Cybersecurity Means Job Security

Meet Louis A. Clark. He is 54 years old, 6-foot-3 and 159 pounds. He lives at 4676 Joyce St. His blood type is B-positive, he drives a 1996 Maserati Ghibli and his favorite color is orange.

But that's not all there is to know about Clark. He is active on social media. His mother's maiden name (Cottman), his first pet's name (Pirate) and his favorite sports team (Raiders) aren't the secure computer password questions he thinks they are. And there's this: He has connections to an organized-crime family.

Actually, you can't meet Louis Clark unless you are one of the 200-plus students enrolled in cyber operations courses at the University of Arizona. Even then, you can't really meet him. Clark is one of 15,000 virtual residents of a virtual city, CyberApolis, that has its own water and power companies, news media, retailers, bank and hospital … and, naturally, its own underground hacking community.

CyberApolis — the capital "A" in the middle stands for the UA — also has its own social media platforms: Social Park (like Facebook) and ChirpyHub (like Twitter). Their remarkably authentic-looking posts and chirps are generated by software.

At the command post of this fast-paced, forward-thinking online learning environment sits Jason Denno, who created and directs the cyber operations program on the UA South campus in Sierra Vista, not far from the U.S. Army installation at Fort Huachuca. It's no geographical coincidence. Sierra Vista has a high concentration of cybersecurity personnel because of the base, which is the home of the Army's Network Enterprise Technology Command, or NETCOM, and the Army Intelligence Center. 

Denno, a former Army paratrooper, once worked as an intelligence officer on the base.

"I told (the UA) I'd work cheap as long as I could establish the best cyber program in the nation before I retire," Denno says. "I'm here to build highly qualified, highly skilled professionals to defend and arm this nation."

Online Students From All Over

The UA cyber ops program, which began with about two dozen students in January 2017, has grown at blinding speed. It has learners logging in from all over the world, ranging from traditional students to retired military personnel to an aerospace engineer with a Ph.D. 

The appeal has much to do with a wealth of career opportunities in the field. In a tech world where data breaches have become common and costly, the talent pool hasn't been keeping pace with the demand for sophisticated cyber expertise from industries such as retail, health care and banking.

According to the International Information Security Certification Consortium, a nonprofit organization that specializes in training and certifications for cybersecurity professionals, an additional 1.8 million cyber professionals will be needed in the U.S. by 2022. These are good jobs, too: The median salary in 2017 for information security analysts was more than $95,000. 

As Denno notes, it's not a capacity problem — it's a competence problem. More than eight in 10 organizations believe half or fewer of their applicants for cyber positions are qualified, according to ISACA, an international association focused on information technology governance.

"The one thing our graduates can count on," Denno says, "is the fact that they will possess extraordinary technical cyber skills. Those skills are not very common in the workplace right now.

"They're not going to be looking for work. Work is going to be looking for them for the rest of their life."

The UA's degree program for a Bachelor of Applied Science in Cyber Operations has two paths: an engineering track with a security focus, and a defense and forensics track. A policy track, combining the technical aspects of those two with studies in law, political science and philosophy, is expected to launch next spring.

The big difference from other cyber programs, Denno says, is the skills-heavy work done by UA students in CyberApolis, a malware "sandbox" and labs in forensics, honeynet and the Internet of Things. CyberApolis may be only a virtual city, but the cyber program's lessons are real, with live online lectures and practical exercises modeled on actual data crises such as those experienced in recent years by retailers Home Depot and Target.

"Everything in the program is completely hands-on, and that makes us unique," Denno says. "Everything is done to ensure that the student has the knowledge, skills and ability when they leave to be able to do what they were taught to do.

"CyberApolis is not a video game. It's a deep simulation that allows us to deliver our courseware to our students in a real environment. If they use an automated tool or do a manual process that we teach them in one of the classes, then if something works, it's because we designed it to work. And if something breaks, it's because we specifically broke that to make sure it would support a learning objective."

'Exactly What We Need'

It's cool enough to make Sharon O'Neal, who retired last year after a 32-year career with Raytheon Missile Systems, wish that she were back in school.

"It makes me want to take the classes just so I can play and learn from the tools that Jason's team has built," says O'Neal, the former director of Raytheon's Software Engineering Center, who also is an instructor in the UA College of Engineering. "This is exactly the kind of learning that we need at Raytheon. Not to mention the potential research collaborations that could take place."

