UC student keeps ransomware raiders at bay

It started in high school with him taking classes in a criminal justice and forensics academy at Colerain High School in Cincinnati. He was interested in digital forensics and had a chance meeting with a ransomware negotiator. 

These professionals use their technical IT knowledge along with good insight to protect organizations from cybercriminals by minimizing damage, reducing ransom demands, safely recovering encrypted data and stopping the release of stolen information.

“I learned more about the cybersecurity side of forensics, which I think is very cool and very important,” says Bernhardt, a fourth-year cybersecurity student in the School of Information Technology at the University of Cincinnati. “It sounds cheesy to say, ‘I want to better the world and make people feel more secure,’ but there are a lot of bad actors out there and it is only gonna get exponentially worse.”

Securing private information for individuals and companies is a necessity. And Bernhardt is continuing to sharpen his digital detecting skills with co-op experiences at Kroger Co. and U.S. Bank. He is one of more than 9,600 UC co-op students who gain valuable real-world work experience with partners across industry, government, nonprofit organizations and the university while continuing to make progress toward their degrees. 

At Kroger, Bernhardt was an information systems auditor intern during three co-op experiences with the company. He gathered data for financial audits, corrected security flaws to protect sensitive files and ensured that network firewalls worked properly. 

His work involved using automated code to find, format and document user permissions and system logs for mandated audits and also documenting how apps and automated scripts are used in a financial/sox and HIPAA compliant databases to improve security and restrict access to company information.

“Audits are a good way to make sure that what is in a company’s policies is actually being regulated and followed,” explains Bernhardt. “What good is a policy if nothing is being enforced? As auditors we help make sure the policies are being enforced and that financials for a company are correct.”

This summer Bernhardt is enjoying his fourth co-op experience in cloud governance, risk and compliance at U.S. Bank, the fifth-largest bank in the United States, with a focus on identity, access risk and security governance across cloud production environments.

It has offered a chance for Bernhardt to connect what he learned in the classroom with real-world security work. He’s seeing how cloud security, identity and access management and governance all work together to reduce risk across an organization.

“One project I have been involved in uses a CNAPP tool, a cloud cybersecurity platform, to help identify identity-based risks, including highly privileged access to sensitive cloud resources, and evaluate how those findings could translate into real security concerns to members of my team and other members of senior leadership,” explains Bernhardt.

“My experience at U.S. Bank, along with my previous co-ops at Kroger, has helped me better understand how important identity and access management is in real-world security. Ensuring people and systems have the right access is not just about meeting compliance requirements; it is about helping them do their jobs securely while reducing risk that a threat actor could take advantage of.”

Bernhardt has participated in numerous Capture the Flag (CTF) events which simulate real-world cyberattacks focusing on web exploitation. The gamified cybersecurity exercises and competitions allow participants to use hacking techniques to solve puzzles, exploit vulnerabilities and find hidden strings of text called “flags.”

“The challenges can involve things like analyzing suspicious files, looking at network traffic, testing a purposely vulnerable website or solving a cryptography puzzle,” explains Bernhardt. “It feels like a game because there are points, rankings, timers and teamwork, but the skills are very real.” 

For much of his time at UC he’s been a member of Cyber@UC, a student organization that tries to teach the campus all aspects of cybersecurity.

The group stays up-to-date on new cybersecurity techniques, works with students on campus and at local high schools to encourage learning in the area of cybersecurity, runs various CTF events, operates and maintains a multiple platform lab and experiments with malware.

Bernhardt teamed up with classmates in April to compete in a statewide Capture the Flag competition hosted by the Ohio Cyber Range Institute on the UC campus. The event involved 68 teams with 226 students across Ohio who participated in the event. It gave students the opportunity to deepen their cybersecurity skills while competing in hands-on cyber challenges for a coordinated day of learning.

Bernhardt was a member of Team Cyber@UC during the event and the group won first place. Members also included UC students Gabriel Lowden, Nathan Hagan, Ian Balfour and Sean Huggins. 

Bernhardt has been part of winning teams during CTF competitions at the Cincinnati-based Queen City Conference — they won first place during the 2024 and 2025 events — and were awarded the Black Badge, a custom electronic badge with a working geiger counter — highly prized by participants. The Black Badge also provides lifetime entry to the Queen City Conference.

CTFs may feel like entertainment, but the events build skill sets for the future. 

“They have helped me apply what I learn in class to hands-on problems that feel much closer to real security work,” adds Bernhardt.

Students should take PD 1010 (Professional Development for CECH), an “intro to co‑op” class, and attend job search initiation meetings the semester before they are expected to co‑op, explains Richard Hoyt, assistant professor in the College of Cooperative Education and Professional Studies.

Chat with your academic adviser to build a degree map and use that to plan co‑op terms; there is flexibility in information technology, especially when employers want back‑to‑back rotations. Hoyt says students are taught the full job search process, but he stresses they can’t just rely on platforms such as Handshake, LinkedIn and Indeed to find a co-op.

“The most successful students leverage networking, their own personal networks, attend UC career fairs and employer events and information sessions,” adds Hoyt, who advises hundreds of cybersecurity co-op students annually. “Get your face in front of employers. That’s especially important for the first co-op.”

Featured top image of Ethan Bernhardt in the UC Esports Innovation Lab by Connor Boyle/UC Marketing + Brand.