Practice makes perfect—or, at the very least, a better defense. And that’s just part of what Virginia Tech is now offering to those studying cybersecurity—both in higher ed and in high school—throughout the US.
This week, David Raymond, the director of the US Cyber Range at Virginia Tech as well as Deputy Director of Virginia Tech’s IT Security Lab, said that his program is opening its doors to all comers. “Anyone can sign up—students, teachers, afterschool programs, even companies that want to train their staff.” So far in Virginia, more than 5,000 students have gone through the program. The program is free for students in Virginia, but Raymond expects to charge others a monthly fee.
The Cyber Range offers curriculum but it also offers a (virtually) walled environment where students can flex their hacking skills. Even better: Since that “environment” exists entirely in the cloud, students can do all their work with any computing device and a web browser. On average, Raymond says his team sets up about a half dozen virtual machines per student.
The need to train people with cybersecurity skills is huge: “There are about 30,000 open cybersecurity jobs in Virginia--about a third of the cybersecurity jobs in the state,” Raymond told a crowd of education leaders from higher ed, K-12 and technology companies, at the IMAGINE conference hosted by Amazon this past week in Seattle.
In July 2016, the Virginia Commonwealth decided to devote two years of funding to create a program that would offer cybersecurity courseware and training to people (both students and companies) in Virginia. The university tapped Raymond to lead the program.
Raymond had previously created a similar—but smaller—program at the US Military Academy West Point. “We had a lab with about 100 students a year” and a hefty budget to support hardware, software and a testing environment, he recalls. Even so, the design of that lab meant that Raymond wound up spending a third of his time making sure the infrastructure worked.
When he began working on the program for Virginia Tech, Raymond knew that he wouldn’t have a budget to buy much hardware and that the entire program had to be something that faculty members could get up and running with a couple of clicks of a mouse. “It had to be plug-and-play,” he says. His team wound up collaborating closely with the Amazon Web Services (AWS) team to make it possible for students to run all the exercises from a browser tab on whatever desktop machine they have available.
The program is free to Virginia students. Raymond’s team of about 20 people (including student interns) now supports 200 schools, including 13 of Virginia's 15 public universities, 20 of 24 community colleges and 180 of Virginia’s 400 high schools.
Courseware is free and has drawn on some of the best available courseware on cybersecurity that Raymond’s team has identified. Modules range from basic introductions (both “How a Computer Works” to detailed explorations of the “Cyber Threat Intelligence Cycle” (CTIC for short, of course.) Educators can add their own materials or just use what the Range makes available. “The hardest part is finding teachers who can teach the content,” Raymond concedes.
Although Raymond’s team designed the program for college students, it’s been a whirlwind hit with high school students, who currently make up about three-quarters of the participating students. “The high schools have really embraced computer science courses to empower students for jobs,” Raymond notes.
Raymond says the program is still evaluating exactly what fees it will charge to those outside the state but estimates the fee for the program will be less than $20 per student per month. He expects to charge on a monthly basis, giving students the flexibility to take the program for as long as they desire. The Cyber Range also aims to work with the National Integrated Cyber Education Research Center (NICERC), which provides educators teaching cyber security with curriculum and professional development.
Does he worry that the Cyber Range will train the next generation of hackers? “Nope, I’ve never had that come up,” Raymond says. “We do ethics early and often.” Besides, anyone with malicious intent can find plenty of resources on YouTube, he notes. And just like a shooting range, the Cyber Range will give the white hats a place to practice their skills.
