Students gain hands-on cybersecurity education, experience with VA cyber range


An innovative combination of public and private sector financial support — and access to cloud computing — are helping IT officials at Virginia Tech and other Virginia universities bring a new dimension to cybersecurity training.

In recent years, as the Commonwealth of Virginia has zeroed in on its commitment to cybersecurity and cyber education, schools in the state have followed its lead.

K-12 schools, for instance, reported the highest participation rates in a nationwide cyber initiative last month, and 10 public universities in Virginia have been designated Centers for Academic Excellence by the National Security Agency and Department of Homeland Security.

Less than a year ago, those same universities launched the Virginia Cyber Range, which allows students and state residents to immerse themselves in a virtual environment where they can tackle mock cyberthreats and attacks.

“The hands-on experiential learning is absolutely important,” said Scott Midkiff, CIO of Virginia Tech, at a breakout session during the AWS Public Sector Summit this week. “The lectures [and] the classroom only go so far in terms of preparing students to be able to really understand and be productive in … positions where cybersecurity is important.”

Virginia Tech, an NSA/DHS Center for Academic Excellence in research and cyber operations, worked with institutions likes George Mason University, James Madison University and Northern Virginia Community College to make the Virginia Cyber Range available in early 2017. Amazon Web Services provides the virtual environment, technical support, and an unspecified allowance of cloud computing credits in support of the cyber range, according to Midkiff.

In addition to offering cyber exercises and obstacles, the range is helpful in bucking the stigmas surrounding cybersecurity and information technology, said Russ Memisyazici, lead network architect at Virginia Tech.

“You don’t have to have a security mindset,” he said. “Anybody can learn IT security. That’s what we’re trying to enable for the state of Virginia.”

The Virginia legislature — led by Gov. Terry McAuliffe (D), who is “all over cybersecurity,” Midkiff said — granted initial funding for the cyber range in its 2016-2018 budget. However, those funds will not renew past fiscal year 2018, so one of the challenges of the program has been looking at ways to make it sustainable for years to come, Midkiff said.

The limited time frame of the program is one of the reasons university IT leaders chose to host the cyber range in the cloud. Another is how easy the cloud makes it to set up virtual sandboxes for users to try things and make mistakes. Midkiff believes the approach establishes a useful model for universities to attract a wider circle of students and faculty to learn about cybersecurity tactics.

“We think we’re going to be in a place by the end of the year where we’re able to run very efficiently, deliver services when needed and to be … sustainable and grow through a variety of sources to make sure that we really support K-12 and community colleges and higher education,” Midkiff said.

Barring any unexpected blips, Memisyazici said he, along with his six-person IT team, plans to roll out “version 2.0” at the end of July. This version will offer new exercises and a capture-the-flag style game in the cyber range’s virtual training ground.