Earlier this month I had the privilege of speaking at George Mason University’s cybersecurity innovation forum. The venue was a “series of ten-minute presentations by cybersecurity experts and technology innovators from throughout the region. Presentations will be followed by a panel discussion with plenty of opportunity for discussion and discovery. The focus of the evening will be on cybersecurity innovations that address current and evolving challenges and have had a real, measurable impact.”
(How does one prepare for a 10-minute talk? The Woodrow Wilson quote came to mind: “If I am to speak ten minutes, I need a week for preparation; if fifteen minutes, three days; if half an hour, two days; if an hour, I am ready now.”)
Given my experience with network security job training here at TCS, I decided to talk about the approach we take to prepare students for military cybersecurity missions. It turned out to be a good choice: The topic was well received by the audience and provided a nice complement to the other speakers’ subjects (botnet research, security governance, and security economics).
My talk had the tongue-in-cheek title The 5 P’s of cybersecurity: Preparing students for careers as cybersecurity practitioners. I first learned of the 5 P’s from my college roommate who captained the Auburn University rowing team. He used the 5 P’s (a reduction of the 7 P’s of the military) to motivate his team:
Poor Preparation = Piss Poor Performance
In the talk I asserted that this equation holds equally true for network security jobs as it does for rowing clubs. A cybersecurity practitioner who is not well prepared—in particular who does not understand the “why” of things happening on their network—will perform neither effectively nor efficiently at their job. And as with rowing, network security is often a team sport: One ill-prepared team member will often drag down the rest of the team.
I mentioned how my colleagues at TCS (and many of our competitors and partners in the broad field of “advanced network security job training”) also believe in the equation, perhaps even moreso given that many of them are former or current practitioners themselves. I have enjoyed working alongside instructors who are passionate about the importance of doing the best job they can. Many subscribe to an axiom that my father originally used to describe his work as a high-school teacher:
“If my student has failed to learn, then I have failed to teach.”
After presenting this axiom I discussed several principles TCS has adopted to guide our advanced technical instruction, including:
- Create mission-derived course material with up-to-date exercises and tools. We hire former military computer network operators to develop our course content, in part to ensure that what we teach in the classroom matches what’s currently being used in the field. When new tools are published, or new attacks are put in the news, our content-creators immediately start modifying our course content—not simply to replace the old content with the new, but rather to highlight trends in the attack space & to involve students in speculating on what they will encounter in the future.
- Engage students with hands-on cyber exercises. Death by PowerPoint is useless for teaching technical skills. Even worse for technical skills (in my opinion, not necessarily shared by TCS) is computer-based training (CBT). Our Art of Exploitation training is effective because we mix brief instructor-led discussions with guided but open-ended hands-on exercises using real attacks and real defensive methodologies on real systems. The only way to become a master programmer is to author a large and diverse series of software; the only way to become a master cybersecurity practitioner is to encounter scenarios, work through them, and be debriefed on your performance and what you overlooked.
- Training makes a practitioner better, and practitioners make training better. A critical aspect of our training program is that our instructors aren’t simply instructors who teach fixed topics. Our staff regularly rotate between jobs where they perform the cybersecurity mission—for example, by participating in our penetration test and our malicious software analysis teams—and jobs where they train the mission using the skills they maintain on the first job. Between our mission-relevant instructors and our training environment set up to emulate on-the-job activities, our students experience in the classroom builds to what they will experience months later on the job.
The audience turned out to be mostly non-technical but I still threw in an example of the “why”-oriented questions that I’ve encouraged our instructors to ask:
The first half of an IPv6 address is like a ZIP code. The address simply tells other Inetrnet computers where to deliver IPv6 messages. So the IPv6 address/ZIP code for George Mason might be 12345.
Your IPv6 address is typically based on your Internet service provider (ISP)’s address. In this example, George Mason’s ISP’s IPv6 address is 1234. (Continuing the example, another business in Fairfax, Virginia, served by the same ISP might have address 12341; another might have 12342; et cetera.)
However, there is a special kind of address—a provider-independent address—that is not based on the ISP. George Mason could request the provider-independent address 99999. Under this scheme GMU would still use the same ISP (1234), they would just use an odd-duck address (99999 instead of 12345).
Question A: Why is provider-independent addressing good for George Mason?
Question B: Why is provider-independent addressing hard for the Internet to support?
Overall I had a great evening in Virginia and I am thankful to the staff at George Mason for having extended an invitation to speak.