Adding ‘Industrial’ to Cybersecurity Education

ISAGCA website. While this is an impressive level of transparency for a curricular guidance effort, the most exciting part is the guidance itself.

The 125-page document is an essential reference for students, instructors, administrators and industrial cybersecurity practitioners. It is organized around the analogy of a building with three components represented in Figure 2: an environment, a foundation and a superstructure.
 

Resources

The International Society of Automation Global Cybersecurity Alliance (ISA GCA) supports the author’s research and provides these related resources:

• Whitepaper: “Curricular Guidance: Industrial Cybersecurity Knowledge,”

• Webinar: “Curricular guidance to develop a new generation of industrial cybersecurity professionals”

• PowerPoint Presentation

• The ISAGCA website contains survey questions, responses, analysis and more.

 
Training a cyber-infused generation of automation professionals

What would you say if someone asked how to best move towards a secure digital future for critical infrastructure and industrial automation?

In late July 2016, I was contacted by my master’s thesis supervisor (Dr. Corey Schou) from Idaho State University (ISU) where I had graduated 10 years earlier. He asked whether I would be interested in teaching a course in ISU’s new Industrial Cybersecurity Program.

As I had spent the first decade of my professional life in industrial cybersecurity, I thought this sounded intriguing. I cleared what I thought would be a one-night-a-week teaching commitment with my employer (FireEye/Mandiant) where I had just been appointed as director of the industrial control systems security virtual business unit and started preparing course content for “Risk Management in Cyber-Physical Systems.”
I was unfamiliar with ISU’s Energy Systems Education and Training Center (ESTEC) where the program was housed. So, when I walked into the ESTEC building and saw the fantastic hands-on educational equipment including programmable logic controllers, variable frequency drives, transmitters, pumps, valves, motors, conveyors and pipes, and talked with the experienced instructors, I realized how special this opportunity could be.

ESTEC is a department-level center featuring five distinct engineering technology programs: electrical, instrumentation, mechanical, nuclear operations and industrial cybersecurity. It features 40,000 sq. ft. of educational laboratory and classroom space spread across four buildings on ISU’s main campus in Pocatello, Idaho.

ESTEC was founded in 2007 with the primary objective of expanding ISU’s existing industrial automation program to meet the growing demand for qualified technical professionals at the Idaho National Laboratory. Hundreds of ESTEC graduates work across the country in places like Simplot, Phillips 66, Chevron, Alyeska Pipeline, Columbia Electric Distributors and many other industrial firms.

When I started teaching, I thought to myself, “Wow, the Idaho State Board of Education has approved the country’s first industrial cybersecurity degree program. ESTEC is already a leader in preparing professionals to go into critical infrastructure environments. We need to teach cybersecurity to these students. This is exactly what the country needs. It’s exactly what the world needs.”

I believed it so firmly that I quit my high-paying job at FireEye to become ESTEC’s Industrial Cybersecurity Program Coordinator. My responsibility was to build the program from the ground up.

Over the next seven years, I authored courses, made curriculum proposals, visited high schools to recruit students, submitted and won grants, graded assignments and exams, and hired faculty. I helped place graduates at national-level employers such as the INL, Accenture, Savannah River, National Renewable Energy Laboratory and HDR Engineering, among others.