May/June 2019

Communities: Education
Schools Integrate Engineering Thinking With Cybersecurity

Cybersecurity engineering programs are still rare at the undergraduate level—but they’re slowly gaining traction. Proponents emphasize their necessity and advocate for more.

 LARGER VIEW

In 2017, at a petrochemical plant in Saudi Arabia, hackers remotely took over safety instrumented systems. A flaw in the Triton malware caused a shutdown, but as an MIT Technology Review article explains, in the worst-case scenario, the code might have caused explosions or the release of toxic gas. “This was the first time the cyber-security world had seen code deliberately designed to put lives at risk,” the article notes, pointing to similarly vulnerable systems in transportation, water treatment, and nuclear power.

Warning lights are “blinking red,” said US Director of National Intelligence Dan Coats in a speech last year, stressing the threats to the nation’s critical infrastructure. And ordinary devices are vulnerable as well. As they become smarter and more connected (i.e., the “Internet of Things”), they too could be tampered with. Recognizing the dire need for trained professionals to address these challenges, some institutions have gone beyond master’s or certificate programs and added cybersecurity engineering at the bachelor’s level.

Last year accrediting body ABET, in response to the growing number of academic programs as well as industry and government interest in cybersecurity, approved new criteria for both cybersecurity and cybersecurity engineering baccalaureate programs.

The Early Leader

George Mason University, a Virginia public institution with a main campus just outside Washington, D.C., was out in front with a BS in cybersecurity engineering that launched in 2015. The engineering school’s industry advisory board had pushed for the program, explains director Peggy Brouse.

A professor of systems engineering and operations research, Brouse realized that cybersecurity was a systems problem—with both hardware and software involved. She couldn’t find any other cybersecurity engineering undergraduate programs, so she designed one from scratch.

Mason’s program focuses on integrated cyberphysical systems in industries such as transportation, energy, healthcare, infrastructure, finance, government, and defense. It includes 22 cyberfocused courses such as Industrial Control Systems Security, Critical Infrastructure Protection, Cyber Physical Systems, and Human Factors and Cyber Security Engineering.

Brouse explains that the emphasis is on being proactive, “trying to identify vulnerabilities in systems before we field them instead of trying to fix them after.”

Graduates might serve on teams with electrical, mechanical, or systems engineers, the program director says. As a system is being built, the cyber engineer’s job would include vulnerability analysis and fixes.

Mason’s program includes electives that can be easily switched out due to the pace of change in the industry. Often, they’re taught by professionals working in the field. Recent courses covered cyberlaw and blockchain.

The university’s cybersecurity engineering program was the first such program to be ABET-accredited, Brouse notes, under general criteria. But she helped develop the cyber engineering criteria, and plans to pursue that route as well.

“We can’t educate people fast enough,” she says. Undergraduate enrollment has grown from 105 in 2015–2016 to 370 in 2018–19.

Students get courted by employers, with internships as freshmen or preclearances. After graduation, they work for NASA, the Department of Homeland Security, Northrop Grumman, or Raytheon. Starting salaries have been reported in the $90,000 to $110,000 range.

A ‘New’ Program

Iowa State University’s history with cybersecurity dates back to the 1990s. The university previously offered graduate-level courses and a minor. This fall, the College of Engineering will start a BS degree in cybersecurity engineering. It was also driven by feedback from industrial partners who wanted a full-fledged undergraduate program.

Doug Jacobson, a professor in the Department of Electrical and Computer Engineering where the program resides, has been teaching cybersecurity courses since 1995 and led the effort to create the degree. The new program, he explains, combines a computer engineering foundation with eight cyber courses and was designed using ABET’s new criteria as its guiding principles. The aim is to graduate students with a background beyond solely cyber topics, he says.

Most of the country’s cybersecurity programs grew out of computer science, Jacobson notes, but the engineering thought process has advantages. Point solutions no longer work, he says. Echoing Brouse, he emphasizes the systems nature of cybersecurity. “That’s what I’ll argue engineers are the best at.”

“Everything we do in engineering is solving big problems with groups of people,” Jacobson says. “And that needs to be brought to cybersecurity.”

The shortage of students is enormous, he emphasizes. “We could stand up a large number of programs and still come nowhere close to producing what we need to produce.”

Jacobson stresses the importance of not siloing cybersecurity. For instance, students’ capstone experience will bring together teams that could include cyber engineering, electrical engineering, and cybersecurity students.

“We need to design with cyber in mind,” says Jacobson. He hopes that faculty in other programs will incorporate some of the lessons from the courses, such as a discussion about cybersecurity in designing autonomous cars. He’d like to eventually see cybersecurity become a standard part of the computer engineering curriculum.

Iowa State will work toward accreditation under ABET’s new cybersecurity engineering criteria. Although the program was the next logical step for the university, earning accreditation will afford additional credibility, says Jacobson. He hopes that the new criteria will help other schools make the argument to start programs. His view on the future of cybersecurity engineering programs: “There should be more of them.”

A Niche With Potential

At Tuskegee University, interest in computer engineering was growing—so in fall 2018 the school added the focus to its Department of Electrical Engineering. This past fall, the university launched a bachelor of science in computer engineering with a focus on both hardware design and cybersecurity engineering. It is the first baccalaureate program with a focus on cybersecurity engineering at a historically black college and university (HBCU).

Ben Oni, associate professor of electrical engineering and interim head of the department, says Tuskegee wanted to create a niche that would drive steady growth. In addition, the university sees the program as a launch pad for courses in other emerging engineering areas, such as artificial intelligence, machine learning, autonomous vehicle technology, and embedded robotics.

Oni also draws a distinction between cybersecurity and cybersecurity engineering. “Many of the institutions that offer cybersecurity programs, they’re mainly software,” he says. “Ours is not just cybersecurity as a science but as engineering. That means we also need to address the issue of hardware.”

Tuskegee has an enrollment of just over 3,000, and this program is small, with just eight enrolled. But interest and support from companies—such as IBM, Lockheed Martin, and Boeing—is high. Industry partners helped with the curriculum structure, for instance, advising on the order of courses to allow for meaningful internship experiences.

The program will be eligible for ABET accreditation after its first student graduates.

Oni sees cybersecurity issues as only continuing to grow. “As we see the damage that is being done right now through hardware, software, virus infiltration, we are going to need a very strong, educated, and knowledgeable pool of engineers who will know how to tackle these type of problems,” he says. “I see a future where cybersecurity becomes an indispensable part of engineering programs.”

 LARGER VIEW