Enable breadcrumbs token at /includes/pageheader.html.twig

Achieving Cyber Skills Through Gaming

CyberStart America lets students try the cybersecurity field.

The National Cybersecurity Scholarship Foundation is finding that since the cybersecurity skills shortage in America is so great, the CyberStart America program will need to be rolled out in the future to students at earlier ages, down to junior high and middle schools, attests the foundation’s president, Michele Guel. Just in its second full year of dispensing college scholarships and cybersecurity training, the foundation provides a platform to expose kids to cybersecurity as a career field and learn cyber capabilities. The foundation hosts 200 or so digital challenges through the CyberStart America gaming platform and offers top performers funding to continue their cyber development.

“The initiative is designed to identify talent in high school and college students and includes a comprehensive set of programs and supports that work together to create a more assured pipeline for building the next generation of cyber talent,” the foundation’s website states.

Guel, who, along with Alan Paller helped to create the nonprofit foundation, has long been a proponent of growing the cyber work field. She was a rare female working in the early days of cybersecurity and saw some of the first attacks.  

“I was working at the NASA Ames Research Center at the time as a contractor when the Morris worm hit in November 1988 and at that time, cybersecurity wasn’t even on the map,” she shared. “Within a year after that I had an opportunity to establish the cybersecurity program at NASA Ames, where they were doing research on next-generation aircraft and spacecraft. And that’s actually where I met Alan Paller, who was the founder of SANS and the founder of the National Scholarship Foundation. He passed away about 12 months ago.”

Guel and Paller found they were kindred spirits in wanting to advance the cybersecurity profession. “I knew Alan for essentially 30-plus years, and we worked on many endeavors together,” Guel noted. “He was extremely passionate about trying to increase diversity in cybersecurity and I was part of the founding team of what is now the SANS Institute.” Guel also helped found the Women in Cybersecurity Group at Cisco—where she worked for many years before taking the lead at the foundation.

Several years ago, Paller and Guel wanted to create a place especially for young women to try out and learn cybersecurity skills, given the low numbers of females in the industry. They established a girls-only program at SANS called Girls Go CyberStart in 2018, and in three years, 30,000 high school girls were introduced to the cybersecurity field.  

“It was to see if we could do something that was focused on high school girls, with an all-girls competition,” she explained. “We were very pleased with the results, and we found some tremendous talent amongst those girls. And out of that grew the National Cyber Scholarship Foundation.”

The pair realized that a much larger population was needed for the nation to even have a chance at fielding the next generation of cyber defenders and address the huge cyber workforce gap.  

“Our goals are to increase that effort, not only just for girls, but boys and girls in all types of [communities], to help reduce the supply-demand challenge,” Guel stated. “I’m not sure we’ll ever catch up. It is going to take tremendous partnership and focus to get the U.S. to have a sufficient supply of cybersecurity professionals for the ever-increasing growing demand.”

The key thrust of the foundation is a development program with a yearly performance evaluation cycle that begins in October and ends in April. Students learn and compete for several months in the CyberStart online cyber gaming platform, which evaluates different cyber skills at different “stations,” earning the students points.  

“One station might be focused on cryptography,” Guel explained. “One station might be focused on forensics. One might be focused on all the different foundations you might need for Linux and so on.”

It’s a flexible platform for schools to adopt, as teachers—who can use it directly in their curriculum or after school in a club—don’t need any special training. “That is the beauty of it,” she stated. “Everything the teachers need to know and everything the students need to know is all contained within the game.” 

CyberStart America has reached all 50 states, with 4,075 schools registered. To fine tune its tactics, techniques and procedures, the foundation just began a new pilot effort in five states—California, Florida, Georgia, Texas and Virginia.

“Through our first year, we had five states that had some great feedback, and they were interested in forming a pilot,” Guel said. “What we’ve learned is that every state has its own set of educational regulations. We want to learn from these five states, and we want to build a playbook. We’ll have a better playbook, and then next year, we can increase our reach and our focus.”

