well as name association with CyberPatriot. CyberPatriot literature and other media contain the sponsors’ logos. National sponsors conduct their sponsorship through the CyberPatriot Program Office. Local Team Sponsors. Local sponsors may sponsor specific local teams, but may not use the CyberPatriot Logo in their advertising. If a team advances to the National Finals Competition or is involved in another event other than a team competition, the team shall not use the local sponsor’s name, logo, or other identifying characteristics. If you know of anyone interested in becoming a CyberPatriot national sponsor or if you want to know more about sponsorship, please visit our website at www.uscyberpatriot.org or contact the CyberPatriot Program Office at: Email: [email protected] Telephone: 1-900-727-3337 ext. 5806.



APPENDIX VII

TECHNICAL SUPPORT Technical support for online competition rounds will be provided by the CyberPatriot Operations Center (CPOC) and CyberPatriot Program Office, during competition windows. CyberPatriot technical support is divided into four tiers. Tier 1: CyberPatriot Operations Center (CPOC) (AFA, Rosslyn, VA) Functions. Answer, record, and resolve trouble calls at the basic level. (e.g., user error, image registration) (Air Force ROTC). Monitors CPOC Tech Support Chat. Tier 2: CyberPatriot Program Office (AFA, Rosslyn, VA) Functions. Evaluate and resolve problems escalated from Tier 1. Resolves participant registration issues. Low level tech support (command line). Tier 3: CyberPatriot Program Office (AFA, Rosslyn, VA)

Functions. Evaluates and resolves problems escalated from Tier 2. Resolves intermediate level technical issues. Low level tech support (command line). Monitors CPOC Tech Support Chat. Tier 4: CIAS , LEIDOS CyberNEXS Team, and Cisco Systems Functions. Expert technical support. Resolve system-wide issues. Trouble Calls. Telephone and CPOC Tech Support Chat are the two means to submit trouble calls. Tech Support Chat. The purpose of Tech Support Chat is to provide a forum to quickly resolve routine issues and to post fixes for issues affecting users. CPOC Contact Information Tech Support Chat Session: afa.adobeconnect.com/CPOC CPOC Telephone: 1-877-885-5716 [email protected]


APPENDIX VIII

CYBERPATRIOT COMPETITOR CODE OF CONDUCT 1. I will consider the ethical and legal implications of my online actions every time I participate in CyberPatriot. 2. I will not conduct, nor will I condone, any actions that attack, hack, penetrate, or interfere with another team’s or individual’s computer system, nor will I use the cyber defense skills I learn in CyberPatriot to develop hacking or other offensive skills. 3. I will not illegally copy or distribute software or other intellectual property. 4. I will not visit inappropriate Web sites while preparing for or participating in CyberPatriot . 5. I will not participate in or condone cyberbullying which includes such behaviors as teasing, threatening, intimidating, humiliating, sexual harassment, racial harassment, and stalking. 6. I will follow the CyberPatriot rules of competition and will accept appropriate guidance from my Coach. 7. I will not tamper with, modify, or attempt to manipulate any element of the CyberPatriot competition or scoring systems. 8. I will not attempt to deceive, hoax, or “prank” other teams by forwarding or posting erroneous or deceptive information on the Internet, by email, or on social networking sites. 9. I understand that violation of this code of conduct is grounds for my immediate dismissal from my team and the disqualification of my team from CyberPatriot competition. 10. I will strive to use my participation in CyberPatriot to further my understanding of cybersecurity. Signature:_______________________ Date:__________

APPENDIX IX COACH ALTERNATE REQUEST

Coaches ensure that minors participating in the competition are protected and that parental prerogatives are respected. (See Chapter 1.) A Coach Alternate is expected to assume the Coach’s responsibilities for protection of minors and to preserve the integrity of the competition by ensuring that all competitors conduct themselves in a fair, ethical, and sportsmanlike manner. *From (Coach’s Information) Last Name: First Name: *Must match file information. Team Number: 06- Email Address: School Name/Organization Name: Coach’s Contact Telephone Number: I will be unable to participate in the CyberPatriot Competition during Round of Substitution. I request that CyberPatriot competition-related email for my team be sent to my Coach Alternate (NAME OF COACH ALTERNATE) Below is his or her contact information: Email Address: Contact Phone Number: I certify that (NAME OF COACH ALTERNATE): Agrees to the Coaches' Agreement and Standards of Conduct in the CyberPatriot Rules Book at the Link. Additionally, I certify that: My Verification Official verified that (NAME OF COACH ALTERNATE) is authorized work unsupervised with minors in accordance with the youth protection and other policies of my school or organization. OR I certify that (NAME OF COACH ALTERNATE) is authorized work unsupervised with minors in accordance with the youth protection and other policies of my school or organization. If you have any questions, please contact the CyberPatriot Program Office at [email protected] or 1-877-885-5716.


