Innovative Public/Private Partnership Approaches for Cybersecurity Workforce Development

Transcription

1 Innovative Public/Private Partnership Approaches for Cybersecurity Workforce Development Eman El-Sheikh, Ph.D. Rajni Goel, Ph.D. Lori Gordon, MPA, PMP Kevin Hofstra, Chief Technology Officer 1

2 Why an Expanding Cyberforce Gap? Organizations are increasingly connecting through SMACIT that will expand their networks and attack surfaces Reasons for Worker Shortage Threats by nation-states, activists, and hobbyists have evolved rapidly, and are no longer the domain of a limited number of skilled individuals GLOBAL 49% 42% 31% 31% NORTH AMERICA These and other factors contribute to 300K cybersecurity unfilled job openings today, a number that will increase to 1.8M by % 42% 34% 28% Source: 2017 Global Information Security Workforce Study (n=12,709) 2

3 Industry/Government/Academic Perspectives 2017 Congressional Hearings 2017 NIST Workshops Need more candidates and educators in the pipeline Need candidates with both hard and soft skills Need to be able to tap into new collar or other labor sources those with nontraditional experience/ education, but have tech skills or interest Need employers and educational institutions to collaborate to align coursework and capabilities needed, as well as on-the-job training Need more diversity across discipline, gender, background, and ethnicity to ensure fresh perspectives, prompt creativity, and drive innovation Need national-level curriculum that retains academic diversity of institutions; consortiums to share best practices among institutions is key 3

4 Cybersecurity Workforce Initiatives 2011 OPM Federal Cybersecurity Competency Model 2013 EO Cybersecurity Framework 2013 FISMA Cybersecurity Workforce Framework 2015 CISA Assessment of federal cybersecurity workforce 2016 Presidential Commission Enhancing Nat'l Cybersecurity Apprenticeship program to train 150K by OMB Federal Cybersecurity Workforce Strategy 2017 CSEC2017 National Curriculum 2017 EO Assessment of US cybersecurity workforce 2018? 4

5 Current Approaches to Public/Private Partnerships Federal Expand existing & proven cybersecurity partnership programs Authorize programs that tap into new workforce sources State Advance legislation in cybersecurity workforce/training Shared Governors approach to enhance state cybersecurity with public/private partnerships Provide seed funds to startups with cyber workforce ideas Academic Establish new and blended cybersecurity centers Provide inputs to national-level cybersecurity curriculum Interdisciplinary projects and curriculum Cybersecurity and awareness research Private Sector Promote apprenticeships/multifaceted partnerships with academia/govt Integrate with existing educational programs and resource bases Emphasize non-tech skills (comms, policy, risk management, human factors) Non-Profit Engage nontraditional or underrepresented students Promote cyber awareness earlier in student experience Work to remove social stigma of being a tech geek 5

6 Developing A Public-Private Ecosystem for Cybersecurity Capacity Building 6

7 FLORIDA CYBER RANGE A University of West Florida Center for Cybersecurity and Metova CyberCENTS Partnership Your Cyber Experience Starts Here

8 Cybersecurity Workforce Needs 300,000 unfilled jobs today Global shortage of 3.5 million by 2021 Most important hiring qualification for majority of organizations: practical hands on skills 59% of organizations get at least five applicants for each open position, but most are unqualified #1 reason: lack of practical hands on skills How can we integrate cutting edge practical skills development into our educational programs?

9 Main campus Pensacola, Florida Regional hub for cybersecurity: Education and training Workforce development Research Outreach and partnerships NSA/DHS National Center of Academic Excellence (CAE) in Cyber Defense Education NSA/DHS CAE Regional Resource Center for the Southeast U.S. 11/15/2017 9

10 Metova Headquarters Cabot, Arkansas Metova CyberCENTS O Fallon, Illinois Created the first ever DOD Cyber Range Developer of: Cyberoperations Enhanced Network Training and Simulators (CENTS ) product line Hands on Training Simulator (HOTSIM ) CYbersecurity Network Training Simulator (CYNTRS ) Range Global Internet (RGI ) Virtualized Cyber Classroom Environment (VCCE ) Sentinel Legion Autobuild Myrmidon Reconstitution (SLAM R ) appliance 10

11 Florida Cyber Range Platform High fidelity learning environment: Hands on exercises Curricular resources Labs ITEN WIRED 2017 Education, training and research: Computer and network security Critical infrastructure and industrial control systems Internet of Things Ethical hacking and penetration testing Defensive cyberspace operations Cyber war gaming 11

12 The Florida Cyber Range Ecosystem Infrastructure Hardware (Transport, Systems & Storage) Virtualization (Hypervisor) Software (Licenses, Applications, Tools) Core Services and Internet Space NTP, DNS, Web, Traffic Generation Network User Communications, Social Media Threat Emulation Custom Attacks, Insider Threats, Metasploit Framework Range Management VMs, Monitoring, Traffic, Attack, Scenario Builder, Scoring Engine

13 High Fidelity Environment Emulated Internet Dynamic Routing (75+ Routers) True Geolocation & Attribution Root DNS Infrastructure NTP Infrastructure (Stratums 0 3) Replica Websites (400+) Vulnerable, hostile and benign: Government, News/Media, Commerce, etc. Dynamic and user customizable Social Media Social Networking (Facebook like) Micro blogging (Twitter like) Chat/IIRC Dynamic Injection of Vulnerabilities Malware (Botnets/Viruses) Attackers (Programmed or Red Team)

14 Presenters: Contact Information Lori Gordon, MPA, PMP Rajni Goel, Ph.D. Eman El Sheikh, Ph.D. Kevin Hofstra, CTO A University of West Florida Center for Cybersecurity and Metova CyberCENTS Partnership Florida Cyber Range: NICE 2017 Booth #212 floridacyberrange.org FLCYBER ( )