New ASU institute to create national cybersecurity hub


A cybercriminal wearing a black cloak works at a laptop at an opulent table

Inspired by the exploits of an 18th-century French thief-turned-law-enforcement-trailblazer, Yan Shoshitaishvili, an associate professor of computer science and engineering in the School of Computing and Augmented Intelligence, part of ASU's Ira A. Fulton Schools of Engineering, has developed an innovative cybersecurity training program that will be put to work in the new American Cybersecurity Education, or ACE, Institute. Graphic generated by Kelly deVos/ASU using Midjourney

|

In 1788, 13-year-old Eugène-François Vidocq, the son of a wealthy merchant in Arras, France, stole his father’s set of silver plates. And so began a life of crime that resulted in dozens of heists and several thrilling prison escapes — and inspired the fiction of Victor Hugo, Edgar Allan Poe and Honoré de Balzac.

The tale also caught the attention of cybersecurity expert Yan Shoshitaishvili, who knew how the story ends.

At the age of 30, following a year of hiding in his mother’s house, Vidocq made a history-defining choice. He decided to stop trying to beat the authorities and, instead, joined them. With the blessing of Napoleon, Vidocq created the Sûreté, later reformed and renamed as the Police Nationale, the official law-keeping force of France. He recruited criminals and personally trained them, remarkably reducing crime in Paris.

Shoshitaishvili is an associate professor of computer science and engineering in the School of Computing and Augmented Intelligence, part of the Ira A. Fulton Schools of Engineering at Arizona State University. He also serves as associate director of workforce development at ASU’s Center for Cybersecurity and Trusted Foundations, or CTF.

He and his CTF team have been awarded a two-year, $4.5 million grant from the U.S. Defense Advanced Research Projects Agency, or DARPA, to establish an institute that will educate the next generation of cybersecurity professionals and address critical workforce shortages.

As part of ASU’s Global Security Initiative, and with the DARPA funding, the CTF team has established the American Cybersecurity Education (ACE) Institute. When considering how the new organization would function, Vidocq’s story and its ethos — that it takes a great thief to catch one — inspired Shoshitaishvili.

An old solution to a new problem

The U.S. Department of Homeland Security has said that cybersecurity threats to critical infrastructure are one of the country’s greatest risks. Meanwhile, the Internet Crime Report from the Federal Bureau of Investigation charts alarming growth in cybercrime, noting a record number of complaints in 2023, with $12.5 billion in reported financial losses.

But in computer science, cybersecurity education comes with a unique set of challenges.

“To learn to write a program, you just have to learn to write a program,” Shoshitaishvili says. “But to understand how to hack a program, you have to understand how that program works better than the people who actually wrote it, so you can catch their mistakes and exploit them.”

Much in the way Vidocq believed the best criminals could be great police officers, Shoshitaishvili theorized that the best way to train cybersecurity pros is to teach them to think like cybercriminals.

Some of that work was already underway in the School of Computing and Augmented Intelligence.

Adam Doupé, a Fulton Schools associate professor of computer science and engineering and CTF director; Connor Nelson, a CTF staff software engineer; and Shoshitaishvili had created pwn.college — a unique combination of an educational curriculum, a competitive practice environment and a set of communication tools to help students learn collaboratively.

On the pwn.college site, cybersecurity students from around the world complete programming modules and participate in hacking exercises to gain real insight into how attackers access secured systems.

It’s this applied approach that Shoshitaishvili seeks to expand upon in the ACE Institute.

Students attend a hackathon at DEF CON
Students attend a hackathon at DEF CON, an annual convention held in Las Vegas. Participating in events like these, in which students hack computer systems to better understand how to secure them, will be a key part of the program at the new ACE Institute. Photo courtesy Shellphish Support Syndicate

Training the best for today’s toughest challenges

Shoshitaishvili and his team identified two key areas the ACE Institute must focus on: preparing current students for the toughest cybersecurity challenges, and recruiting enough students to fill the jobs pipeline for the future.

A pressing problem is ensuring that today’s students have the depth of knowledge needed to fill the most advanced roles.

“When undergraduates leave school, one issue is that they are immediately thrust into extremely complex environments,” Shoshitaishvili says. “They must outthink cybercriminals, who can even be state actors, and successfully attacking a system could be their entire livelihood. These people are very, very motivated.”

To combat this problem, one of the ACE Institute’s first steps will be to create a master’s degree in cybersecurity. The degree, offered by the School of Computing and Augmented Intelligence, is scheduled to begin enrolling students in the 2025–26 academic year.

For the new degree program, Shoshitaishvili and his team will design a curriculum that requires students to complete numerous advanced courses and successfully engage in a number of real-world exercises. Building upon the pwn.college model, master’s degree students will learn to hack highly complex systems, training to beat cybercriminals at their own game. They will also acquire the skills needed to build artificial intelligence, or AI, and machine learning applications for security systems.

Students in caps and gowns
Students attend the spring 2024 Fulton Schools Graduate Convocation ceremony. Under the grant from DARPA, the ACE Institute will develop a master’s degree in cybersecurity that is expected to begin enrolling students in 2025. Photo by Kelly deVos/ASU

Recruiting the best for tomorrow

Next, the ACE Institute will partner with other universities across the country. Dakota State University, or DSU, will join the initiative as a founding partner. DSU is located in Madison, South Dakota, and is one of 10 institutions in the country with all three National Center of Academic Excellence designations from the U.S. Department of Homeland Security.

Joel Wohnoutka, executive director of the Applied Research Lab at DSU, says that his team will take inspiration from the pwn.college program as part of their ongoing efforts to increase involvement in cybersecurity education.

“We’re looking to partner with the ACE Institute to ensure that our classes are hands-on and provide options for many different learning styles,” says Wohnoutka, adding that they plan to use institute resources to develop college credit course options for high school students.

Shoshitaishvili says he is especially excited about the partnership with DSU, which he notes has a successful track record of running cybersecurity workshops for middle schoolers and working to recruit students from historically underserved populations.

Wohnoutka adds that DSU is expanding the offerings of its CybHER outreach program to include an after-school program for elementary school students, enhancing efforts designed to provide young people with early exposure to computer science and diversify the pool of potential learners.

ACE Institute partners will work cooperatively to implement standards in cybersecurity education, and especially to fill the jobs pipeline with quality graduates. There are an estimated 3.5 million unfilled cybersecurity jobs worldwide, 750,000 of which are in the U.S.

Ross Maciejewski, director of the School of Computing and Augmented Intelligence, says that the new institute will prepare graduate students for leadership roles as well as boost recruiting efforts for future students.

“The ACE Institute continues the school’s efforts to create a home for excellence in cybersecurity education,” Maciejewski says. “The new endeavor will also further efforts to establish both the university and the state of Arizona as global hubs for innovation in this arena.”

More Science and technology

 

Associate Professor Yoan Simon in his lab on the Tempe campus.

New polymer technology opens door to paths for enhancing sustainability

We are reminded every day in the media of the unnecessary amount of waste being generated with pictures of plastic garbage patches floating in the oceans or stranded on our beaches. But…

A young girl receives an eye exam.

ASU researchers use AI to help people see more clearly

Myopia, also known as nearsightedness, is on the rise, especially among children.Experts predict that by the year 2050, myopia will affect approximately 50% of the world’s population. Researchers…

A portrait of Tim Cope posing with the ORIGAMI RISK logo and balloons that form the number 900.

ASU computer science alum turns entrepreneurship into activism

Tim Cope encourages students to take risks.That may sound like an odd posture for a co-founder of a software firm that helps companies avoid costly business risks — but he has his reasons.“Taking…