Virginia Tech students help enhance Virginia election security
This summer, six Virginia Tech Pamplin College of Business students gained real-world experience enhancing election cybersecurity in municipalities across the commonwealth through the Virginia Cyber Navigator Program. The 12-week, integrative program combines a semester-long academic curriculum and an immersive internship experience.
Security, Privacy, and Trust is one of four core pillars emphasized throughout Pamplin College of Business’s strategic plan. Closely aligning with Virginia Tech's guiding priorities and commonwealth investments, the pillar aims to reduce the cybersecurity employment gap by increasing the number of graduates with cybersecurity-related degrees in Virginia.
Within this talent gap, cybersecurity professionals are needed to protect election and voting infrastructures from growing threats. In response, Pamplin supported the Virginia Department of Elections in the development of the Virginia Cyber Navigator Program, an educational program designed to train future cybersecurity professionals to protect election infrastructure.
In early 2020, the Virginia Department of Elections contacted Janine Hiller, former director of Pamplin Integrated Security (Security, Privacy, and Trust), and Justin Monday, assistant professor of practice in the business information technology (BIT) department, about developing the program. Hiller, who served as co-principal investigator for the original grant for the Cyber Navigator Program, initiated another three-year grant to support Virginia Tech students as they intern at localities.
Monday’s experience serving as a cybersecurity officer in the U.S. Air Force before teaching database project management courses at Virginia Tech made him the perfect choice to serve as principal investigator of the Virginia Tech grant as well as the designer of Virginia Tech’s pre-requisite Election Securities course, which students must complete before their internship.
The Election Securities course teaches the history of elections, how democracy works, and where some of the election cybersecurity challenges have originated in recent modern history. It also teaches students how to perform risk and vulnerability assessments – tactical skill sets used in the cybersecurity industry to detect and prevent vulnerabilities in systems, repair them, and improve systems’ security over the long term.
Open to students from all university majors, Monday’s inaugural course was taught in spring 2021 to a small cohort of students. Monday and the students participated in a field test with a locality in which they performed vulnerability and risk assessments and provided recommendations for improving their election security posture.
Citing strong student, faculty, and municipal engagement in the course, the Virginia Department of Elections leveraged Virginia Tech’s Election Securities course as a template for other universities to use to design their prerequisite courses.
After completing the Election Securities course in the spring 2022 semester, students at participating universities were selected to attend the two-day Cyber Navigator Boot Camp in Charlottesville. The boot camp prepared students for their internships by allowing them to learn from and hear local election registrars and other industry experts discuss topics related to improving election security and what to expect during their internships.
Over the summer, six Virginia Tech students who attended the Cyber Navigator Boot Camp interned at election localities in Virginia, where they worked with the local general registrars to perform risk and vulnerability assessments and make recommendations to improve election security posture.
According to Karen Hoyt-Stewart, locality security program manager with the Virginia Department of Elections, localities were selected by the Department of Elections to fill in resource and capacity gaps, as many localities don’t have funding for dedicated IT specialists or advanced security architecture and support.
“The biggest obstacle for most localities is the costs of providing the necessary cybersecurity tools,” Hoyt-Stewart said. “Having enough IT staff to provide the internal cybersecurity needs such as vulnerability scanning, malicious domain scanning, and reporting can also be challenging.”
The internships took place over 12 weeks at 19 localities. On Aug. 12, the students gathered at the University of Virginia and shared their customized findings, recommendations, and deliverables for each locality.
“The Virginia Cyber Navigator Program offers students a unique opportunity to gain real-world experience in strengthening election and voting systems security and privacy,” said Monday. “The program also helps enhance students’ resumes, demonstrating their direct experience in performing risk and vulnerability assessments and ability to hit the ground running in a range of cybersecurity roles across the public and private sectors.”
“Working with the Cyber Navigator Program was a great experience and I learned a lot about elections and their cybersecurity, said Zoe Lynes, a senior BIT major. “It was fascinating to witness how much work and planning went into preparing for each election. I worked on real-world cybersecurity policies and procedures that my locality will be able to use to support future elections.”
Lynes said she and another student intern partner plan to travel back to the locality in September to present their findings to the electoral board.
Hoyt-Stewart said the program’s success far exceeded their initial expectations. “We set our goals for three deliverables for each locality participating in the Cyber Navigator Program in 2022,” she said.
“Some localities received up to nine deliverables, which will greatly enhance their cybersecurity posture. They were able to refine their network diagrams, set up their firewalls, and scan their systems for vulnerabilities — tasks they would not have been able to complete without the interns’ efforts.”
Engagement in the Virginia Cyber Navigator Program reflects Virginia Tech’s deep involvement in bolstering cybersecurity at the state level and addressing the cybersecurity talent shortage by delivering integrative cybersecurity academic programming, fostering a range of experiential learning opportunities, conducting leading-edge security research, and more.
The Virginia Cyber Navigator Program is funded by a grant awarded to the University of Virginia through the National Centers of Academic Excellence in Cybersecurity Program within the National Security Agency and is managed by a network of public universities including Virginia Tech, University of Virginia, George Mason University, Old Dominion University, Virginia Commonwealth University, and Norfolk State University.
The universities are part of the Commonwealth Cyber Initiative (CCI), a consortium of 41 Virginia institutions of higher education with the common goal of making Virginia a global leader in cybersecurity.
“Cyber Navigators is exactly the kind of program that CCI is here to enable – it stems from a collaboration between six CCI universities, led by CCI fellow Jack Davidson — and has a focus on experiential learning and building a robust cyber workforce in Virginia,” said Luiz DaSilva, CCI executive director and Bradley Professor of Cybersecurity at Virginia Tech.
“The Cyber Navigator Program opened my eyes to where I can go when it comes to my career with the different aspects of cybersecurity, I was able to work on during the internship,” said Trevor Love, who recently graduated with a bachelor's degree in cybersecurity management and analytics. “The electoral system is a huge part of what makes the United States what it is, and working alongside election officials has given me a new appreciation for the work and the people that go into making sure the election process finishes smoothly.
Love continued, “If given the opportunity I would do it again."
Program details and cybersecurity resources
Students interested in joining next year’s program should register for the Election Security course for spring 2023. Students who take the course may be selected based on academic performance to participate in the Virginia Cyber Navigator Boot Camp and the Virginia Cyber Navigator Internship Program. For questions about the Election Security course or the Virginia Cyber Navigator Program, contact the BIT department at BITCyber@vt.edu.
Additional university cybersecurity resources
- Virginia Tech cybersecurity academic programing
- Virginia Tech security research frontier
- Commonwealth Cyber Initiative
- Virginia Cyber Range
Written by Jeremy Norman and Shea Walters
