The text messages come flying fast any time there is a cybersecurity scare, but James Brahm and his friends can't always respond as quickly as their employer would like. They're still in class. "Sometimes they forget we're in high school," the Huntsville, Ala. teen recently told CBS News.
That's a sign of how much demand there is for information security professionals. Increasingly organizations are looking to universities and high schools to help fill that need. Alarmed by the shortage, new initiatives aim to increase the pipeline of cybersecurity talent by developing people as young as possible.
"When young people are considering which way they want their career to go, cybersecurity is a challenging and rewarding area," says Eddie Schwartz, chief operating officer with security firm WhiteOps in New York and chairman of ISACA's Cybersecurity Task Force. "The criminals and bad guys aren't going to let up anytime in the foreseeable future."
The shortage of security professionals has both national security and corporate security implications, says Ret. Gen. Bernie Skoch, commissioner for the CyberPatriot program at the Air Force Association (AFA), a Washington, D.C. organization that advocates for the U.S. Air Force. "This isn't just a Department of Defense issue," he says. "This is a Wal-Mart issue, a General Motors issue, and a Delta Air Lines issue."
Skoch says it's important to attract students into science, technology, engineering, and mathematics (STEM) programs at an early age, perhaps even before high school. By the time they reach college, it's too late because they may not have taken the needed math and science courses. But these students often face a peer pressure barrier ¾ STEM isn't considered cool. "We've learned that students in high school are already predisposed when they walk into their freshman year," Skoch says. "They say 'I'm not a geek.' They want to do other things. But we need that talent."
Discovering Security Talent
The AFA started its CyberPatriot competition for high school and middle school students in 2008 in response to reports that U.S. high school students were falling behind the rest of the world in math and science, skills that are crucial to jobs in technology-oriented professions. But the program is stimulating students to pursue cybersecurity in particular, Skoch says.
From a pilot competition involving just eight schools in 2009, the program has grown to 2,175 teams from the U.S. and Canada at both the high school and middle school levels. Teams compete in three divisions: one for teams from public and private high schools, Boys and Girls Scouts, Boys and Girls Clubs, and similar organizations; another for middle school students; and a third for students at U.S. Defense Department-affiliated schools.
The early rounds take place online on weekends at the local and state level. In these rounds, teams try to fix security problems on a virtual network, earning points for problems solved successfully. AFA flies the top 28 teams to the national finals, where they compete in four areas: configuring a network, investigating a simulated cybercrime scene, extracting deleted data, and protecting a network against live attacks.
Brahm's Huntsville team recently won the high school division of the finals in Washington, D.C. The winners of the high school divisions earn college scholarships. Thus far, AFA has awarded US$250,000 in scholarships, Skoch says.
For many of the students, the competition is the first time they have been part of a team, a necessary skill for cybersecurity jobs. Team members take on specialized roles, such as firewalls or user permissions, but they learn bigger lessons, as well. "For a lot of these kids, this is the first time they've been asked to exhibit any leadership, which is what employers want to see," Skoch explains. "They develop unique skills, and they contribute as a team."
A New Take on Summer Camp
The latest addition to the CyberPatriot program reaches out to students who weren't able to participate in the competition during the school year. This summer, AFA started a summer camp program in 22 locations. The five-day CyberCamps use interactive exercises to teach cybersecurity principles, ethics, and safety. On the fifth day, participants take part in a mini-CyberPatriot competition.
The same concerns that inspired the CyberPatriot and CyberCamps program are driving the GenCyber program launched last year by the U.S. National Security Agency and National Science Foundation. This summer the two agencies sponsored free camp programs at 29 university campuses in 18 states. The camps enable middle and high school students to learn cybersecurity safety and problem-solving skills, as well as ethical behavior.
Solving Problems With Fresh Thinking
Programs like CyberPatriot and GenCyber are beginning to bear fruit. Skoch says nearly 90 percent of CyberPatriot alums are pursuing STEM degrees. Among those still in high school, 93 percent plan to pursue a four-year college program, with more than half planning to major in cybersecurity or computer science. Eighty percent plan to go into STEM careers, compared to just 13 percent of students overall. And 20 percent of participants are girls, compared to the national average for STEM programs of 14 percent. CyberPatriot waves its registration fee for all-girl teams to encourage greater participation.
Moreover, many current participants are working as interns even before graduation, and some have graduated high school and gone directly into good-paying cybersecurity jobs. Forty-two percent of alumni who are already in the workforce are working in cybersecurity or computer science. "The kids who go through our program get jobs, and they end up in the programs that pay very well," Skoch says, noting that cybersecurity positions pay about US$1,000 a month more than other IT jobs.
Skoch says these young people may bring the fresh thinking that can help solve costly cybersecurity problems for their future employers. "They aren't constrained by the way we've always done business because they haven't done business," he says. "I'm convinced there's some solution out there that a high school aged or young college student is going to say 'Why don't we try this?'"