Increasing the scale of the program is necessary, as kids today still may not know that cybersecurity is a bona fide career. “We find it’s very common that there are high school students who don’t even know that cybersecurity is a profession,” she stressed. “And they have misconceptions like it’s only about programming, or they read some newspaper article and they think you’ve got to wear a hoodie and sit in a dark room and you’re looking at code all day. So, they just never thought about it as a profession. We’ve had some high school kids that had no previous experience in cybersecurity and came in and just discovered their talent. That is what we really love about the platform.”

The foundation’s president also shared that implementing CyberStart America in Junior Reserve Officer Training Corps (JROTC) so far has yielded greater diversity. “With JROTC for the first year, that is where the majority of our diverse candidates came from, in terms of ethnic backgrounds,” she offered.  

In addition, Guel learned that just selecting very high-level cyber performers was not sufficient. “Our original focus was really to find those high-level people, the high school kids who had demonstrated tremendous talent for cybersecurity,” she acknowledged. “But what we learned after the first year and from talking to industry leaders and corporations, we saw we would be missing an opportunity. The cybersecurity industry needs more than that. What we found out from talking to a number of senior-level executives is they want to have talent that has a good foundation, a demonstrable foundation, a cyber foundation certification.  

Then they want to be able to grow that talent within their organization according to how that organization likes to run their cybersecurity operations. We want to churn out a lot of talented individuals.”  

The competition will run through April 4, with the students’ ratings from completing cyber challenges being scored on a leaderboard. For the top performers, a shorter competition follows later in April that gets a little more challenging.  

“You can actually see the leaderboard on the CyberStart website, where it lists all the states and leaders for each school,” she noted. “There’s minimum number of points [needed]  for  students to be able to apply for scholarships. Now, maybe some aren’t interested in scholarship, thinking, ‘Hey, it was just a fun thing to do,’ and other students are like, ‘No, I want every opportunity. I’m going to apply for the scholarship.’ And then for them, there’s another level of play.”

Image
Michele Guel
We find it’s very common that there are high school students who don’t even know that cybersecurity is a profession.
Michele Guel
President of the National Cybersecurity Foundation

While the foundation makes small scholarships to students for college tuition, the organization sees its granted training option—which includes a certification exam—as possibly more popular. It results in specific, tangible cyber skills and certifications that are desirable to future employers.  

“There’s a number of students who will be offered part of a scholarship, and one thing we learned is that getting $1,000 for a community college doesn’t have that much of an impact, but if you offer them the ability to take a certification program for free, that has a bigger impact,” she said. “We’ve learned that students value the actual foundation certification training—that I think is worth $3,000. They’ll have an invitation, a voucher to take the foundation’s curriculum, which is, I think is like 100-plus hours of material. Then they can take a certification exam on the end, and that’s part of the scholarship offering. And with that, they get the designation of a National Cyber Scholarship Finalist or Semifinalist.”  

The foundation’s CyberStart platform is not the only way for students to be considered for further funding and cyber development, Guel noted. Top performers from the Air and Space Force Association’s CyberPatriot program and Carnegie Mellon University’s picoCTF competition can also be considered for scholarship awards. In addition, the National Cyber Scholarship Foundation is still offering college students the so-called Cyber FastTrack training program, a similar competition platform to CyberStart. Guel emphasized though that it is almost too late to reach potential cyber workers at that age, as many have committed already to their major academic fields of study, and they will turn in future years to kids in the middle school grades.

Guel said Paller’s dream was to make the foundation’s designation of a National Cyber Scholarship Finalist or Semifinalist akin to the prestige of the National Merit Scholarship but for cyber so that kids could stand out in a vital career field.

“It’s very distinguished if you’re a high school student and you get a merit scholarship—what that says about your academic capabilities—and it’s something that’s known throughout the United States,” she explained. “Alan’s vision was to establish something similar but unique to the cybersecurity industry. And that is why it became the National Cyber Scholarship Foundation, and the participants in the program could have this scholarship designation that would be known throughout the United States.”

Enjoying The Cyber Edge?