By Amber Kennedy
As a kid, James Whittson played "Capture the Flag" at summer camp near Asheville, North Carolina, racing to bring an opposing team's pennant back to base. But now, Whittson plays a more sophisticated version of the childhood game, intended to test the computer safety knowledge of cybersecurity professionals.
Whittson, a 37-year-old graduate student in Old Dominion University's School of Cybersecurity, scored a big win in the world of "Capture the Flags," or CTFs, when he took first place in a competition promoted by the National Institute of Standards and Technology. The competition, timed to coincide with National Cybersecurity Career Awareness Week from Oct. 18-23, tested participants' knowledge of cryptography, networking, web applications, reconnaissance and more. Whittson bested more than 500 competitors.
Whittson likes the challenge of CTFs - part code-cracking, part detective work - and has found one of his secrets to success has been learning keyboard shortcut commands to speed up the process.
"Flag creators take a piece of data and hide it either in a website, program or a whole computer," Whittson said. "Then you take your sleuthing skills, apply them to the breadcrumbs that you find and see if you can find the flag."
Some CTFs can be set for hours, others for days. He often learns about the opportunities through the ODU Cyber Security Student Association, which organizes its own conferences and competitions.
"Our students' participation and success in such competitions reflects their enthusiasm and the quality of the technical knowledge gained at ODU," said Saltuk Karahan, program coordinator and advisor for the School of Cybersecurity. "They partner with industry, expand their knowledge in conferences, create new challenges and keep honing their skills in this continuously growing field."
The recent CTF occurred over three days, and Whittson admits it was hard to focus on anything else when he was trying to crack the code. He had to solve approximately 49 puzzles, sometimes recruiting the help of his wife, who is a whiz at cryptograms.
"When I have a CTF lined up, I probably devote too much time to it, but I don't even look at it as a game," he said. "It's a learning experience."
The challenges are a great training tool for any aspiring cybersecurity professional, forcing participants to acquire new skills in the process, Whittson said. He thinks they would be an excellent resource to help companies train their employees on best practices for safe use of devices.
Industry partners have told educators that CTF competitions are important for training, said Hongyi "Michael" Wu, director of the School of Cybersecurity. "Competitions engage and motivate more students to fill the talent gap in cybersecurity," he said. "They encourage players to hone cybersecurity skills, build confidence and gain real-world experience."
Wu noted Whittson's win is a testament to the quality of ODU's program. "I am very proud of James' achievement for winning this highly competitive national cybersecurity competition. It demonstrates his academic success beyond a perfect 4.0 GPA," he said.
Whittson started his education as a biology major but quickly realized his true love was technology. He completed an undergraduate degree in cybersecurity and information assurance through Western Governor's University. He spent some time on Best Buy's Geek Squad, then worked for Duke University and the Federal Deposit Insurance Corporation. Although he had plenty of hands-on experience, Whittson wanted to formalize his education in hopes of taking on leadership roles.
Attending ODU for graduate school has supplied an "understanding of policies, procedures, governance and the leadership and management side of things," Whittson said.
Nationally, the cybersecurity industry's available jobs are outpacing the skilled workforce. A host of factors - increased ransomware attacks, the rise of telemedicine and a transition to remote work - have recently brought the need for cybersecurity professionals and safety awareness to the forefront.
Whittson would like at least part of his future career to include cyber safety education. For seven months, he's helped teach a security boot camp through George Washington University, providing instruction to school principals, nurses, psychology grad students and others. "It was really eye-opening to see the influx of people from so many spectrums," he said.
After graduation from ODU, Whittson is interested in pursuing security engineering and architecture but knows sharing what he's learned will always be part of his career, even if he's offering free sessions on securing phone data. "We need people to be aware of the vulnerabilities," he said. "I want to give back to the community and be a mentor."
