This Is Not CTF
CCDC is the largest collegiate cyber defense competition in the United States, testing real-world enterprise security operations.
Enterprise Simulation
Teams inherit a live corporate network—web servers, email, databases, Active Directory—and must keep it running while under attack.
Red Team vs Blue Team
Professional penetration testers attack your infrastructure in real-time. Your job: detect, contain, and recover—without losing business continuity.
Business Injects
Complete CEO requests, compliance tasks, and incident reports. Technical skills alone will not win—you need operational excellence.
“CCDC is not about who hacks best—it is about who keeps the business running under persistent attack.”
— The Core Philosophy
How Teams Win
Understanding the scoring model is the first step to strategic competition.
Score = Services + Injects − Red Team DamageThe Scoring Breakdown
Service Points
Automated checks verify your services every few minutes. Keep web, mail, DNS, and databases running—downtime costs points.
Inject Points
Business tasks from the CEO, Legal, HR. Write policies, investigate incidents, implement changes. This is half your score.
Red Team Penalties
Successful compromises deduct points. But high-quality incident reports can reduce penalties—documentation matters.
10 Regions to Nationals
Win your regional competition to advance to the National CCDC Championship and compete for the Alamo Cup.
National Champions
Two decades of excellence. The teams that reached the summit.
The Eight Iron Rules
Battle-tested principles that separate champions from competitors.
Service Priority is Public
Every team member knows which services are Tier 0 (never die), Tier 1 (protect), and Tier 2 (sacrifice if needed).
No Lone Wolf Changes
Any change affecting auth, network, AD, mail, or DB requires two-person confirmation. Most disasters are self-inflicted.
Identity Over Surface
With limited time, don't make things look secure—control high-privilege accounts, unknown users, and management interfaces first.
Logs Are Not Decoration
If you can't see it, it didn't happen. Centralize logs, protect them, and actually watch them.
Every Anomaly Gets a Ticket
No documentation = no incident. In CCDC, incident reports can reduce penalties. Record everything.
Contain First, Explain Later
Don't wait for complete analysis. Stop the bleeding, isolate the threat, then investigate.
No Scorched Earth
Blocking everything breaks scoring engines. Use surgical containment, not carpet bombing.
Injects Are Not Side Quests
Business tasks are half your score. They're not optional—they're the main event alongside services.