On this page
Manual
Competition Components
Gymnasium
The Gymnasium opens prior to the start of the Practice Game. It contains guided challenges to help you prepare for the rest of NCL. Participation in the gymnasium is not required but is recommended.
Practice Game
The Practice Game is a week-long practice event that is used to make students familiar with the NCL Games. Participation in the Practice Game is not required, but is recommended to help new Student Players prepare and returning Student Players refresh for the Individual and Team Games. Collaboration is allowed for the Practice Game.
Individual Game
The Individual Game is where you compete against all the Student Players in NCL, even the other Student Players from your school. Performance from the Individual Game is used to award prizes and calculate your school's Cyber Power Ranking. You must compete in the Individual Game to be eligible for prizes, obtain a Scouting Report, and represent your school in the Cyber Power Rankings. You may not receive any assistance from anyone else during the Individual Game.
Team Game
The Team Game is where you compete with the other members of your team against all the other teams in NCL, even other teams from your school. Performance in the Team Game is used to calculate your school's Cyber Power Ranking. You may receive assistance from members of your team but may not receive assistance from anyone else.
Players still set up their team after they have completed their individual registration for the season. The team set up process can only be done by the Student Players. Faculty Coaches cannot assign teams via our system. Any Student Player who does not complete the team setup process prior to the deadline will be placed on a solo team by themselves. Each team may have up to 7 Student Players and do not need to be from the same school.
Scoring
The goal of the competition is to achieve the best rank. A smaller (lower) numerical rank is better than a higher (larger) rank (i.e. a rank of 1 is better than a rank of 2).
Each Game (Practice, Individual, and Team) has its own leaderboard and rankings. Ranking in any Game does not impact the rankings in any other Game.
There are 3 factors that determine an individual's or team's rank:
Points
Points are earned upon the submission of a correct answer to a question. Point values for questions vary and are denoted next to each question.
Ties on points are broken with accuracy
Accuracy
Accuracy is determined by dividing the total number of correct answer submissions by the number of total answer submissions.
Ties on accuracy are broken with time of last correct submission
Time of Last Correct Submission
A timestamp is taken when a correct answer submission is made. Incorrect answer submissions or hint redemptions do not update the last correct submission timestamp.
Ranks are assigned in the same way for both individual competition and team competition - in ascending order based firstly on the individual or team that has the most points.
Hints
Some questions feature hints to help guide Student Players to the correct answer. Points may be deducted upon the redemption of one of these hints. The cost of redeeming a hint is indicated prior to the redemption of a hint and the individual or team must have sufficient points to redeem the hint. Some hints have no point cost and may be redeemed for free. There is no penalty for redeeming free hints; however, the redemption of the hint will be marked on that individual or team’s performance report.
Points
Individuals and teams earn points by correctly answering questions within each Game. Questions are grouped into challenges, which tie questions together based on a common scenario.
Each challenge will have a maximum number of attempts available to answer all of the questions within that particular challenge (this is typically set to 5 attempts per question for individual-based events and 10 attempts per question for team-based events). Attempts are pooled between questions so correctly answering a question with fewer attempts allows for additional attempts for other questions within the same challenge. It is also possible to consume too many attempts on a question, resulting in the inability to submit an attempt for an unattempted question. Players may not attempt to solve a question through brute force means. The number of remaining attempts for a challenge will be indicated on the left sidebar of the page.
Specific questions may also have their own maximum attempt limit which will be displayed on the question itself. If the maximum attempt limit for a question is reached, no more attempts may be made for that question regardless of how many attempts are still remaining for that challenge.
The types of questions will vary depending on the category and specific challenge. Some may ask the Student Player to perform analysis work and submit results such as an anomalous IP address or an attacker’s username.
Flags
Some questions may require you to capture a “flag” and submit that as proof of work. A flag is a stand-in for what might otherwise be sensitive or secret information (e.g. a social security number or other personally identifiable information). The format of the flag is standardized to ensure easy identification. The flags within the NCL competition will be in the format: SKY-ABCD-####. All flags will be 13 characters long and consist of 3 groups of characters, separated by dashes. The first group will be the letters “SKY”, followed by a group of 4 random letters, and finally a group of 4 random numbers. Flags are not case sensitive.
Results and Rankings
What is a Scouting Report
The NCL Scouting Report is a document that provides evidence of a Player’s demonstrated skills. It provides a granular level of detail on a Player’s performance including rankings, points, accuracy, and completion in each of the nine categories. Each challenge listed in the Scouting Report also includes a brief description of the skill that it measures.
