1. Devote 5-10 minutes to explaining the CyberPatriot Competition System (Instruction Slides 3-4). Allow hours for students to work on the competition images and minutes for closing remarks and awards.
If computer resources allow, each team of 2-3 students should have two computers, so it can work on both competition images simultaneously. As long as teams did not receive significant instructor guidance in preparing their notes, they can use them during the competition.
It can take up to a few hours to download the images and 5-10 minutes to unzip each image, so complete these steps in advance of starting the Friday Camp Competition.
The CyberPatriot Program Office can be reached for support by at or by phone at during normal ET business hours.
The CyberPatriot competition images you have been provided are the intellectual property of the Air Force Association and should be removed from all computers after your competition. The images are to be used only by the students and only during your camp’s scheduled competition window. Keeping images past the end of your camp is not authorized.
Module 5

2. CyberPatriot Competition!
AFA CyberCamp Format
Day One
Cyber Safety
Day Two
Windows System Administration
Day Three
Intermediate Windows Security
Day Four
Intro to Linux and Ubuntu Security
Day Five
CyberPatriot Competition!
Today is competition day! It is time to put what you learned about cyber safety, Windows security, and Linux security to the test.

3. Module Five Outline CyberPatriot Competition System Overview
Closing Remarks and Awards
After a short walkthrough of how the CyberPatriot Competition System (CCS) works, your teams will dive into the competition.
You will have a few hours to work on the competition images, after which we will tally the scores and announce the winning team.

4. How the Competition Works
Earn points by fixing vulnerabilities in the image
Lose points for making the system less secure
Harden your system and defend against outside attacks by starting with hints in the ReadMe file on the desktop
In the event of a tie, the winning team will be the one that scored its last point first
Click to reveal first bullet.
Your team will earn points by finding and correcting the vulnerabilities in the competition images on your desktop.
Click to reveal second bullet.
Your team will lose points, though, if you do something that makes the system more vulnerable to attack.
Click to reveal third bullet.
In your efforts to improve the system, you must follow guidelines and requirements, like those you would be assigned in a job as an IT professional. For example, the simulated computer might be used by five people in Company XYZ, but your bosses only want two or three of those people to have access to certain files.
Those mock requirements, as well as hints on where problems exist in the system will be outlined in a text document on the desktop called a ReadMe file.
Note that some vulnerabilities may not be in the ReadMe file.
In the event of a tie, the winning team will be the one that scored its last point first.

5. DO NOT OPEN, MODIFY, OR DELETE ANYTHING IN THE “CYBERPATRIOT” FOLDER
How Scoring Works
Use the CyberPatriot Scoring Report to check your score and your connection status
As you work through the competition image, your team’s progress will be automatically transmitted to the CyberPatriot Scoring Server.
It is therefore, essential that you maintain an Internet connection.
You can check your team’s score and connection status at any time by opening the CyberPatriot Scoring Report from the shortcut on the desktop.
Note that there are more vulnerabilities in the image than those being scored. That is, you might do something that improves the system, but does not earn your team points. The goal of the competition is to harden the system as completely as possible in the provided time.
The points on your scoring report are updated approximately every two minutes. If you have speakers on your computer, turn them on to a low volume. When you gain or lose points, CCS will play a sound cue (a chime or siren, respectively).
Click to reveal warning in red text.
The competition images each contain a folder called “CyberPatriot.” DO NOT OPEN, MODIFY, OR DELETE, ANYTHING IN THIS FOLDER. The CyberPatriot Competition System (CCS) will not work properly without all of these files and your scores might be lost.
DO NOT OPEN, MODIFY, OR DELETE ANYTHING IN THE “CYBERPATRIOT” FOLDER

6. COMPETITION! Instructions Open the competition images in VMware.
**The password for the “student” user account in the Ubuntu image is Cyb3rCont3st. The Windows 7 image will automatically log you into an administrator account. The password for the Windows 7 admin account is also Cyb3rCont3st.
Enter the ten-digit hash you have been assigned into the Team ID pop-up window.
Use the CyberPatriot Scoring Report to check your connection status.
Open the ReadMe file for instructions.
**DO NOT CHANGE THE PASSWORD ON THE ADMINISTRATOR ACCOUNT YOU ARE USING IN EITHER IMAGE.
It is recommended that students are given a hour Competition window. To simulate the real CyberPatriot competition the time period should be continuous without breaks.
Distribute the team numbers and hashes you were provided by the CyberPatriot Program Office. Remember to make a note of which team received which hash.
When you are ready for the students to begin, click to reveal each line of instruction.
Leave this slide up on the projector until teams are up and running.
If the students accidentally enter the wrong Team ID into either of their images, there is a shortcut on the desktop of both images called “CyberPatriot Set Unique Identifier” that will allow them to re-enter their ID.
To avoid accidentally locking themselves out, students should not change the password of the administrator account they are using in either of the images (the “student” account in Ubuntu and the “user” account in Windows). If they do lock themselves out of the main administrator account, they can try logging into one of the other administrator accounts outlined in the image’s ReadMe file and using that account’s admin rights to reset the password of the “student” or “user” administrator account. If they are unable to log themselves back in, the students will need to unzip a new copy of the relevant competition image and start over using their notes.
Visit to set up a countdown clock. Enter the amount of time you are allowing teams to complete and then switch to the countdown timer on the projector. When the timer runs out, the students should power off the images.
Remind students to check their local Scoring Report regularly to make sure they are still connected to the server.
You can monitor the teams’ scores using the local score report on each team’s computer. At the end of your competition window, use the local scoreboard on each computer and your list of hashes to identify and announce the top teams.

7. Be safe, be ethical, and be proactive.
Conclusion
Cyber is everywhere - you can’t avoid it, nor should you.
Be safe, be ethical, and be proactive.
Visit for more information on how to compete in the National Youth Cyber Defense Competition.
Ask students to review what they learned during the camp.
Announce the winning team of the CyberPatriot Competition and present any prizes you have acquired for the students. Many sites recognize all students with a participation certificate and the 1st, 2nd and 3rd place winners with a special prize – the recognition is up to each host site’s discretion.
If you would like to print and present certificates to each of your campers, a template is provided on your Camp Coordinator Dashboard
Click through to reveal closing text.