New ASU institute to create national cybersecurity hub

In 1788, 13-year-old Eugène-François Vidocq, the son of a wealthy merchant in Arras, France, stole his father’s set of silver plates. And so began a life of crime that resulted in dozens of heists and several thrilling prison escapes — and inspired the fiction of Victor Hugo, Edgar Allan Poe and Honoré de Balzac.

The tale also caught the attention of cybersecurity expert Yan Shoshitaishvili, who knew how the story ends.

At the age of 30, following a year of hiding in his mother’s house, Vidocq made a history-defining choice. He decided to stop trying to beat the authorities and, instead, joined them. With the blessing of Napoleon, Vidocq created the Sûreté, later reformed and renamed as the Police Nationale, the official law-keeping force of France. He recruited criminals and personally trained them, remarkably reducing crime in Paris.

Shoshitaishvili is an associate professor of computer science and engineering in the School of Computing and Augmented Intelligence, part of the Ira A. Fulton Schools of Engineering at Arizona State University. He also serves as associate director of workforce development at ASU’s Center for Cybersecurity and Trusted Foundations, or CTF.

He and his CTF team have been awarded a two-year, $4.5 million grant from the U.S. Defense Advanced Research Projects Agency, or DARPA, to establish an institute that will educate the next generation of cybersecurity professionals and address critical workforce shortages.

As part of ASU’s Global Security Initiative, and with the DARPA funding, the CTF team has established the American Cybersecurity Education (ACE) Institute. When considering how the new organization would function, Vidocq’s story and its ethos — that it takes a great thief to catch one — inspired Shoshitaishvili.

The U.S. Department of Homeland Security has said that cybersecurity threats to critical infrastructure are one of the country’s greatest risks. Meanwhile, the Internet Crime Report from the Federal Bureau of Investigation charts alarming growth in cybercrime, noting a record number of complaints in 2023, with $12.5 billion in reported financial losses.

But in computer science, cybersecurity education comes with a unique set of challenges.

“To learn to write a program, you just have to learn to write a program,” Shoshitaishvili says. “But to understand how to hack a program, you have to understand how that program works better than the people who actually wrote it, so you can catch their mistakes and exploit them.”

Much in the way Vidocq believed the best criminals could be great police officers, Shoshitaishvili theorized that the best way to train cybersecurity pros is to teach them to think like cybercriminals.

Some of that work was already underway in the School of Computing and Augmented Intelligence.

Adam Doupé, a Fulton Schools associate professor of computer science and engineering and CTF director; Connor Nelson, a CTF staff software engineer; and Shoshitaishvili had created pwn.college — a unique combination of an educational curriculum, a competitive practice environment and a set of communication tools to help students learn collaboratively.

On the pwn.college site, cybersecurity students from around the world complete programming modules and participate in hacking exercises to gain real insight into how attackers access secured systems.

It’s this applied approach that Shoshitaishvili seeks to expand upon in the ACE Institute.

Shoshitaishvili and his team identified two key areas the ACE Institute must focus on: preparing current students for the toughest cybersecurity challenges, and recruiting enough students to fill the jobs pipeline for the future.

A pressing problem is ensuring that today’s students have the depth of knowledge needed to fill the most advanced roles.

“When undergraduates leave school, one issue is that they are immediately thrust into extremely complex environments,” Shoshitaishvili says. “They must outthink cybercriminals, who can even be state actors, and successfully attacking a system could be their entire livelihood. These people are very, very motivated.”

To combat this problem, one of the ACE Institute’s first steps will be to create a master’s degree in cybersecurity. The degree, offered by the School of Computing and Augmented Intelligence, is scheduled to begin enrolling students in the 2025–26 academic year.

For the new degree program, Shoshitaishvili and his team will design a curriculum that requires students to complete numerous advanced courses and successfully engage in a number of real-world exercises. Building upon the pwn.college model, master’s degree students will learn to hack highly complex systems, training to beat cybercriminals at their own game. They will also acquire the skills needed to build artificial intelligence, or AI, and machine learning applications for security systems.

Next, the ACE Institute will partner with other universities across the country. Dakota State University, or DSU, will join the initiative as a founding partner. DSU is located in Madison, South Dakota, and is one of 10 institutions in the country with all three National Center of Academic Excellence designations from the U.S. Department of Homeland Security.

Joel Wohnoutka, executive director of the Applied Research Lab at DSU, says that his team will take inspiration from the pwn.college program as part of their ongoing efforts to increase involvement in cybersecurity education.

“We’re looking to partner with the ACE Institute to ensure that our classes are hands-on and provide options for many different learning styles,” says Wohnoutka, adding that they plan to use institute resources to develop college credit course options for high school students.

Shoshitaishvili says he is especially excited about the partnership with DSU, which he notes has a successful track record of running cybersecurity workshops for middle schoolers and working to recruit students from historically underserved populations.

Wohnoutka adds that DSU is expanding the offerings of its CybHER outreach program to include an after-school program for elementary school students, enhancing efforts designed to provide young people with early exposure to computer science and diversify the pool of potential learners.

ACE Institute partners will work cooperatively to implement standards in cybersecurity education, and especially to fill the jobs pipeline with quality graduates. There are an estimated 3.5 million unfilled cybersecurity jobs worldwide, 750,000 of which are in the U.S.

Ross Maciejewski, director of the School of Computing and Augmented Intelligence, says that the new institute will prepare graduate students for leadership roles as well as boost recruiting efforts for future students.

“The ACE Institute continues the school’s efforts to create a home for excellence in cybersecurity education,” Maciejewski says. “The new endeavor will also further efforts to establish both the university and the state of Arizona as global hubs for innovation in this arena.”