UCA Cyber Range to Produce Needed Talent

The new cyber range at the University of Central Arkansas will complement the school’s new bachelor’s degree program and deliver to a fast-growing job field the talent it desperately needs to combat cybercrime, which is costly for businesses of all sizes.

The range will do all that by offering college and K-12 students in Arkansas the opportunity to experience cyberattacks like those they could face in the real world.

A cyber range is a dedicated computer system that simulates a computer network. The students can use it to learn how to detect and fend off cyberattacks and how to anticipate unknown threats, without exposing an actual network to a breach.

“It’s sort of like having the internet in a box. You’ve got one system, which is a closed system, but it has the capabilities of the actual internet in there, so people can learn many aspects of the computer business on it,” according to Stephen Addison, dean of UCA’s College of Natural Sciences & Mathematics.

Officials say UCA’s range is the first built for students in the region and the first in the country that will be used to teach both college and K-12 students.

The range isn’t fully open yet because a curriculum is being developed for the students who will use it. The first lesson plan was completed in early January, and Addison expects to have eight lesson plans done by the end of the spring 2019 semester.

That means the range should be fully open by the fall of 2019.

However, equipment for the range has already been set up at UCA’s campus in Conway, in Burdick Hall on Bruce Street, and it has had a kind of soft opening. The range is being used by UCA students and by students of Harding University in Searcy, Addison said.

The annual operational budget for the range will be about $30,000, and Gov. Asa Hutchinson announced in late 2017 that UCA would receive a $500,000 grant to build its 28 stations, one per student. The grant came from state discretionary funds and the Arkansas Department of Higher Education.

‘Marker in the Ground’
UCA President Houston Davis said UCA built the range because it “really allows us to put a marker in the ground that this is a priority for the university, that it’s a priority for the state of Arkansas.”

He said the range will offer cybersecurity learning opportunities to not only UCA students but to students at other universities and to K-12 students across the state, which is important “because information assurance is so important to our present and to our future.”

Davis added, “We think it also generates interest [from students]. There are a lot of job opportunities in cybersecurity and in information assurance. … Having things like the cyber range as tools in teaching as well as attracting interest, those things go hand in hand to meet workforce development needs.”

UCA’s range is typically set up for seven four-person teams to tackle exercises together, but it can be reconfigured for individuals or for larger teams as well, Addison said.

Several companies are interested in financially supporting ongoing operations and offering feedback on the curriculum, he said. But Addison declined to name them.

According to the state Department of Education, the range was constructed by Metova Federal of Cabot. And, in November, the state agency entered into agreements with Metova Federal and the National Integrated Cyber Education Research Center of Bossier City, Louisiana, to develop curriculum modules. The Arkansas Educational Television Network is also a partner, helping with cyber range offerings for K-12 students.

Metova Inc., which has offices in Fayetteville, Conway and Franklin, Tennessee, is not involved in the cyber range project, but COO G.B. Cazes spoke with Arkansas Business as an industry expert. 

“There’s a lot of hunters in Arkansas, right? So, if you think about it, you go shoot at the shooting range to practice before you go hunting, to hone your skills,” he said. “It’s kind of the same thing with the cyber range.”

“This is a place, an environment, where students can go practice what they’re learning from a textbook but actually have to get their hands dirty. They get the real-world experiences,” he continued. “It makes it more fun. It makes it more engaging. It makes it real. So that when they get into the real world, when they get into their jobs, they will have already seen some of these things and have real experiences, not just read about it in a book. So it’s vitally important, or critically important, for students and for preparation of the workforce.”

Cazes noted a huge skills gap, not just in Arkansas, but across the country. “All the reports that have come out show the demand for these types of workers, these skills, is growing, but the supply is lacking,” he said.

“For Metova, for other Arkansas-based companies, it’s going to be a great opportunity for us to instill talented people coming out of school with real experience that can go to work right away. … The return on investment is much quicker when a student comes in if they’re able to get to work sooner and be productive faster.”

The cyber range will produce a workforce attractive to companies outside the state, helping to attract them to Arkansas and boosting economic development in the process, Cazes said.

Industry to Benefit
It makes sense for companies to be involved in this project because, according to Davis, “Industry is going to be a major beneficiary of the cyber range.”

All types of businesses, large and small, need well-trained cybersecurity professionals to work for them or for the information technology companies they hire.

That’s because falling prey to cybercrime costs them big bucks.

The average total cost of a data breach has reached $3.86 million, according to the Ponemon Institute’s “2018 Cost of a Data Breach Study: Global Overview.” The study was sponsored by IBM.

Cybercrime may also be costing the world almost $600 billion, or 0.8 percent of global gross domestic product, according to “Economic Impact of Cybercrime — No Slowing Down,” a report released in February 2018 by McAfee of Santa Clara, California, and the Center for Strategic & International Studies, a bipartisan nonprofit policy research organization based in Washington, D.C.

While cybersecurity is a fast-growing and high-paying occupation, it is also suffering from a skills gap, one that was noted by Cazes.

Between 2016 and 2026, employment for information security analysts is expected to grow 28 percent, much higher than the average growth rate for all occupations (7 percent), according to the Bureau of Labor Statistics’ most recent “Occupational Outlook Handbook.”

The report also noted that the 2017 median annual pay for an information security analyst was $95,510.

But the Center for Cyber Safety & Education, a nonprofit charitable trust based in Clearwater, Florida, projected in a 2017 report a global cybersecurity workforce shortage of 1.8 million by 2022.

“In considering new programs, we look for opportunities that are good for students, good for UCA and good for Arkansas,” Addison said. “In cybersecurity, we saw an opportunity that would do those things and more. In building a program in cybersecurity that included a cyber range, we recognized that we could do something that would make Arkansas a leader in the region and help create an industry [here] and the workforce to serve it.”

RELATED: Cryptojacking Is Trend to Watch

Students Flock to Program
Addison was referring both to the cyber range and to UCA’s new bachelor’s degree program in cybersecurity. The Arkansas Higher Education Coordinating Board approved it in July, and 25 freshmen have already claimed cybersecurity as their major.

Several upperclassman are also switching to that major, Addison said. When the state grant to build the range was first announced in late 2017, his conservative estimate was that 15 students would enroll in the new degree program. But he also said then that he thought enrollment would grow rapidly.

“When I embarked on all this, I knew it would be a popular program and one that would grow fast. But my experience so far exceeded all of those expectations,” Addison said in a recent interview. “The interest is really large, and [cybersecurity] is something many, many people are concerned about.”

(Correction: A previous version of this article stated that the cyber range was constructed by Metova Inc. and that Metova Inc. would help develop curriculum modules for it. Metova Inc. is not involved with the range. Metova Federal built the range and will help develop the curriculum modules. Metova Inc.’s G.B. Gazes was speaking as an industry expert and not as a representative of a partner in the cyber range project. We have corrected the error.)