Fear and loathing defending ICS security at DoE's CyberForce Competition

"The HPC is down!"

"But the competition just started!"

Our high-performance computing cluster (HPC) blinked red on the big screen. Minutes ticked by.

"Get it up! Get it up! We're losing points!"

"Working on it!"

Red team had been circling since the day before, hawks swooping and diving. They'd been scanning and probing all day Friday, but weren't allowed to attack until the checkered flag dropped Saturday morning at 8 a.m. We'd hoped to evade their talons, but they wasted no time, and now one of our critical assets blinked out--a meal for a hungry predator.

Our blue team was tasked with defending a mock oil refinery's industrial control system (ICS), the HPC and the integrated back-office IT system—all of it default insecure, some of it insecure by design—and the only real defense active monitoring and split-second eviction before red team could take us down.

"The HPC isn't coming up. What is going on?"

Four Raspberry Pis running the oil refinery and HPC sat on the table in front of us, water pumps clicking on and off. Click-click. Click-click. Click-click. Someone else was in control. Not us.

Meet Big Oil Logistics and Transportation Corporation (BOLT Corp), its ICS, and an HPC running on four Raspberry Pis.

Across the country in seven different Department of Energy labs, university teams fought alongside us to defend identical infrastructure. The DoE runs its CyberForce competition every year to introduce college cybersecurity students to the challenges of securing critical energy infrastructure, and to recruit the best and brightest. We were the UC Berkeley team representing the Berkeley iSchool's new Masters of Information and Cybersecurity (MICS, pronounced "mikes") program, and I was not only reporting on the event, I was playing to win.

The six of us hunched over our laptops in the competition space at Berkeley Lab, perched cliffside just east of the UC Berkeley campus, too distracted to enjoy the view of the Golden Gate Bridge, San Francisco Bay and the iconic Berkeley Campanile, the picture postcard bell tower. For eight hours we fought to keep our systems up and red team out, until, by the end, the uncontrollable twitch in my right eye told me I had chewed on too much stress for one day.