Inside UNLV’s Student-Powered Security Operations Center

Today, UNLV can complete the same investigation in about five minutes. But the solution wasn’t devised by Griffin or one of the other two permanent, full-time employees in the university’s security operations center.

It was built by students.

Several years ago, Griffin began experimenting with hiring students to help staff the school’s SOC. The arrangement not only helps UNLV stretch its limited cybersecurity staffing but also helps students gain the real-world professional experience they need to land jobs in the field.

“This isn’t a training SOC,” Griffin notes. “This is the real world. They are helping the university to become more secure.”

From Classroom Concepts to Admin Expertise

Griffin started UNLV’s student-powered SOC with just a single student analyst. Over time, the program grew to as many as 10 students, although Griffin says four to seven is generally the “sweet spot.” Most have been graduate students, but the program has also included a handful of ambitious undergraduates.

READ MORE: Virtual reality environments help cybersecurity students practice soft skills.

The student positions are paid, and most student SOC analysts work between 10 and 20 hours per week. They can also receive academic credit by enrolling in an internship course.

Griffin teaches security operations and security data analytics courses at UNLV, during which he incorporates coursework from the Splunk Academic Alliance, a free program that provides colleges and universities with access to Splunk technology, curriculum and certification support.

Griffin notes that nearly 100 UNLV students have earned Splunk Power User certifications, with others working toward cybersecurity defense analyst credentials. These certifications give students another way to demonstrate practical skills to employers, even for those who don’t staff the actual SOC.

Students are hired into the SOC only after successfully completing at least one foundational course, and even then, Griffin does not immediately hand them the university’s most sensitive security work. New student analysts learn UNLV’s systems and ticketing processes and then gradually take on greater responsibilities as they grow their skills.

“We’ll give them an easy alert to triage or an easy vulnerability to track down, and then build from there,” Griffin says, noting that some students have progressed to performing Splunk administration and detection-engineering work while still in school. “They’ve been doing admin work as student analysts.”

Click the banner below to receive the latest Higher EdTech content directly in your inbox.

The DMCA solution shows how much value those students can provide when given the opportunity. Previously, members of the security team had to manually work their way through multiple sources of information, including firewall and identity logs, to connect an IP address, time stamp and port to an individual user. The university was able to meet its compliance obligations, but Griffin’s small staff lacked the time to streamline the process. 

“We didn’t have the bandwidth,” he says. 

Student analysts built a Splunk-based workflow that correlates relevant logs, identifies the user associated with the activity and records the incident in UNLV’s ticketing system. They also identified the 20 or so sites responsible for the bulk of illegal media downloads and blocked them, essentially eliminating the problem. 

In another instance, a student analyst built a detection focused on remote monitoring and management tools used by hackers to remotely control compromised systems. “Depending on the access, that could have been catastrophic,” Griffin says. “Because of the work that our student analyst did, we’ve been able to detect it.” 

UP NEXT: Cyber ranges give students hands-on security experience.

A Perfect Job-Placement Rate

The benefits to UNLV are only half the story. 

Griffin notes that, even though there is a significant shortage of cybersecurity professionals, graduating students often have a difficult time getting hired for entry-level roles without real-world experience. 

UNLV’s student-powered SOC gives students a way around this catch-22 by allowing them to build professional experience before they graduate. Griffin estimates that roughly 14 students have gone through the SOC, and every one of them has gone on to find work in the field after graduation. 

“It’s a small number, but a proud number,” he says. “It’s 100%.” 

Those former student analysts have moved on to a range of cybersecurity and technology roles. For example, Griffin says that alumni have gone to work at Home Depot, taken civilian positions supporting the military and advanced their careers within the armed forces. One recent graduate became a security engineer at the online fashion marketplace Poshmark after previously building the remote-monitoring detection used inside UNLV’s SOC. 

At some universities, Griffin notes, students respond to simulated incidents to teach them how security operations work. By working alongside full-time professionals in a real-world security environment, he says, students gain the skills and credibility needed to land full-time roles. 

“This is more all-hands-on-deck,” Griffin says. “That’s one of the big differences.”