There are multiple uses for the Scouting Report, including:
- Identifying possible careers - The NCL categories are mapped to the NICE Workforce Framework and the Scouting Report will indicate possible job roles that align strongly with each category. Players can use this to explore and consider careers that match to their natural interests and strengths.
- Tracking skills for career readiness - The NCL Games include challenges that professionals encounter in the real world. The Scouting Report provides granular detail on the specific tasks that Players performed during the games, allowing Players to identify what skills they have developed and which ones to continue working to become job-ready.
- Assisting in the hiring process - During the hiring process, employers are trying to identify if candidates have the skills to do the job. Participation in the NCL games provide Players with experiences they can talk about in the interview - like how they used Splunk to identify a hacker’s IP address from a log file. This experience is invaluable in the hiring process and the Scouting Report will provide the evidence of the Player’s claims.
How to obtain a Scouting Report
All Players who participate in the Individual Game will be eligible for a Scouting Report. Scouting Reports are generated at the end of each season once all post-game audits have been completed. Players will be emailed a copy of their own Scouting Report and Coaches will be emailed a copy of all of their students’ Scouting Reports.
You can also follow these instructions to access your Scouting Report once they have been generated.
How to use your Scouting Report
A great way to show employers how you performed in NCL is by incorporating your Scouting Report into your resume. There are many ways to do this; we encourage you to get creative and do what's best for you! A few methods include:
- Provide a link to your online Scouting Report (this can be found in the email with your Scouting Report.)
- Under the "achievements" section of your resume. Make sure to describe key tasks that you completed and tools that you used.
- Take a screenshot of your scorecard (located at the bottom of the first page of your Scouting Report) and insert it as an image into your resume.
Another way to show employers your experience outside of the classroom is to add your Scouting Report to your LinkedIn profile.
Live Reporting
During each NCL game, live performance reporting is provided directly in the Cyber Skyline platform. There are two primary views for live reporting: the leaderboard and the score report.
In each of these views, data can be segmented in two ways: by group and by topic. Group segmentation allows users to view results for all Players, only Players within their experience level, and other Student Players who have accepted the same Coach Observation URL. Topic segmentation allows users to view results for all challenges or a specific topic. Both methods of segmentation can be used simultaneously.
The leaderboard lists the performance of Players in descending rank. Players will be able to see the leaderboard and their rank within the selected group. Information on the leaderboard includes each Players’ rank, their handle, their number of points scored, their accuracy, how long ago they made their last correct submission, and their percentage of completed challenges. The leaderboard view also provides a timeline of the top Players in the selected group.
The score report provides more in-depth details about a Players’ performance and provides a comparison to the aggregate performance of the other Players. Again, segmentation can restrict the reporting to include specific groups or specific topics. The score report lists a Players’ own ranking, number of points scored, accuracy, percentage of completed challenges, number of attempts, number of correct attempts, and number of hints used. Additionally, there are 3 graphs that compare the user to the selected group:
/w=48,quality=90,fit=scale-down){kind=small}
Comparative Timeline
A line graph of the awarded points over time as compared to the averages of the top 25%, the bottom 25%, and the overall of the selected group.
Composite Performance
A bubble chart that compares the user’s points/accuracy vs the rest of the group.
Score Distribution
A histogram that compares the percentage of points the user scored vs what percentage of points the rest of the group scored.
NCL Medal Badges
Badging is a system that is used by the NCL to help individuals and teams track their performance. The Medal Badges issued by NCL consist of a division and a tier, which together represents an individual or team's percentile score in a game.
There are 5 divisions. In ascending order, they are: Bronze, Silver, Gold, Platinum, and Diamond. Within each division are 4 tiers. They are represented as a numeric value starting from 4 (being the lowest) to 1 (being the highest). The division and tiers help players track their performance and growth across NCL Seasons.
Cyber Power Rankings
The school Cyber Power Rankings are a comprehensive measure of the colleges who participate in the National Cyber League.
Ranking Calculation
There are 3 factors that are considered in a school's Cyber Power Ranking. In descending magnitude of weight, they are:
- The school's top performing team during the Team Game (4/7 weight)
- The school's top performing student during the Individual Game (2/7 weight)
- The level of participation from the school. Participation level is calculated by counting the number of students who made a submission in the Individual Game with students scoring between 1,000 - 2,000 points counting as two and students scoring 2,001+ points counting as three (1/7 weight)
Eligibility
For a student to contribute to a school's Cyber Power Ranking, they must have submitted accurate school information during the registration process and be in compliance with the NCL Ethical Behavior and Rules of Conduct guidelines.
