Editor's Note: This story was originally published in the Spring/Summer 2020 issue of iConnect, the alumni magazine of the College of Information Sciences and Technology, and is being republished in honor of National Cybersecurity Awareness Month this October.

UNIVERSITY PARK, Pa. — A cyberattack occurs in the U.S. every 39 seconds, and the average cost of a data breach is $3.86 million. And by next year, there will be a projected 3.5 million unfulfilled cybersecurity jobs to protect against these attacks.

The College of IST is helping to fill this global demand through the cybersecurity analytics and operations bachelor’s degree program, launched in 2017. Its first class of graduates, having earned their degrees in May, are ready to tackle cybersecurity challenges that individuals and organizations around the world face.

Sarah Hume is one of those graduates. “The demand is crazy right now, and the unemployment rate is close to zero,” she said. “It's really exciting that Penn State is one of the leaders in terms of universities offering cybersecurity education.”

Hume enrolled at Penn State in part due to the University’s designation as a National Center of Academic Excellence in Cyber Defense by the NSA and the Department of Homeland Security. Now, as she enters the workforce, Hume feels that having cybersecurity experience on her resume helped her stand apart from other candidates — leading to her current role on the technical assessments team at Security Risk Advisors, a firm at which she completed two internships.

“The name of the degree is pretty unique and implies a much more technical background,” she said. “That intrigues an employer and shows them that the candidate has the skills they're looking for.”

Alyssa Stackpole agrees. While she earned her degree in security and risk analysis before the launch of the cybersecurity program, she has been working in the industry since she graduated in 2017. Today, she is employed as a cyber engineering consultant at Coalfire Systems, a firm in that deploys system information and event management tools for clients to monitor their environments to meet compliance standards.

“While many people are trying to enter the field to ensure job security, many still lack the technical skills to fill many positions in the industry,” said Stackpole. “I am very excited about the independent degree so students can focus on expanding the technical skills that are currently needed in the cybersecurity field [in addition to building] communication skills with end users and clients.”

Transforming a program

Cybersecurity training isn’t a new concept within the college.

“We’ve been teaching cyber since the early days,” said Nick Giacobe, assistant teaching professor and director of undergraduate programs. “We’ve had courses in network security, cyber forensics, and security management [since the college was founded].”

Giacobe explained that as the original information sciences and technology coursework became more focused on security topics, and as homeland security issues increased following 9/11, the security and risk analysis bachelor’s degree was established in 2006. Under that major, students could choose an information and cybersecurity option.

“There have been advances in the internet and development of things being connected and online at the same time,” he said. “We’ve begun to carry phones in our pockets that are little computers, and we bring IoT (Internet of Things) devices into our homes. Meanwhile, many high profile, worldwide catastrophic events were happening. That has driven students to want more of a technically-oriented cybersecurity degree program.”

That drive, combined with industry insight, is what prompted the college to develop a standalone technical cybersecurity program. Giacobe was among the faculty, administrators and industry partners who helped to get the new degree off the ground.

“We had noticed that many of the top performing students in the college were in dual majors,” he said. “They got the context and tools capability of the SRA program, and software development and programming skills from the IST design and development option."

He added, “We looked and said ‘let’s put those two things together as part of the foundation in the new major.’”

Enriching experiences

While students enrolled in the cybersecurity program are receiving a state-of-the-art education, they also have ample opportunities to enrich their learning experiences outside of the classroom.

“There are some things that you have to learn by actually doing rather than reading about it or attending lectures,” said senior Cole Daubenspeck. “Cybersecurity is one of those things because it relies on critical thinking and problem-solving skills.”

Daubenspeck is treasurer of the Competitive Cyber Security Organization (CCSO), a student organization through which members master cybersecurity skills and participate in local and national competitions.

A University team including CCSO members recently advanced to the regional finals of the Mid-Atlantic Cyber Defense Competition — the farthest a Penn State student team has ever gone in the national competition. The rigorous competition provides hands-on cyber defense skills where students defend computers against a live red team of penetration testers. This enhances students' understanding of theory and practice.

“You are getting real-world experience and you actually get to defend a company network against an advanced team of hackers,” said 2020 graduate Mark Wallace. “I also got to connect with a lot of professionals in the industry and have already received emails asking me to look at their company’s job openings.”

