About 50 miles northwest of Sioux Falls, South Dakota, sits Dakota State University, a small institution with enrollment just over 3,200. Despite its small class size and rural location, DSU has built a curriculum that has made the school one of the most successful in funneling cybersecurity professionals into the National Security Agency\u2019s talent pipeline.<\/p>\n\n\n\n
And the skills are quite specific. The defensive and espionage missions undertaken by the NSA require efforts from some of the top tech operators in the world, capable of performing some of the most complex cybersecurity operations to defend and infiltrate adversarial networks.<\/p>\n\n\n\n
These operators must come from somewhere. And it\u2019s no secret that the public and private sectors are strapped for cybersecurity talent \u2014 a problem pecking at federal government, no matter their line of work.<\/p>\n\n\n\n
But the NSA has DSU. And, actually, the NSA has spent the last 20 years cultivating an interwoven network of universities and community colleges across the country capable of educating students in rigorous cybersecurity programs that are tailored to the needs of the agency.<\/p>\n\n\n\n
The partner institutions \u2014 called Centers of Academic Excellence (CAE) \u2014 have grown from seven institutions in five states to 312 across 48 states, the District of Columbia and Puerto Rico, adding the Department of Homeland Security as a partner in 2004.<\/p>\n\n\n\n
\u201cWe need lots of talent, and that talent needs to be diverse and reflect who we are as a country,\u201d said Diane Janosek, the commandant of the NSA\u2019s National Cryptologic School.<\/p>\n\n\n\n
Institutions of higher education can receive the CAE designation in three different areas: cyber defense, cyber defense research and cyber operations. That\u2019s an expansion from 20 years ago when the program focused on information assurance \u2014 aiming to \u201ccontribute to the growing demand for cybersecurity expertise in the intelligence community workforce.\u201d<\/p>\n\n\n\n
The designation is not easy: just 10 schools across the country have designations in all three categories, according to the NSA, and DSU is one of them. The shortage has only persisted, both for the federal government, state and local government and the private sector. According to Cyber Seek, which tracks the cybersecurity workforce shortage, there are nearly 314,000 cyber job openings across the country, while in the public sector 17,000 positions are unfilled.<\/p>\n\n\n\n
\u201cThere\u2019s economies of scale if you get outside the Beltway where we can actually operate more cost effectively,\u201d said Wayne Pauli, professor of information systems and coordinator for the DSU doctorate program in cyber operations. \u201cAnd we have young, talented people from every area in the United States that maybe just don\u2019t want to move.\u201d<\/p>\n\n\n\n
But to adequately combat the expanding workforce gap, the program must produce talent with the right skillsets. NSA and DHS have set rigorous academic requirements, faculty requirements and community outreach mandates. Several NSA officials have said that the CAE program is also the NSA\u2019s biggest driver of diversity. A spokesperson said that the demographic information wasn\u2019t \u201cavailable for public release,\u201d but said that the 63 of the schools are classified as minority-serving institutions.<\/p>\n\n\n\n
The universities <\/b><\/p>\n\n\n\n
Foreign adversaries and cybercriminals are getting more aggressive and advanced. The mission, Janosek said, is no longer just to bring in talent to the NSA. The goal is to widen access to cybersecurity education as cyberthreats have become an \u201ceconomic threat,\u201d she said. Now, her goal is for students to \u201clearn cybersecurity education that can be applied to more than just the defense and intelligence sector. It could be applied to the banking industry, the finance industry, the health care industry, manufacturing.\u201d<\/p>\n\n\n\n
To ensure that these sectors are matched with adequately prepared talent, the participating institutions must meet rigorous curriculum standards that evolve with the threat landscape. Every few years, universities must be redesignated as CAEs. Cyber operations remains one of the most exclusive designations, held today by only 21 schools.<\/p>\n\n\n\n
Those courses \u201care hard to teach,\u201d said Drew Hamilton, director of the Center for Cyber Innovation at Mississippi State University, which has a master\u2019s program stamped as a CAE for cyber operations. \u201cThey are hard to grade, challenging for the students. [But] you get a better product.\u201d<\/p>\n\n\n\n
