Data breaches and cyber hacks are a major concern for businesses, organizations, and governments. Hacks disrupt operations, put sensitive information at risk, harm an organization’s reputation, jeopardize national security, and cost the economy billions of dollars each year. The Penn State Hack Response Simulation 2019 competition, designed by Penn State faculty, was put together to help faculty develop interdisciplinary educational approaches to hacks and to help students know how to understand the full range of necessary steps to address and minimize harm from security breaches.

How is the competition structured?

Interdisciplinary teams of faculty and students (randomly assigned by the simulation planners) will learn how easily systems are breached through witnessing in real-time a simulated cyber hack. Participants will see and learn how easily and quickly a hacker, using openly available software, breaches a system. Faculty and students then collaborate on teams to formulate the best course of action, including defensive and offensive measures, preservation of evidence requirements, legal notice requirements, and the reputation and public relations side of handling a hack. Teams will present their team’s response to an executive board of Penn State faculty, alum, and legal and technical scholars. A winning team will be selected and each individual team member on the team will receive a prize.

Teams will be charged with answering questions related to the following:

How is the hack detected and how was the system breached?
How should the system be secured?
What data was accessed and what data was taken?
Can the nature of and intent behind the hack be determined? Malicious or white hat hacker?
Can the identity of the hacker be determined?
What defensive measures can be used?
Can the hacked entity’s IT professionals hack back?
Should/must law enforcement be involved?
Is the hack, as well as any associated damages, covered by the business’s insurance policies?
Other legal compliance requirements and risk management topics must be addressed, including: electronic evidence preservation, notice to affected individuals, information sharing with law enforcement, national security, applicable non-disclosure agreement contractual requirements
Public relations/communication response

The closed cyber hack simulation will involve a hack and system breach and theft of data that potentially consists of some or all of the following data: PII, biometric data, medical data, and national security information.

The project was designed by Anne Toomey McKenna, Distinguished Scholar of Cyber Law and Policy and Professor in Practice, and Russell Houseknecht, Lecturer in Information Sciences and Technology.

Tentative Itinerary

8:30–9:00 a.m. — Meet and greet, with coffee and bagels, pick up team assignment information

9:00–9:15 a.m. — Welcome remarks, introduction of speakers, and hack executive board (Jenni Evans)

9:15–9:45 a.m. — Overview of hack response simulation – facts, objectives, rules, team submission process, goals, team ranking criteria (Anne McKenna)

9:45–10:15 a.m. — Hack simulation (Russ Houseknecht and Anne McKenna)

10:15–Noon — Teams breakout for team hack response development

Noon — Team responses electronically submitted to executive board

12:00–1:15 p.m. — Catered lunch

1:15–3:00 p.m. — Executive board members review the team hack responses by area of executive board member knowledge/expertise and identify criteria in board members’ respective evaluations, with interactive audience Q&A

3:00–3:30 p.m. — Executive board announcement of first place team and presentation of awards; wrap-up

Executive Board

Wyatt DuBois, Assistant Director, Office of Strategic Communications
Pete Forster, Associate Teaching Professor of Information Sciences and Technology
Amy Gaudion, Associate Dean for Academic Affairs and Assistant Professor of Law, Dickinson Law
Mike Hohnka, Research and Development Engineer, Applied Research Laboratory
Jim Houck, Director, Center for Security Research and Education
Russ Houseknecht, Lecturer in Information Sciences and Technology
Anne McKenna, Distinguished Scholar of Cyber Law and Policy and Professor in Practice, Institute for CyberScience and Dickinson Law
The Honorable Thomas Vanaskie, Judge, United States Court of Appeals for the Third Circuit
Donald Welch, Chief Information Security Officer