Communications of the ACM
Protecting Data, Recruiting Students to Cybersecurity
Iowa State University
Professor Doug Jacobson emphasizes the community and fun aspects of Cyber Defense Competitions at Iowa State University.
Credit: Christopher Gannon / Iowa State University
Doug Jacobson acknowledges that the Cyber Defense Competitions at Iowa State University aren't exactly lessons from a software manual.
"They're a party," says Jacobson, a University Professor of electrical and computer engineering, the director of Iowa State's Information Assurance Center, and the holder of three degrees from Iowa State. "They're a two-day party. There's food. It's loud. Students are all together. And it's chaotic."
Also challenging.
The latest version of the campus cybersecurity experience, contested on Oct. 12, asked Iowa State students to protect the computer servers and applications of the "Chris and Doug Construction Co."
Students worked to protect the company's information, electronically monitor the company's cranes and other equipment, take care of the time clock application, and run the company's website.
All the while, attackers tried to bring the systems down.
And these attackers were motivated: "Our next client has caught some flak from Internet forums for its recent work on data analysis and has been receiving large amounts of attacks on its infrastructure," said the contest's written scenario. "As such, we need to make sure we are up to spec and protected before we move equipment over and get set up."
Setting up the construction company's information systems and protecting them for eight hours was a unique experience for students.
The competitions really offer students a "moment," says Nate Evans, director of the Cyber Defense Competition when he was at Iowa State, where he earned his undergraduate and doctorate degrees. Evans is the current cybersecurity program manager at the U.S. Department of Energy's Argonne National Laboratory, and is lead developer of Argonne's own Cyber Defense Competition.
A few special, hands-on moments can inspire and influence students, Evans says.
"The excitement of defending in a Cyber Defense Competition is a moment that gets students excited about working in cybersecurity," he says.
Stacks of Pancakes
Jacobson launched Iowa State's Cyber Defense Competitions in 2005 — "That was an era when people didn't know about cybersecurity" — after learning how the military was running information-security exercises. He decided to make the contests a little more fun and, to date, nearly 2,000 Iowa State students have competed in 20 contests. Another 1,588 Iowa high school students, 967 community college students, and 918 students from Midwestern colleges and universities have also participated in contests at Iowa State.
And, the best estimate says Jacobson's tradition of making breakfast on contest Saturdays has resulted in about 15,000 pancakes.
Why go to all the trouble?
First, Jacobson says, the competitions are great for teaching and learning.
"Learning how to detect, mitigate, and report attacks in real time and under pressure — I can't lecture on that skill," he says.
Second, they're a great way to introduce students to real jobs in cybersecurity. That includes introductions to industry professionals who often come to campus to play the role of the competitions' hackers.
Because of headlines about cybersecurity failures, "students now know what cybersecurity is," Jacobson says. "But they don't know what it is from a career perspective."
Going to a Cyberparty
With nearly 2,200 students, Waukee High School just west of Des Moines is the second largest high school in Iowa. It has a HyperStream Technology Club that has had as many as 80 students. It has an APEX Program offering work-based learning opportunities for 600-plus students interested in business or technology.
But, even with its size and resources, it's not able to offer a cybersecurity curriculum.
So the district has turned to the programs Jacobson and his team have developed. Schools across Iowa are offered a year-long curriculum — including books, videos, and access to faculty. Plus, there are trips to campus for Cyber Defense Competitions and IT-Olympics.
"The competitions are where students get hands-on experience with cybersecurity," says Michelle Hill, director of Waukee High School's APEX Program and adviser to the technology club. "They're also able to meet with business partners who do that for a living. That is so valuable to students."
Plus, there are opportunities to visit a research university, listen to expert speakers, win scholarships and, for girls, be inspired by the success stories of women in the field.
"I wouldn't miss it," Hill says.
That's another reason he's doing these outreach programs, Jacobson says.
Yes, of course he has other things to do. There are research projects to manage, such as the $3.5 million Internet-Scale Event and Attack Generation Environment he developed to study cyber defense. There's also helping with Iowa State's new major in cyber security engineering.
But he's at the Cyber Defense Competitions on several Fridays and Saturdays a semester, flipping pancakes, talking to students, visiting with corporate partners, and making sure everything is on track. "This has a great impact — on society and on the students we bring in," Jacobson says.
Besides, it's still a party with a purpose: "It's just as much of an educational component as a competitive one," he says. "I hate to use the word competitions. We want it to be fun.
"We're an intramural sport."
No entries found