APPENDIX X

HOME SCHOOL PARENTAL/GUARDIAN APPROVAL FOR CYBERPATRIOT COACH I the parent/guardian of _________________________ hereby give my permission for my (Child’s Name)

child’s CyberPatriot Coach _________________________________ to have unsupervised (Coach’s Name) access to my child during CyberPatriot activities. I understand that in the absence of a governing body for my home school, that I am the verification official for the background of the CyberPatriot Coach and take full responsibility in allowing the Coach to interact with my child. Parent/Guardian Name: ____________________ Signature: _________________Date:______ Witness Name: ____________________ Signature: ____________________ Date: ______

APPENDIX XI CYBERPATRIOT CENTER OF EXCELLENCE PROGRAM

The CyberPatriot Center of Excellence (COE) program recognizes higher education institutions, government organizations, and other entities for exceptional support in promoting and supporting the CyberPatriot program. ELIGIBILITY COE eligibility is open to:

• Non-profit organizations • City, county, and other municipalities • Non-profit consortia of organizations, firms, or businesses in relevant areas , e.g.—

technology, STEM education, cybersecurity • State or other groupings of participating organizations, e.g.—State-wide Wings of Civil

Air Patrol, Scouting Councils • School districts • School collectives, e.g.—academy groupings, home school co-ops • Higher education institutions such as community colleges, colleges, and universities

Eligibility is not open to: • For profit corporations or businesses • Entire states • Individual schools • Individual CyberPatriot teams

BENEFITS COEs are recognized as leading institutions and organizations in promoting STEM and cyber education. COEs receive additional attention from the CyberPatriot program in piloting new programs and processes, are eligible for additional sponsor support to include grants and internships and may be targeted as recipients for hardware or software grants. COEs also receive regional and national media attention from the CyberPatriot program. SELECTION CRITERIA COEs are selected based on:

• Success in recruiting high school and other teams to the CyberPatriot program • Persistent promotion of CyberPatriot through media attention and by other means • Sustained support of the CyberPatriot mentor program • Success in building civic, community, industry, and education partnerships in promoting

CyberPatriot • Demonstration of support and recognition to CyberPatriot teams in the community

RECOGNITION ELEMENTS COEs receive a framed certificate and electronic logo that they may publish and display.

APPLICATION PROCESS Nominations consist of a one-page written statement addressing why the eligible entity should be awarded COE status and a forwarding cover letter signed by the head of the entity asking for COE consideration. . Explanations should include concrete examples of the entity’s efforts to promote CyberPatriot. The one-page statement should be attached to Applications are considered and approved by the CyberPatriot Commissioner within 30 days of receipt based on staff recommendations. Applications received that are over one page in length or which are not accompanied by a signed cover letter will not be considered. SUBMISSION Applications may be submitted any time by email (including a scanned copy of the signed forwarding letter) to [email protected] or by U.S. Mail to: The Air Force Association CyberPatriot Program Office, Suite 400 1501 Lee Highway Arlington, VA 22209-1198


CyberPatriot VII: Rules Book Amendments From CyberPatriot VI (Version 1)

(Amendments 1 – 4)

As of August 1, 2014, the following portions of the CyberPatriot VI Rules Book have been implemented. The CyberPatriot VI Rules Book will be superseded by future amendments and the CyberPatriot VII Rules Book prior to the start of the CyberPatriot VII Practice Round. Amendment 1. Team rosters are now limited to two to six Competitors rather than two to 10 Competitors.

Change Paragraph 1006.2. to read: “Competitors (roster of two to six total, only five may compete at any one time during a competition round. Members who are not competing may not assist the team.)

Change Paragraph 1009 to read: “COMPETITORS. A CyberPatriot team consists of a minimum of two and a maximum of six registered Competitors. A registrant becomes a Competitor when they receive consent to compete from a parent or legal guardian. During competition, two to five Competitors may compete at a time. Substitution of team members is at the Coach’s discretion during the online rounds of competition. A Competitor shall compete on only one team during a CyberPatriot season.

Figure 1-3 should reflect the change of the new roster size.

Amendment 2. Coaches may now lead up to five, rather than three, teams.

Change Paragraph 3002.c. to read: “Coaches of Multiple Teams. An adult may register as a Coach for up to five CyberPatriot teams from the same or different schools, organizations, or Divisions under the following conditions:”

Change Paragraph 3002.c.(2) to read: “Verification. Verification officials shall separately verify a Coach for each registered team. This will require timely response by the Verification Official for up to five separate verification emails.”

Amendment 3. Coaches may use one email address to register all five of their teams rather than require use a unique email address for each team.

Delete Paragraph 3002.c.(3) Unique Email Address.

Amendment 4. The CyberPatriot Competition Design has been updated to reflect middle school participation and competition tiers based on team performance.

Replace the content in Chapters 6, 7, and 8 with the following articles for each Competition Division from the June 2014 edition of The CyberSentinel.

Update the Advanced, Intermediate, and Basic tiers in the graphics below to the Platinum, Gold, and Silver tiers respectively.

http://www.uscyberpatriot.org/Documents/CyberSentinels/Final_CyberSentinel_June2014.pdf

CP-VII Brackets: Open Division

Qualification Rounds . CP-VII Rounds 1 and 2 are the same as CP-VI. All Open Division teams can participate in these rounds. A team’s performance in Round 1 does not affect its ability to compete in Round 2. Teams missing Round 1 can participate in Round 2.