This year, DSU expects to graduate 200 undergraduate students in cyber operations and 120 in cyber defense, Pauli said. He added that typically 15-20 students end up going to the NSA, DHS or another federal government institution after graduation.<\/p>\n\n\n\n
The process to receive the NSA\u2019s approval stamp is so difficult that an educator at one school that reapplied for the designation recently called it \u201ceight months of hell.\u201d But it\u2019s a designation that\u2019s critical to NSA recruiting, Janosek said.<\/p>\n\n\n\n
\u201cWe now can recruit in very key areas from the schools that we know have the caliber of the curriculum that we\u2019re looking for,\u201d Janosek told Federal Times.<\/p>\n\n\n\n
A clich\u00e9 in the cyber sector is \u201ccybersecurity is a team sport.\u201d While government officials say this all the time while struggling to break down communication barriers, the web of universities and community colleges across the country established a communication network that fosters real cooperation between the designated schools.<\/p>\n\n\n\n
The CAEs are grouped by region throughout the United States. Across the nation, the NSA has designated schools as CAE national or regional resource centers. Regional resource centers help schools prepare for designation, while assisting the national resource centers with webinars, application review, information sharing, mentoring and professional development for faculty.<\/p>\n\n\n\n
University of West Florida is dubbed a regional resource center for the Southeast, assisting institutions in Alabama, Florida, Georgia, Mississippi, Puerto Rico and South Carolina. Eman El-Sheikh, UWF\u2019s cybersecurity program director, said what UWF wants is \u201cto build a community, a collaborative community across the Southeast.\u201d<\/p>\n\n\n\n
The partnerships with universities across the country also expand facility access for the NSA. For example, DSU is developing a secure research facility for the government, called Madison Cyber Labs.<\/p>\n\n\n\n
\u201cWe fully intend to have defense contractors and government entities that will actually do work at our location and it will be much more cost effective being out here,\u201d Pauli said.<\/p>\n\n\n\n
\u201cWe have a tagline that we say: \u2018All this in the middle of a cornfield.\u2019\u201d<\/p>\n\n\n\n
Signaling to employers<\/b><\/p>\n\n\n\n
The workforce shortage is not shrinking: in fact, it\u2019s reaching what experts describe as crisis levels. One estimate from Cybersecurity Ventures says the shortage will reach 3.5 million open cybersecurity positions worldwide by 2021.<\/p>\n\n\n\n
The designation provides assurances to employers \u201cthat we\u2019re following strict guidelines on our curriculum and that these students are going to be prepared to go to work when they come on,\u201d said Stephen Miller, director of the Cybersecurity Center of Excellence at Eastern New Mexico University – Ruidoso Branch Community College, a school with around 1,000 students. ENMU-Ruidoso has a two-year program in cyber defense.<\/p>\n\n\n\n
In the two decades of the CAE program, the most significant change made was allowing community colleges to receive the CAE designation, Janosek said. Community colleges are a critical piece of boosting the cyber workforce because of the lower barrier to entry for students.<\/p>\n\n\n\n
That\u2019s an important piece of the mission at ENMU-Ruidoso, which is considered one of the most affordable colleges in the West. El-Sheikh said that the limited cyber workforce is a national security issue and the outreach needs to include different types of schools, and even different career skillsets, such as technical operators or cybersecurity lawyers and ethicists.<\/p>\n\n\n\n
\u201cTo continue to be a leader globally in cybersecurity, that innovation needs qualified professionals and it needs diverse qualified professionals,\u201d El-Sheikh said. \u201cBecause the more that you bring diverse perspectives, diverse experiences and diverse backgrounds to the mission and to the conversations, the more we\u2019re going to keep ahead of the game.\u201d<\/p>\n\n\n\n
Outreach <\/b><\/p>\n\n\n\n
The NSA also considers schools\u2019 community outreach programs as an integral part of the evaluation to become a designated CAE. Janosek said that the most successful schools are the ones that are \u201creally connected to their communities.\u201d<\/p>\n\n\n\n