The UA cyber ops program was "reverse engineered," Denno says, meaning that it was based from the outset on the standards of the National Security Agency, an arm of the Department of Defense. This week, the NSA made a site visit to UA South to consider the program's application for designation as a Center of Academic Excellence in Cyber Operations, or CAE-CO.

Although nearly 150 four-year colleges and universities, including the UA, have received designation as a Center of Academic Excellence in Cyber Defense Education, or CAE-CDE, only 15 have achieved CAE-CO status, which affirms an emphasis on specialized cyber ops technologies and techniques. In June, the UA will learn the outcome of the NSA visit and the 650-page CAE-CO application that was required by the agency.

Denno has fashioned "a unique degree program that this nation and our national defense absolutely needs," says Jerry Proctor, a mentor to Denno who served as the deputy commanding general at Fort Huachuca for 14 years.

"The importance of cyber operations simply can't be expressed enough," Proctor says. "It is, and will be, the centerpiece of nearly everything this world will use. The (UA) students are trained in all areas of cyber. It makes sense that if you are going to be a cyber defender, you should really know and have the skills to be a good cyber offensive person."

Proctor says he also is impressed by Denno's emphasis on ethics, adding that "these skills in the wrong brain can do untold damage." In the unlikely event that a student were to go rogue, Denno says he would contact the FBI.

Eager to Launch Careers

Although only one in 10 cyber operations jobs is in government, senior Autumn Cottrell of Phoenix says she could see herself going that route in her career. She seems ideally suited for cyber ops work — wary of the dangers lurking on the internet, she says, but admittedly "super nosy" and able to turn up information quickly online.

Cottrell, 23, has taken courses from each of the cyber ops tracks and is scheduled to graduate in the spring of 2019. She says she is drawn to "niche aspects" of cyber such as malware analysis, reconnaissance, forensics and offensive security measures. In a recent conversation with a digital forensics expert with 20 years of experience, she discovered that the two of them have been using the same tools.

"We're doing what we'd be doing on the job in the field," Cottrell says of her UA classes. "I can't wait to get started in my career."

Another student, Raymond Melzer, likes the fact that the field is young and evolving — so much so that when he graduates in 2020 or 2021, he has "no idea what new opportunities there will be."

Melzer, 40, of Tucson, works full time and has a family and is unable because of those responsibilities to take a full course load. But he says he has known that this is the right career for him since attending a weeklong cyber ops boot camp in late 2015 in Florida. He says Denno's "extreme passion" for the UA program convinced him to enroll.

"A lot of universities are putting these programs up quickly, but the UA isn't interested in that," Melzer says. "They want to create people who are ready to hit the ground running. Every single cyber job is involved in protecting our nation. The way this program is laid out, how could you not get incredibly excited about it?

"This isn't just book knowledge. It's actual experience-based learning. There's a huge difference. It's the difference between creating cyber professionals and cyber warriors."

The Road Ahead for Cyber

Denno says he sees artificial intelligence playing an increasingly significant role in cyber in the coming years.

"Some systems currently defended by humans will start to be defended by artificial intelligence," he says. "But at the same time, you will see artificial intelligence being used to attack other systems. So I think the cat-and-mouse game of defend and attack will continue well into the future."

There also will be developments on the international stage, Denno says.

"Cyber is now a warfighting domain," he says. "Nation-states will use it not just for espionage and ransomware attacks, but to topple economies and steal intellectual property so they can start last and finish first. The U.S., China, Russia and near peers such as Iran, North Korea and the U.K. all have cream-of-the-crop cyber capabilities. But others are learning quickly."

Among global players, there will be haves and have-nots as technology continues to evolve, according to Alex Braithwaite, an associate professor in the UA's School of Government and Public Policy, who says it's not difficult to envision an AI "arms race."

"If not everyone can participate in the same way, they will find different ways," Braithwaite says. "Those left behind may try to find a way of accelerating to keep up. We have a tendency to forget how to deal with non-state actors.

"Technological advances have been great … but the flip side can be keeping up with the Joneses. It's easy to know what that looks like if it's China or Russia. But the non-state actors are more difficult to predict."

In any case, no one sees the field of cyber operations hitting even a brief plateau. 

"How long will cyber stay hot?" Denno asks. "How many processes are running on your phone right now? And do you know what they are? I could be using your phone in an attack on a bank — and you wouldn't even know it."

Unless that's the bank in CyberApolis, there is reason for all of us to carefully consider the devices and gadgets that enthrall us.

The need for the UA program shows "just how cyber vulnerable we all are," Proctor says. "Every new 'digital assistant' that comes along is another huge vulnerability of our digital and actual lives."