Oct 29 2019

University Cyber Ranges Immerse Students in Cybersecurity Education

Students are put to real-world security tests as cyber ranges expand cyber education.

Imagine going with your coworkers to an offsite meeting with your CEO. You’re all taken to a room containing rows of computers, with large screens displaying your company’s logo on the walls. Your CEO walks in with a chilling announcement: Your company’s been hacked, and you’re losing data by the minute.

Exhale — it’s only a simulation.

That’s the scenario that plays out at IBM’s X-Force Command Cyber Range and others like it across the country every day as companies try to prepare for the worst. But there are other institutions getting in on the virtual action: colleges and universities

As high-profile hacks dominate headlines with regularity, more colleges and universities are using their own cyber ranges to train the next generation of cybersecurity professionals. From classes to competitions, students are able to hone their cyber skills while taking a holistic approach to security.

What Is a Cyber Range?

A cyber range is a place, both virtual and physical, designed for cyberwarfare training. It can be used by companies to assess readiness for an attack, or as a practice field for students looking to get into the cybersecurity field.

While some, like X-Force Command, are private, some states are using public funds to install cyber ranges at public colleges that can then be used throughout the public school system.

“It’s this virtual environment where you can practice skills and you can simulate attacks in a safe environment, so you can figure out how to combat against it, prevent it,” says Rebekah Michael, executive director of the Ohio Cyber Range at the University of Cincinnati.

The advantage of having the range at a university, like the Virginia Cyber Range at Virginia Tech University, is that the school takes care of the hardware, software installation and management and configuration, with the virtual space living in the cloud. This allows more schools to have access to the hands-on experience than they otherwise would.

“We take that burden away from them,” says David Raymond, director of the Virginia Cyber Range and deputy director of Virginia Tech’s IT Security Lab.

MORE FROM EDTECH: Data security, privacy and confidentiality are important, but do you know the differences between the three?

How Students Use Cyber Ranges

Whether it’s through simulations, competitions or lab drills, cyber ranges give students a place to visualize what they’re reading about in the classroom, something that Raymond says is essential for cyber education.

“They’ve got to be able to put hands on keyboards and apply some of the techniques that they’re learning in class,” he says. At Virginia Tech, Raymond says, students learn how to identify and penetrate vulnerabilities, properly secure web applications and build and test firewalls using two machines at once.

Once foundational skills are gained, cyber ranges also offer immersive simulations. “We just had a women in technology capture the flag competition last spring,” says Michael, “so they get in and run these exercises in competitions.”

This exercise is a little different than the game you remember from elementary school gym class. In such competitions, students break into teams and work to hack into each other’s virtual machines. Not only do they have to focus on infiltrating systems but they also have to be ready to defend themselves against similar attacks.

X-Force Command, based in Cambridge, Mass., offers educational options for high school and university students alike. Executive Director Christopher Crummey says the site hosted a capture the flag competition that included Tufts University, Northeastern University, Boston College and the Massachusetts Institute of Technology — and the students who did the best didn’t play by the rules.

“They thought way outside the box,” Crummey says. “That’s how the bad guys think: They think outside the box.”

States Invest in University Cybersecurity Education

The programs at Cincinnati and Virginia Tech have a major thing in common: They were started when the governors of their respective states identified a need. Michael says that Ohio was looking at about 7,000 empty cybersecurity jobs. Raymond says that, in Virginia, that number was more like 30,000.

So far, the programs seem to be on their way to filling those talent gaps. Michael says Cincinnati’s program has exploded. 

“We don’t have anything to say that absolutely it’s the cyber range; we have a lot of things going on,” she says, “but currently in the school of IT, we have been growing on average over the past 3 years at 19 percent per year.”

Raymond says that the number of participants at the Virginia Cyber Range has grown from just 250 students in a 2017 pilot program to 9,000 this year, across 220 different high schools, community colleges and universities. “The state of Virginia has made a pretty good investment in this technology that we’ve developed,” he says. “I think it’s revolutionary.”

A Holistic Cybersecurity Education

Cyber ranges are just one way that colleges and universities are rounding out cyber education programs. Michael says that at Cincinnati, it was the cyber range that brought multiple departments together to form a more complete program.

“The school of information technology, the department of computer science and electrical engineering, and the department of political science: All three disciplines are involved in the cyber range and cybersecurity education,” says Michael.

“I think the cyber ranges are a great way to address the full requirements for cyber,” Crummey says.

“Cyber is as much about the human being as it is about the business and as it is about the technical stuff. And when you bring all three of those together, that’s when the lightbulb goes off as to what we’re up against.”

PeopleImages/Getty Images

Become an Insider

Unlock white papers, personalized recommendations and other premium content for an in-depth look at evolving IT