The community colleges will host youth events, like Girls Who Code, or Girl Scout troops working toward their cybersecurity badge. Community college engagement can produce long-term return on investment, engaging students from a young age who then go through the cybersecurity education process.<\/p>\n\n\n\n
\u201cWe\u2019re trying to create this cyclical process,\u201d Janosek said. \u201cAnd what we have found are pockets across the country that are doing it really, really well.\u201d<\/p>\n\n\n\n
There are also immediate benefits for state and local governments, as well as local industry, in the areas these CAE schools are located. Students who graduate from programs, if they don\u2019t work for the government, often end up working for local hospitals or school districts, sectors that have been devastated by the ransomware epidemic that has closed schools and hospitals.<\/p>\n\n\n\n
And with military installations across the country, there are also benefits from the program for the government, even if they don\u2019t send students directly to work for agencies in Washington.<\/p>\n\n\n\n
Greg Randall, CAE program manager at Snead State Community College in northeast Alabama, said many of his students end up working at Redstone Arsenal, an Army post in Huntsville, Alabama, or for local defense contractors. According to Randall, one of his former students is a top cybersecurity official at Redstone\u2019s local bank.<\/p>\n\n\n\n
\u201cWithout being a [CAE], we would not be where we are today; the access that you get to programs, technology, all that, is very important to our success,\u201d Randall said.<\/p>\n\n\n\n
Benefits of participation<\/b><\/p>\n\n\n\n
There is one glaring hole in the federal government\u2019s partnerships with these universities: no funding goes to the designated universities, though there are grant opportunities for the schools to apply for and scholarships available to students.<\/p>\n\n\n\n
Federal Times asked several program directors what the incentive was to participate given the lack of funding. Several said degrees with the NSA\u2019s CAE stamp made their schools more competitive and set their students apart when applying for jobs. Some pointed to the grant and scholarship opportunities.<\/p>\n\n\n\n
None of the program directors interviewed for this story decried the lack of funding, all saying that the designation has been transformative for their students and schools and has provided tangible support for the cyber community.<\/p>\n\n\n\n
\u201cIt is that distinction that employers are looking for, that parents and potential students are looking for,\u201d said El-Sheikh. \u201cIt\u2019s really, within the higher-ed world, the gold standard of quality.\u201d<\/p>\n\n\n\n
Janosek also pointed to the network of CAEs across the country as another incentive to participate in the program. The benefits she listed include assistance with grant applications, career fair participation and shared resources.<\/p>\n\n\n\n
While cybersecurity practices differ from agency to agency and information can sit in closed-off stovepipes, the standardized, rigorous education curriculum mandated to receive the designation also establishes a qualified starting point for cyber education.<\/p>\n\n\n\n
\u201cYou\u2019ve got a baseline from which all people can go ahead and move forth,\u201d said Tom Polliard, a professor in the computer information systems department at Estrella Mountain Community College in the Phoenix suburbs. \u201cSo, you have a really good idea of what those people are going to know and don\u2019t know.\u201d<\/p>\n\n\n\n
With the cyber workforce gap only growing, governments from the federal level down to the municipal and tribal levels are going to have to pull cybersecurity professionals from across the country.<\/p>\n\n\n\n
\u201cIn the area of cybersecurity, the need is so great,\u201d said Hamilton. \u201cJust from a national perspective, you can\u2019t afford to leave anyone out.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The defensive and espionage missions undertaken by the National Security Agency require efforts from some of the top tech operators in the world, and these operators must come from somewhere. Enter the NSA’s partner institutions \u2014 designated Centers of Academic Excellence.<\/p>\n","protected":false},"author":7,"featured_media":37722,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":14,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-12223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"2NLNJOGRIFAWZI6HQKBWGZ47RI","arc_canonical_url":"\/it-networks\/2019\/12\/23\/inside-the-nsas-plan-to-lure-cyber-talent\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n