Texas Tech University NSF-SFS Workshop on Educational Initiatives in Cybersecurity for Critical Infrastructure Workshop Summary May 3, 2013 Support for this work was provided by the National Science Foundation’s Federal Cyber Service: Scholarship for Service (SFS) program under Award No Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.

Reminder! Visit our web site: Send slides to

Education Panel -Need for cybersecurity degrees at the BS level -Need security for cyberphysical systems (different from traditional information systems security) -Students need to develop work ethic -New discipline: Complex Systems Security Engineering -Students need a mix of HW and SW background, but depth in at least one area -All graduates need increased awareness of security -Gestalt! -Scholarship support will help to guide students into security courses

Day 1 University Presentations -Alex Seazzu (University of New Mexico) - Security as a concentration in the MBA program; developing an MS in Information Systems and Assurance - Good collaboration with local law enforcement, FBI, and other agencies - Guide more technical types into managerial policy courses; guide lest technical students into more technical courses - Teach professional communications, contract/vendor work. - Outreach, cybersecurity competitions -Kevin Barton (Our Lady of the Lake University) - Graduate program in information systems; focus on management and leadership - Cybersecurity competitions (Cyber Patriots) - Moving away from textbooks and more to research literature - Teaching more analysis, evaluation, creation

Research Panel -Modeling and simulation; need to model the attacker -Integrate with human-decision making; visualization -Borrow techniques from gaming and integrate with science modeling for hi- fidelity simulations -Combine live games, constructive simulation, and virtual simulation with human interaction for realistic training environments -Students need more analytical thinking and quantitative analysis capabilities; tools need to support this -Federal agencies fund basic research; industry funds applied research. -Basic research obstacles need to be overcome to increase industry funding of university. Government funding needs to listen to industry long term needs. -Need to be concerned about cascading failures -Looking for a holistic approach; difficult from a research perspective

Research Panel (continued) -Texas Tech is focusing on the right thing -Need to learn industry needs -Reach out with programs such as I/UCRC -Difficult for industry to open up at conferences; external advisory meetings are better -Think out of the box – attend an Oil & Gas Conference! -Faculty internships with industry

Day 2 University Presentations -Luc Longpre (University of Texas El Paso) - Graduate level program in information technology - National Center for Border Security and Immigration; Intelligence and National Security Studies; Regional Cyber and Energy Security Center - Mix of CS and IT students in courses; High school outreach - Outlined research in privacy, self-organizing networks, formal methods, applications of game theory, security in software engineering -Sam Segram (Texas Tech University) - Prevalence of security violations and statistics related to security violations - Challenges of cloud computing, legal issues, aging infrastructure - Texas Cybersecurity Council findings and recommendations to improve cybersecurity in the state of Texas - Need for life-long cybersecurity awareness - Proposed Texas Cybersecurity Education Pipeline

Day 2 University Presentations -Lorena Gomez (Monterrey Tec) - Overview of Monterrey Tec - Security in the curriculum - Challenge: Getting the students to apply security concepts - Funding from Microsoft, joint with University of West Indies - Mobile phone security for money transactions - Secure Software Development research - End User Training Strategy, Threat Mitigation - Graduate program in software engineering - Conacyt accreditation, relationships with CMU and Oracle - Cybersecurity education a priority; social service

WCOE Panel -Qing Hui: Summary of ME Courses (Control of Dynamic Systems) -Jordan Berg: Summary of ME Courses (Control of Dynamic Systems Laboratory) -Sunho Lim: Summary of CS Courses (Opportunistic Mobile Networks, Embedded Systems) -Susan Urban: Summary of IE Courses (Cybersecurity for Information Systems, Software Security)

Recommendations and Action Items