For a team to contribute to a school's Cyber Power Ranking, they may only have, at maximum, 1 member who is not from the same school. If more than 1 member is not from the same school as the rest of the team, the team will not count towards any school's Cyber Power Ranking. The listed school for the majority of the team members will be used to determine the school that the team will represent. For teams of fewer than 3 members, all members must be from the same school for the team to represent a school.
The demographic information collected during registration is used to determine the school that each individual or team will represent. To ensure that each Student Player is properly representing their school, Players should select one of the autocompleted options when filling out their school information during registration. Players who do not select an autocompleted option risk having their performance not count towards their school’s Cyber Power Ranking. If your college or university is missing from the autocompleted list, please contact Cyber Skyline support.
Additionally, students will be asked to self-classify themselves as a “cybersecurity student” or an “experienced cybersecurity student” during registration. There are separate Power Rankings for Players who are considered “experienced cybersecurity students” and it is possible for a school to be represented on both Power Rankings depending on how their students classified themselves. See Player Classification for more details.
A school must have students participating in both Individual Game and Team Game to qualify for the Cyber Power Rankings.
View the Latest Cyber Power Rankings
Player Classification
During registration, Players are given the option to self-identify as a "cybersecurity student" or as an "experienced cybersecurity student". Players who identify as an "experienced cybersecurity student" will be placed on the "Experienced Students" leaderboard and will represent their school the “Experienced Students” Power Ranking to maintain fair comparisons between Players of different backgrounds.
The Experienced Students Power Ranking will be calculated using the Individual Game performance of all experienced students and the Team Game performance of any team with at least 1 experienced student. These individuals and teams will represent their school in the "Experienced Students" Power Ranking and not in the regular Power Ranking.
The purpose for this classification is to help maintain fair comparisons between Players of different backgrounds. The NCL’s broad definition of “student” means that some NCL Players are taking their first cybersecurity class and others already have years of industry experience and have returned to school to get a degree. Because many students utilize their performance in NCL and their NCL Scouting Report to demonstrate to employers that they are job-ready, it is important that the NCL results provide fair comparisons between Players.
We provide the following guidance to help Players make their selection at registration:
- I am a cybersecurity student
- Not yet in a cybersecurity role or hold extremely limited experience in any technical NICE cybersecurity work roles
- Enrolled in an undergraduate cybersecurity or undergraduate computer science program
- Want to compete with students who are beginners or have limited experience
- I am an experienced cybersecurity student
- Have experience working in a technical NICE cybersecurity work role for 3 or more years
- Enrolled in a graduate cybersecurity or graduate computer science program or experienced certificate program
- Want to compete with students who are more advanced or have more experience
System Requirements
The NCL is powered by the Cyber Skyline Platform, a cloud-based web app that is accessible with minimal requirements.
Operating System | Windows 7 or above, OS X 10.10 or above, and most modern distributions of Linux |
Browser | One of the latest 3 major release of Chrome, Firefox, Safari, or Edge |
Internet | 1Mbps+ |
Additionally Recommended
Although not required, we recommend that Players have access to a Kali Linux virtual machine as it comes preinstalled with many useful tools for solving NCL challenges.
Got a Chromebook?
No problem, Cyber Skyline has built-in tools for many challenges! If this is your first season playing, you will be able to do most challenges with a Chromebook though certain advanced level challenges may require a Windows, macOS, or Linux operating system.
Website and Network Access Requirements
There are minimal website access required to participate in NCL. The website access list is not all-inclusive and does not include websites that may be helpful research resources for participants in the NCL games.
Required
Domain | Ports | Reason |
*.nationalcyberleague.org | 80, 443 | Competition information and resources |
*.cyberskyline.com | 80, 443 | Competition platform |
*.cityinthe.cloud | 80, 443 | Competition platform |
Additionally Recommended
Domain | Ports | Reason |
*.github.com | 80, 443 | Common resource for research |
*.github.io | 80, 443 | Common resource for research |
*.wikipedia.org | 80, 443 | Common resource for research |
*.cloudshark.org | 80, 443 | Browser-based network traffic analysis tool |
Rules and Terms of Use
Your participation in the NCL is governed by the NCL Ethical Behavior & Rules of Conduct and your use of the Cyber Skyline platform is governed by the Cyber Skyline Terms of Use. Please take a moment to review these documents to learn about professional & acceptable conduct during the Games.