Many computer geeks are clever and capable of impressive technical feats, but how many have professional-caliber lock-picking skills?
Few computer geeks have been invited to penetrate the cyber defenses of a major corporation or probe for weaknesses in computer systems that control a national gas pipeline system. Not many have helped to solve a murder. And only a very few -- all of them, probably, students or alumni of the University of Tulsa's elite Cyber Corps Program -- have been taught how to stalk. "I train MacGyvers," says computer scientist Sujeet Shenoi, the director of the program, referring to the hero of the eponymous late-20th century TV show, who solved crimes and helped people with technical ingenuity and resourcefulness.
Shenoi founded the Cyber Corps Program after being named professor of the year by the Carnegie Foundation for the Advancement of Teaching in 1998. "I didn't think I deserved the award, so I thought I should do something to deserve it," he says. Michael Jacobs, then information assurance director at the National Security Agency, had impressed upon him the urgent need for a fleet of highly trained American cybersecurity experts. As a newly naturalized U.S. citizen, Shenoi accepted the challenge, launching the University of Tulsa's Cyber Corps Program in 1999 to train "the best and brightest" American students to protect the nation from cyber attack.
Careers in Cybersecurity
Cybersecurity is one of a handful of areas scientists can work in for which job opportunities far outnumber the number of job seekers. For more information on this career path, see the companion article "Battling Cyber Threats."
Since then, the program has trained about 225 students. In a typical year, about 40% are undergraduates, 40% are master's degree students, and 20% are pursuing Ph.D.s. Two scholarship programs -- the National Science Foundation's Federal Cyber Service: Scholarship for Service and the Department of Defense's (DOD's) Information Assurance Scholarship Program -- support many of the students.
The Cyber Corps Program prepares students for a variety of cybersecurity career trajectories, including research, operations, project management, and executive-level positions in the federal government. The most intense course of study, which Shenoi calls the "MacGyver Track," imparts hardware, software, and foreign-language skills to students who intend to join the intelligence community. The program is widely regarded as one of the best -- and the most intense -- in the nation. "It is a model because of its combination of foundational education and hands-on skills that will allow them to be effective on day one in solving real-world problems," says Richard "Dickie" George, technical director of the National Security Agency's (NSA's) Information Assurance Directorate.
Cyber Corps graduates have gone on to work for DOD -- in both military and civilian roles -- and for federal agencies such as NSA, the Central Intelligence Agency, the Department of Homeland Security, and many others. Competition for Shenoi's graduates is keen, George says, noting that one recent graduate received eight job offers from NSA alone. Shenoi says that's not unusual -- his students commonly get six or eight job offers with federal security agencies. One recent graduate, he says, was offered 26 jobs.
Like their counterparts at other universities, Shenoi's students take a suite of basic and advanced computer science courses and courses in various aspects of cybersecurity: computer and network security, critical infrastructure protection, secure electronic commerce, and so on. What sets the Cyber Corps Program apart is the depth and breadth of the hands-on experience it provides. Students learn to pick locks. They go Dumpster diving for clues. They hack into computer systems touted as "unhackable." They use the program's full-fledged crime lab, as well as a Secret Service facility, to help local, state, and federal law enforcement agencies solve homicides and other crimes. As part of this collaboration, Cyber Corps students have helped develop techniques for extracting digital evidence from burned or shattered cell phones and other devices.
In a hardware reverse-engineering course, students deconstruct a device such as a remote control or a complex bomb circuit, figure out how it works, and rewire it for some other purpose such as turning on a light bulb. In a software reverse-engineering course, they rejigger the video game Minesweeper so that the player always wins. For a course on security auditing and penetration testing, they hack into private companies' computer systems, pinpoint vulnerabilities, and then advise the companies how to do a better job protecting their systems. In another course, they learn how to hack into and then design better protections for "SCADA systems" -- computer systems that monitor and control critical infrastructure such as gas pipelines, telecommunication networks, water-treatment facilities, and electrical grids. The program receives mentoring, equipment, and other support from private corporations and government agencies. This is crucial, Shenoi says, because "no university can afford million- or billion-dollar infrastructures for their students to work on."
The hands-on experience even permeates students' lives outside the university. For one semester, each student in the program is assigned to stalk another student, both online and in real life. "I have 25 paranoid students throughout the entire semester," Shenoi says. The smart ones, he says, figure out who their stalker is and turn the tables.
In addition to learning the technical side of cybersecurity, students need to become well-versed in the legal issues related to government monitoring of private critical infrastructure assets, Shenoi says, so that students understand, for example, what forms of monitoring are constitutional. He urges his students to take courses in law, political science, economics, and history and to learn at least one foreign language.
Needed: Fearlessness, patriotism, and selflessness
Students entering the Cyber Corps Program need to have a strong interest in computer science, computer engineering, electrical engineering, mathematics, or applied physics. But a quantitative background is not necessary. A number of his students, Shenoi says, entered his program as master's students after earning undergraduate degrees in liberal arts.
Far more important than technical background, Shenoi says, is mindset. "I want students to be fearless of learning. That attitude surmounts everything, because we're talking about solving problems that we don't know are problems yet, using technologies that haven't been invented." He requires "an abiding sense of patriotism," which he equates not with an urge to fight but with an inclination to do "the best you can do." Finally, he wants students who value community and camaraderie, who will go out of their way to help each other. "My students know that the one thing that will make me really angry is if they are selfish," Shenoi says.
Shenoi has no trouble finding fresh blood. He recruits a few promising students directly each year by sending them e-mails asking, "Do you want to be a MacGyver?" He gets recommendations from professors at other universities and community colleges, former Cyber Corps students, and agencies that employ his graduates. And every so often, when the program gets a little press attention, Shenoi gets hundreds of "pings," many of them frivolous, he says. "People get drunk, feel patriotic, and call me," he jokes. "Everybody wants to impress their girlfriend or their parents, but I've got to screen them carefully. For every one of these sexy things we teach, there's a lot of hard things you've got to do."
Shenoi works hard, he says, to recruit minorities and nontraditional students. Currently, about 30% of his students are members of groups underrepresented in the sciences. The current crop also includes six military veterans and one active-duty officer. He has had two students over the age of 60, five over the age of 50, and a couple of dozen in their 40s. One student, a Vietnam War veteran, had to interrupt his coursework to have heart bypass surgery; he finished the program and joined DOD. Over the years, about 37% of Cyber Corps students have been nontraditional students.
The diversity helps the students learn from each other, Shenoi says. "Each has unique skills and experiences. Ultimately, it makes them more understanding, more able to work in teams in the real world. It just makes them better."
Shenoi works closely with his students, often coming to know their families. He works on projects at his students' side, writes papers with them, travels with them, stays in the same cheap hotels. He works with them on their resumés and helps them in their salary negotiations. As he sees it, "My job is to prepare them well and place them well, to help them to make a difference in their lives."
Siri Carpenter writes from Madison, Wisconsin.