University of Maryland Global Campus (UMGC) faculty offered insights and advice on technology trends and job opportunities during the recent “Cybersecurity Here and Beyond” webinar event open to the general public.
Faculty panelists also discussed bad actors, ethical hacking and how aligning curriculum with workforce needs and emerging technology helps close the cybersecurity skills gap. The Oct. 12 event was hosted by UMGC and moderated by Loyce Pailen, senior director of the university’s Center for Security Studies.
“Most jobs in cybersecurity are offensive, such as penetration testers, and defensive, such as analysts defending networks,” said Jesse Varsalone, collegiate associate professor of cybersecurity technology. “In curriculum, teaching offensive tactics helps students learn how an attacker works and exposes them to the importance of forensics.”
Forensics examinations—or knowing where and when a hacker gets on the system—is key to understanding how to be a better defender. “Looking at event logs, scheduled tasks and registries for certain entries are tactics that we emphasize,” Varsalone said.
Ethical hacking is also a big part of the cybersecurity workforce.
“Companies depend on ethical hackers to identify vulnerabilities on their systems so that they can implement the right safeguards to secure their systems,” said James Robertson, program director of Cyber Operations master’s degree program at UMGC.
Robertson discussed the disconnect between what is sometimes taught in university cybersecurity programs and the skills needed in the workforce. He emphasized the critical need to mesh curriculum with the Cybersecurity and Infrastructure and Security (CISA) Workforce Framework for Cybersecurity to narrow that cyber workforce gap.
“A cyber operator, for example, must be able to collect information, exploit targets of interest, navigate networks and do forensic analysis,” he said. “There's a certain skillset that goes with that role and we must make sure we're aligned with this skillset so that our students are studying these areas.”
In addition to technical roles, Robertson said there is a need to develop more cyber policy thought leaders.
“We must promote a greater understanding of how to manage cybersecurity analysts, which will be important over the next few years as we start using more artificial intelligence (AI) and machine learning (ML) to identify attacks,” he said.
Participants at the event agreed that AI has been a significant enhancement to cybersecurity.
“Traditional cyber controls, such as demilitarized zone (DMZ) networks and multiple firewalls, which all companies implement to secure their systems, have evolved over the years with the introduction of AI and machine learning tools in the fight against cyberattacks,” said Patrick Appiah-Kubi, program director for UMGC’s Cloud Computing, Cybersecurity and Computer Networking.
He noted that cloud security has improved with the use of AI and machine learning tools and has prompted a shift in cybersecurity programs, adding a new focus on AI, machine learning and cloud security.
“I see a lot of companies making strides in social engineering and tools that help identify unusual behaviors, even on the part of users determining if it’s the user doing something or an attacker,” said Appiah-Kubi. As a trend, cybersecurity has progressed with newer skills and newer technologies and newer opportunities in education.
A main area of cybersecurity in need of improvement is security controls for devices connected to the internet, according to Varsalone.
“If you take a look at my house, I have Alexa devices, a garage door opener, a thermostat – all devices connected to the Internet,” he said. “All of these connected devices are harder to control because so many different types and functions are being added to the game.”
While stressing that “there is no magic bullet,” Varsalone pointed to the National Institute of Standards and Technology (NIST) Framework for cybersecurity standards as a starting point as companies work to reduce cybersecurity risk to critical infrastructure and industrial control systems.
One of the greatest future threats, according to Appiah-Kubi, will target industrial control systems, critical infrastructure and data.
“Imagine if an attacker takes control of the air traffic control system or if an attacker injects a poisonous liquid through a water treatment system,” he warned.
Robertson, head of the Cyber Operations program, added that these types of threats will dovetail with political and geopolitical issues. “State actors attacking infrastructure will bring about the rise of smart cities and the automated analysis of everything through AI based systems,” he predicted.
Share This