Rebuilding a College Cyber Club From Zero

I was elected president of the Ohio University Cybersecurity Club (Cyber Club) in April. “Taking over a club” sounds like there was a lot to take over. There wasn’t much. There’s no alumni network or internship pipeline, and no stack of old meeting slides to work from. For the most part we’re building it again from scratch, and I’ve had to figure out what a club like this actually needs.

Getting the word out

The first meeting this fall was September 3. Before that I spent a lot of the summer on stuff that has nothing to do with hacking: flyers (a dark version and a light version), an 18-slide deck for the first meeting, announcement graphics, an infographic, and sign-up forms. I built the forms in Google Forms and used Apps Script to handle the parts I didn’t want to do by hand.

I also gave the club an actual look. It’s neon green (#39FF14) and cyan (#00E5FF) on a dark base, with Tektur and Geist Mono for fonts. The logo is a shield split down the middle, with a cyan half for defense, a red half for offense, and a >_ prompt in it. That might sound like a lot of effort for a student club, but when you’re starting from nothing, looking like you have your act together is part of how you get people to show up a second time.

How meetings work

We meet Thursdays from 5:30 to 7:00 PM. Most of the talking happens on Discord and Teams, and we post on Instagram at @ohiou.cybersec.

For practice we use a picoCTF classroom, and the meetings walk through the picoCTF categories one at a time. So far we’ve covered General Skills, Cryptography, Forensics, and Web Exploitation. I pick the challenges for each meeting.

The rule I try to hold myself to is to explain the concept first and then hand people the challenge. I also assume nobody in the room has used a terminal before. That second part matters more than I expected. When I was starting out, the most I’d done at a command line was run sfc /scannow on a broken Windows install. If a meeting jumps straight to “just pipe it into grep,” you lose the people who would have gotten hooked if somebody had explained what a pipe is.

Building challenges, not just solving them

Last spring the club ran its own CTF with a bobcatCTF{} flag format. Besides playing, I wrote some of the beginner challenges, including a ROT13 one (with a writeup) and a two-layer Caesar/Vigenère one. Writing a challenge changes how you see them. You have to decide what the one idea is that you want someone to learn, and then make sure the challenge actually tests that idea and not something random. It’s harder than it looks, and it made me better at solving too.

The calendar

One of the more useful things I’ve done is put together a real competition calendar so people know what’s coming and can plan around it:

Fall 2026

• K17 CTF, September 11 to 13 (we placed 49th in the non-AI division, which I wrote about separately)
• NCL Practice Game, October 12 to 18
• NCL Individual Game, October 23 to 25
• NCL Team Game, November 6 to 8
• Queen City Con in Cincinnati, November 13 to 15, in person

I dropped Hack.lu and Platypwn because their dates ran into other events. Spreading a small group across overlapping weekends just means nobody does well at either one.

For spring 2027, the plan right now is UofTCTF, picoCTF, WolvCTF, KalmarCTF, UMassCTF, b01lers, and UMDCTF. For trips, I’m aiming at BearcatCTF in Cincinnati and JerseyCTF at NJIT. That’s a projection, not a promise. It depends on interest and on whether I can make the travel work.

Where to practice outside of meetings

When members ask what to do between Thursdays, this is what I point them to:

• TryHackMe for guided rooms when you’re brand new
• HTB Starting Point once you want something closer to real boxes
• pwn.college for binary exploitation and Linux fundamentals
• PortSwigger Web Security Academy for web
• CryptoHack for crypto
• CyberChef, which isn’t a course, but you’ll use it constantly

What’s been hard

Honestly, the hardest part isn’t the technical side. It’s consistency. You have to show up every Thursday with something prepared, pitch it at the right level for a room where some people are brand new and some aren’t, and keep people coming back after the first couple of weeks when the novelty wears off. I don’t have that fully figured out yet. But the club is meeting, people are solving challenges, and we’ve already competed as a team this semester, which is more than we had a year ago.

If you’re at OU and any of this sounds interesting, come by on a Thursday. You don’t need to know anything yet.