Another experience was held last fall, when the Pennsylvania National Guard's Army/Air Joint Cyber Team hosted a Cyber Wi-Fighter Hacking Challenge at the college. Alumnus Capt. Sean Smith, class of 2009, was among the National Guard members leading the activity.

"I was blown away,” said Smith. “The students who participated were completely focused on the exercise and had the technical acumen to complete some pretty challenging tasks in an impressively short period of time.”

He added, “They were skilled team players that were able to confidently and professionally interact with senior military leadership, and demonstrated that they will be the future star employees in tomorrow's workforce."

Experiential opportunities take place across the country and the world. Rahul Walia, class of 2020, was one of two Penn State students selected as security scholars to attend the RSA Conference in San Francisco earlier this year. The program nurtures the professional growth of 80 students, enabling them to network with industry thought leaders and gain insights on global trends.

There, Walia met with seasoned veterans in the security industry who are guiding the next generation.

"It was a great opportunity to network with security experts and learn from what they have seen change in the last two decades of security," said Walia. “It changes every day, so I can only imagine what they've seen."

Expanding the reach

Upon the successful launch of the cybersecurity bachelor’s degree at University Park, Penn State is expanding its offerings in the program. To date, several Penn State campuses have also begun to offer all four years of the bachelor's degree in cybersecurity analytics and operations, while numerous others provide the necessary coursework for students to begin the program before transitioning to University Park to complete their education.

This fall, the college also launched a cybersecurity analytics and operations master’s degree at University Park and bachelor’s degree through World Campus — further expanding the program’s reach around the world.

“As technology advances rapidly and more vulnerabilities are realized, the opportunity to now offer these in-demand credentials online through World Campus will aid in enhancing the global response to cyber threats and strengthening a highly trained workforce to protect information, systems, and organizations,” said Dave Fusco, former interim associate dean for undergraduate and graduate studies.

The online program will also provide adult and distance learners with the opportunity to develop necessary skills for the growing industry.

“Many World Campus students are career changers," said Amy Stever, director of academic services operations. "Offering this degree online offers many more opportunities for prospective students from all backgrounds as they explore a career change and available jobs."

Cutting-edge research

More than a quarter of the college’s full-time faculty members focus their work in the areas of privacy and security, leading groups such as the Software Systems Security Lab and the Algorithmic Learning, Privacy and Security Laboratory. Internationally-acclaimed faculty experts conduct cutting-edge research that aims to solve information security problems across the globe.

Some of the problems these researchers tackle involve detecting threats of information misuse, privacy protection in social networks, exploring malware behaviors, and developing innovative software analysis and verification technologies.

“Our researchers are constantly designing technologies that prevent attacks to vital cybersecurity infrastructure that not only protect our computers at home and work but also vital infrastructure such as the IoT, energy grid, self-driving cars, city infrastructure, and computers that ensure our water supply, using machine learning and other intrusion detection technologies,” said Prasenjit Mitra, associate dean for research.

In 2018, the college's first Raymond G. Tronzo, MD Professorship in Cybersecurity was awarded to professor Peng Liu, who was instrumental in developing the curriculum for the new cybersecurity program and serves as director of the University's Center for Cybersecurity, Information Privacy and Trust. The professorship is the third in the College of IST, and the first established since 1999.

Liu is pioneering research in two areas: applying deep learning to make the asymmetric battle between malware and security analysts significantly more symmetric; and making cyber-physical worlds — like city infrastructures and intelligent transportation systems — more observable, secure, and manageable.

“Dr. Liu has had significant success in obtaining external funding to support his work and students engaged in cybersecurity research, which has produced numerous insights as well as publications in important venues that allow him to share his work with other researchers and practitioners,” said Andrew Sears, dean.

Looking ahead

As the class of 2020 enters the workforce, they will be met with evolving and challenging threats. Something, Hume says, for which the College of IST prepared them well.

"One thing with cybersecurity is that it's always changing," she said. "You have to be able to stay relevant; you have to always be teaching yourself. And that's one thing that the college focuses on: learning how to learn."

She concluded, "The College of IST focuses a lot on the foundational knowledge, and that's important to have at your core. Having that knowledge will allow you to adapt to anything new, because you'll be able to more easily understand how it works."