Rules
Online registrations
November 18, 2024 - January 17, 2025
From November 18, 2024, to January 17, 2025, it will be possible to register for the fifth edition of the Italian Cybersecurity Olympics. The only requirements for registration are:
- Being enrolled for the 2024/2025 school year in a secondary school that has joined the CyberHighSchools program
- Being under 22 years old as of January 1, 2025, meaning being born in 2002 or later
- Completing the registration form by January 17, 2025, and confirming your email. For those who participated in a previous edition, it is sufficient to confirm their participation with the existing account
Registration must be carried out independently by each student interested in participating in the program.
If your school has not yet joined the CyberHighSchools program, you can involve a teacher to have the school register for free at this link. There are no limits on the number of students registered from the same school.
School selection
January 18, 2025
Saturday, January 18, 2025, the first phase of the Italian Cybersecurity Olympics selection will take place online. This phase will consist of a multiple-choice test with 12 questions and 90 minutes duration, to be completed individually by selecting a start time within a 4-hour window from 15:00 to 19:00. Participants can complete the test independently from home on any personal device without support from the school. All participants will receive, the day before the test, the link and information to complete the test at their registration email address.
The questions will cover topics such as logic, mathematics (up to the first two years of secondary school), algorithms, and basic computer science. Knowledge of specific programming languages or advanced cybersecurity topics is not required to pass this phase. Past tests are available, with solutions, in the training material section of the website.
In this phase, each correct answer is worth 1 point, up to a maximum of 12, each unanswered question is worth 0.25 points, while each wrong answer is worth 0 points.
The following are admitted to the next phase:
- All the previous yeas' medalists, provided they still meet all the participation requirements, indipendently from their participation and results in the school selection, who express their willing to participate by successfully registering to the new edition of the program
- The top scorer from each school, if they scored at least one correct answer
- The next highest scorers, if they scored above the national average, up to a maximum of 15 students per school
The national average is calculated based on all participants who scored above 0. In the case of a tie, the ranking will be ordered by age, with preference given to younger participants. In the event of a further tie (in score and date of birth), all tied students will be admitted to the next phase.
In cases of suspected cheating or collaboration among participants, organizers reserve the right to disqualify all involved students and report their names to their respective schools.
Regional selection
March 8, 2025
Saturday, March 8, 2025, the second phase of the Italian Cybersecurity Olympics selection will take place. This phase will consist of a "Capture The Flag" (CTF) competition in Jeopardy format, entirely online, lasting 4 hours, from 15:00 to 19:00. This type of competition includes a series of practical problems (called challenges) to be solved using programming languages and/or specific tools. Each challenge will correspond to a hidden string, called a flag, through which students can demonstrate they have correctly solved the exercise. Participants will be presented with 10 to 12 challenges, each worth between 50 and 300 points. The leaderboard will be displayed anonymously in real-time throughout the competition, allowing each student to track their position.
The challenges will cover topics such as programming, network security, cryptography, web security, and software security. In the training material section of the Olympics website, there are links to introductory lessons on all these topics, while the training portal offers over 300 challenges for practice, ranging from basic to advanced levels on the various topics covered. The portal also includes past tests and simulations. Commented solutions for the 2022, 2023 and 2024 regional selection challenges are also available in the training material section.
Students can participate in this phase using their own computer, with no restrictions on programming languages or installed tools. In cases of suspected cheating, students may be required to present the procedure and/or code used to reach their solution at the end of the competition. As in the previous phase, organizers reserve the right to exclude and report all involved students to their schools.
The final leaderboard will be ordered by:
- total points earned
- the time of the last correct flag submission, with preference given to earlier submissions
Students advancing to the final phase:
- the top scorer from each region, if their score is above the national average
- the next highest scorers with more than 0 points, up to a maximum of 100 students
As in the previous phase, the national average will be calculated based on students scoring above 0. If fewer than 100 students score above 0, no additional students will be advanced.
National competition
TBA 2025
The national finals of the 2025 Italian Cybersecurity Olympics will be held during the 2025. Like the regional selection, this competition will be an individual Jeopardy-style CTF, but it will have a total duration of 7 hours. Participants will be presented with 12 challenges of varying difficulty on the same topics as the regional selection.
All those selected from the regional selection, as well as up to one teacher from each finalist's school, are invited to the national competition. For all event participants, food and accommodation will be provided for the entire duration of the event, with management and organization fully handled by the organizers. Travel must be arranged independently by all participants and will be reimbursed after the event according to the guidelines communicated to the finalists.
On the late afternoon of the first day, a brief simulation will be held to test the competition room, connectivity, and gaming platform.
The participants will take the test using their own laptops, which they must bring to the competition venue. Internet connection will be provided by the organizers via Wi-Fi or Ethernet cables. In general, additional devices or accessories other than a mouse, keyboard, and laptop charger will not be allowed; specifically, the use of additional screens will not be permitted. If a participant needs to use auxiliary devices, they must request authorization from the organizers at least 7 days before the event. The organizers will evaluate such requests on a case-by-case basis and communicate their decision.
As in previous phases, the organizers reserve the right to exclude from the competition and report to the respective schools all students involved in cases of suspected cheating or unauthorized external assistance.
Unlike the regional selection, the challenges of the national competition will not have predefined scores. Instead, a dynamic scoring system will be adopted: each challenge will start at 500 points at the beginning of the competition, and its score will adjust automatically as the challenge is solved. At the end of the competition, challenges solved by more competitors will be worth fewer points, down to a minimum of 50, while the least solved ones will be worth more points, not exceeding 500 points. The score (in points) of the various challenges will be updated in real time and made available to participants throughout the competition.
The competition leaderboard will remain visible only for the first 5 hours, while in the final 2 hours, participants will only know their own score. At the end of the competition, the final ranking will be drawn up according to the same criteria as the regional selection but will be kept secret until the award ceremony the following day. In the hours after the competition, the organizers will give a brief presentation of the problems and their solutions.
On the following day, the award ceremony will take place. Along with the organizers, national and international authorities and representatives from leading cybersecurity companies sponsoring the program will attend. During the ceremony, the top 40 competitors will be awarded, divided as follows:
- 1st to 5th place: gold medal
- 6th to 15th place: silver medal
- 16th to 40th place: bronze medal
International competitions
The top participants in the Italian Cybersecurity Olympics may qualify to join TeamItaly: the Italian Cyberdefender Team that represents Italy in international competitions.
In Europe, ENISA organizes the European Cyber Security Challenge (ECSC) each year to promote the exchange of knowledge and talent across Europe. The competition is open to all European countries, with each nation competing with a team of 10 players aged 14 to 25.
For the 2025 edition, the European Cyber Security Challenge will take place from October 6 to October 10, 2025, in Warsaw, Poland.