Information technology officer helps fight cyber crime

Confronting a widening workforce gap in the cyber-security community, Virginia Tech’s information technology (IT) security officer has designed advanced curriculum for specialized camps aimed at teenagers with highly developed computer skills.

Randy Marchany, Virginia Tech’s IT security officer and a renowned cyber-security specialist, offered his expertise for the United States Cyber Challenge (USCC) camps, part of a larger effort by the Department of Defense to attract young talent to help combat the growing threat of cyber crime.  The camps took place in July and August in New York, California, and Delaware.

According to the Government Accountability Office, cyber attacks on federal agencies quadrupled between 2006 and 2009. In response to this growing threat, the federal government partnered with the Center For Internet Security, a non-profit cooperative dedicated to reducing cyber crime, in order to create the USCC.

Karen Evans, USCC national director and former de facto chief information officer for the federal government under the Bush administration, said the overall goal is to recruit 10,000 professionals to protect various sectors of the nation’s cyber infrastructure.

Still in its early stages of development, the USCC has been piloting a variety of programs, such as the advanced skills camps, in an attempt to find the best combination of approaches to help reach the goal.

While several private industry partners, including Microsoft and Cisco Systems, contributed resources to the USCC’s advanced skills camps, it was the SANS Institute that took the lead by funding and developing the camps. SANS -- short for SysAdmin, Audit, Network, Security -- is the world’s leading organization specializing in computer security training. Because SANS has partnered with Marchany on projects for 15 years, the institute tapped the Virginia Tech cyber specialist to design the camps’ curricula.

According to Allan Paller, director of research at SANS, Marchany was the ideal candidate for the job because he brought a unique combination of skills to the table — those of cyber security expert and USA Volleyball Association volleyball coach. While sports and computers are seemingly unrelated, Paller put the concept into perspective.

“This industry is very similar to a sport.  There are few teachers who teach this. What we needed were coaches and a competitive atmosphere in which to push these kids,” Paller said. “Randy was instrumental in creating that atmosphere.  He didn’t just get involved, he took over.”

Marchany was excited to be involved with the camps, yet he knew certain challenges existed. “One challenge was to design courses at a level that exceeded the skill levels of the campers,” Marchany said.

Motivating the campers was perceived to be an even greater challenge, but Marchany’s coaching experience helped him create a competitive atmosphere to bring out the best in the campers.

Each week-long camp culminated with a capture-the-flag competition. Campers were split into teams and asked to attack a virtual company’s network.

As Marchany said, “We had to create courses with a high degree of difficulty. [With regard to] capture-the-flag, the challenge was [in] designing the virtual corporate network with enough obstacles to make it fun and competitive.”

Despite the challenges, the camps were considered a definite success, due in no small part to Marchany’s involvement. “Randy was instrumental,” Evans said. “He created a unique methodology to help train the teachers that few others could have developed.”

Paller and Marchany view the camps’ success with cautious optimism. The new and perhaps more daunting challenge is creating an economic model that will scale across the entire country.

Though the camps will continue to be a part of the USCC, Evans tempered her enthusiasm, noting that only 55 new professionals came out of the three camps.

“Now the mission is to find the right combination of tools, including the camps to some degree or another, that will get us the biggest bang for our buck and get us to that goal of 10,000 people [working] in cyber-security,” Evans said.