Advancement to the State Rounds. Team scores from Rounds 1 and 2 are added together to determine placement in one of the three tiers. Each of these tiers (Platinum, Gold, and Silver) has a State and Regional Round. The Platinum Tier leads to the National Finals Competition.

Teams in the top 30% of combined Round 1 and Round 2 scores are placed in the Platinum Tier. Teams in the middle 40% of combined scores are placed in the Gold Tier, and the remaining 30% are placed in the Silver Tier.

Tier placement is permanent. Teams may not be promoted or demoted and may not self-select tiers. For awards purposes, Platinum teams are always higher than Gold teams, which are always higher than Silver teams.

State Rounds. All teams may participate in a State Round corresponding to their tier placement. The State Rounds will have different difficulty levels at each tier. Teams that missed Rounds 1 and 2 may participate in the Silver Tier State Round. The top three teams overall in each state, regardless of their tier, will be given AFA State Awards following the rounds.

Advancement to the Regional Rounds. Advancement occurs in two stages. First, the top 3 teams in each state at each tier level are advanced. Second, the teams with the top 12 highest scores in the State Rounds that are not within the top three for their state advance as Wild Cards. All teams advancing to Regional Rounds receive Tier Certificates for their achievement.

State Awards and Advancement Example. To illustrate the State Awards and Advancement process, see the June 2014 edition of The CyberSentinel.

Regional Rounds. Like State Rounds, Regional Rounds have different difficulty levels at each tier. The top three within each Region overall, regardless of tier level, win an AFA Regional Award. Regional Awards are based solely on teams’ performances in the Regional Round. State Round performance and awards are not factors. The top three teams in each region within each tier will receive Tier Certificates.

Advancement to the National Finals Competition. Teams with the top 12 scores in the Platinum Regional Round will advance to the National Finals Competition. Geography is not a factor in National Finals advancement.


CP-VII Brackets: All Service Division

Qualification Rounds. Rounds 1 and 2 are the same as previous seasons. Every All Service Division team can participate in these rounds. A team’s performance in Round 1 does not affect its ability to compete in Round 2. Teams missing Round 1 can participate in Round 2.

Advancement to the State Rounds. Team scores from Rounds 1 and 2 are added together to determine placement in one of the three tiers. Each of these tiers (Platinum, Gold, and Silver) has a State and Category Round. The Platinum Tier leads to the National Finals Competition.

Teams in the top 30% of combined Round 1 and Round 2 scores for their category are placed in the Platinum Tier. Teams in the middle 40% of combined scores in each category are placed in the Gold Tier, and the bottom 30% in each category are placed in the Silver Tier.

Tier placement is permanent. Teams may not be promoted or demoted to different tiers and may not self-select their tier. For awards purposes, Platinum teams are always higher than Gold teams, which are always higher than Silver teams.

State Rounds. All teams may participate in a State Round corresponding to their tier placement. The State Rounds will have different difficulty levels at each tier. Teams that missed Rounds 1 and 2 may participate in the Silver Tier State Round. The top three teams overall in each state, regardless of their tier or category, will be given AFA State Awards following the rounds.

Advancement to the Category Rounds. Advancement occurs in two stages. First, the top six teams in each category in each tier advance to the Category Round. Second, the teams with the top six highest scores in the State Rounds, regardless of category, among the remaining teams advance as Wild Cards. All teams advancing to Category Rounds receive Tier Certificates for their achievement.

State Awards and Advancement Example. To illustrate the State Awards and Advancement process, see the June 2014 edition of The CyberSentinel.

Category Rounds. Like State Rounds, Category Rounds have different difficulty levels at each tier. The top three within each category overall, regardless of tier level, win an AFA Category Award. Category Awards are based solely on teams’ performances in the Category Round. State Round performance and awards are not factors. The top three teams in each category within each tier will receive Tier Certificates. There are no Regions in the All Service Division.

Advancement to the National Finals Competition. The top two teams from each category and one Wild Card in the Platinum Category Round will advance to the National Finals competition.


CP-VII Brackets: Middle School Division

Practice Round 2. Because CyberPatriot VII is the first season for the wide release of the Middle School Division, middle school teams will get an extra practice round to familiarize themselves with the competition and gain cybersecurity training before the scored rounds of competition begin.

Qualification Rounds . All Middle School Division teams can participate in these rounds. A team’s performance in Round 1 does not affect its ability to compete in Round 2. Teams missing Round 1 can participate in Round 2.

Advancement to the Semifinals. Team scores from Rounds 1 and 2 are added together to determine placement in the Semifinals. Teams in the top 50 percent of combined Round 1 and Round 2 scores are placed in the Semifinals.

Semifinals and State Awards. The three teams in each state with the highest Semifinals score will receive AFA State Awards. If a state has fewer than three teams participating in the Semifinals, any missing spots will be filled by non-Semifinalist teams with the highest Round 2 scores. There are no Regions in the Middle School Division.

Advancement to the National Finals. The three teams with the highest scores in the Semifinals will advance to the National Finals Competition.