Students in Embry-Riddle Aeronautical University’s Cyber Intelligence and Security Department earned the top three spots at a regional cybersecurity competition in Arizona, where teams were tested on technical expertise and incident-response skills while investigating a simulated cyberattack on a fictional water-treatment company.

More than 100 participants on 31 squads took part in the 14th annual Tracer FIRE (Forensic and Incident Response Exercise) event, sponsored by Sandia National Laboratories and held Oct. 24-25. Embry-Riddle’s joined the competition from the Prescott Campus student union.

First-place team, Dark Pentad, earned the highest score by examining computer systems and network records, analyzing malicious software and briefing judges on who carried out the attack, how it unfolded and how the organization could strengthen its security.

The team included seniors Joseph Rohani, Jacob Heusuk, Alexander Bieniek, Alec Parish and sophomore Mark Higdon. Parish described how the squad reached a stage of the investigation he had not reached in previous Tracer FIRE competitions. His team spent about an hour searching for a file using Velociraptor, one of the exercise’s forensic tools.

“The malware analysis was tremendous,” Parish said. “It was our biggest breakthrough, but it was also the place that we got stuck on the most and the thing we spent the most time on.”

Heusuk said the competition also gave students a chance to interact with the professionals at Sandia, a national science and engineering laboratory that delivers technology and research to resolve the nation’s most challenging security issues.

“We’re able to represent ourselves to them, and they provide room for us to compete and refine our skills while they scout potential talent,” he said. “It’s a good opportunity for both of us.”

The students’ performance was praised by the competition’s organizers with Sandia.

“We were impressed with the students at Embry-Riddle Prescott,” said Casey Haynes, Sandia Cybersecurity Initiatives researcher who co-ran the event with colleague Sylvian Jones. “There haven’t been many instances in the history of the program where multiple teams have finished the scenario in its entirety.”

The challenge ran overnight between Saturday’s technical sessions and Sunday’s final debriefs. Several Embry-Riddle students worked through the night, said Dr. Krishna Sampigethaya, chair and professor of the Department of Cyber Intelligence and Security.

Since most of the leading teams completed the entire set of challenges, the final incident response debrief presentations ultimately differentiated the top teams.

“Cyber is not just about completing technical challenges. It relies on connecting the evidence, building a coherent incident narrative and communicating findings,” Sampigethaya said.

Second-place team, Desert Eagle, included juniors Ben Higgins, Aaron Tulino, Philipp Shchetinin and James Goyer.

“We’re essentially acting as forensics for hire,” Higgins said of the competition. “We needed to figure out what happened in the fake company’s systems and determine which threat actor was most likely responsible.”

Together, they identified phishing emails used to gain access to the company’s systems and compared the evidence with descriptions of fictional threat groups supplied by organizers.

Although the company and attackers were invented for the competition, Tulino said the exercise was designed to give students a realistic investigation to test their knowledge.

“They get real captures and real logs of real systems,” he said. “They do a good job of putting together a realistic example of what an actual attack might look like.”

For Goyer, the experience connected classroom fundamentals with decisions students would face while responding to an actual incident.

“Events like these give real-world experience and also something to put on your resume,” he said. “The possibilities that events like this open up for you are where this education really shines.”

The third-place team was made up of first-year students Hunter Varin, Jack Ruggeri, Sophia Penick, Diego Fitzpatrick and Alex Arroyo.

“It was a close competition that came down to the wire,” Sampigethaya said.