Abstract:
Method for developing leaders in cyber security. Cyber security candidates are selected according to a series of qualifying process steps. Cyber security leader-selectees are then developed into cyber-security leaders through a repetitive, multiple week program of problem solving skill development with emphasis on-time performance; communication skill development through impeccable technical writing and compelling presentations; and by mentoring from experienced cyber security professionals.

Description:
PRIORITY CLAIM UNDER 35 U.S.C. §119(e)  
       [0001]     This patent application claims the priority benefit of the filing date of a provisional application Ser. No. 60/539,795, filed in the United States Patent and Trademark Office on Jan. 28, 2004. 
     
    
     STATEMENT OF GOVERNMENT INTEREST  
       [0002]     The invention described herein may be manufactured and used by or for the Government of the United States for governmental purposes without the payment of any royalty thereon. 
     
    
     BACKGROUND OF THE INVENTION  
       [0003]     In his introduction of The National Strategy to Secure Cyberspace, President George W. Bush wrote that “securing cyberspace is an extraordinarily difficult strategic challenge that requires coordinated and focused effort from our entire society” and that “the cornerstone of America&#39;s cyberspace security strategy is a public-private partnership.” 
         [0004]     Far from creating another computer security training program such as found in the prior art, what is needed is a method to develop leadership skills through problem solving and technical excellence. It would serve actual cyber security needs much better if students were to be faced with a real-world problem, wherein they must: formulate a clear problem statement; make reasonable assumptions; apply sound analytical techniques and engineering tools; solve the problem to a certain depth; perform risk analysis on the solution; and deliver a solution on time.  
         [0005]     This mindset of an engineering leader was best described by Gene Kranz in his book “Failure is not an Option.” As director of NASA&#39;s mission control in the Apollo era, Kranz led his engineers into uncharted territory, the Moon&#39;s, and established our unchallenged leadership of space. Cyberspace in the twenty-first century is no less challenging than outer space in the twentieth century. Besides, the security of our Nation relies on establishing and maintaining unchallenged leadership in cyberspace.  
       OBJECTS AND SUMMARY OF THE INVENTION  
       [0006]     One object of the present invention is to provide a method for developing leaders in cyber security.  
         [0007]     A related object of the present invention is to train a cyber security workforce skilled in real-world problem solving.  
         [0008]     Another related object of the present invention is to train a cyber security workforce that produces accurate solutions on-time with acceptable risk.  
         [0009]     Yet another related object of the present invention is to train a cyber security workforce in the context of both industry and government sector cyber security objectives.  
         [0010]     The present invention provides a method for developing leaders in cyber security. Cyber security candidates are selected according to a series of qualifying process steps. Cyber security leader-selectees are then developed into cyber-security leaders through a repetitive, multiple week program of problem solving skill development with emphasis on-time performance; communication skill development through impeccable technical writing and compelling presentations; and by mentoring from experienced cyber security professionals.  
         [0000]     Advantages and New Features  
         [0011]     There are several advantages and new features of the present invention. An important advantage is the fact that the present invention provides a method for specialized training to ensure the availability of a dedicated cyber security workforce.  
         [0012]     Another advantage is that the present invention provides training that demands real-world problem solving as opposed to mere academic exercises.  
         [0013]     A further advantage is that the present invention employs selection criteria that select only the best qualified applicants for the specific purpose of cyber security training, as opposed to a generalized program in computer and information technology. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0014]      FIG. 1  depicts a process flowchart for selecting cyber security trainees from a pool of applicants.  
         [0015]      FIG. 2  depicts a process flowchart for developing cyber security trainees into cyber security leaders. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0016]     The present invention addresses a significant component of the National Strategy to Secure Cyberspace by providing a method for developing the top cadets in the Reserve Officers Training Corps into the next generation of cyber security leaders. Through a public-private partnership among the Air Force Research Laboratory, the US Military Academy and Syracuse University, the method taught by the present invention transforms cadets into original thinkers, problem solvers and technical leaders.  
         [0017]     Referring to  FIG. 1 , the present invention develops cyber security leaders by selecting the top cadets in the Air Force, Army and Navy ROTC, providing them with one-on-one mentoring by nationally recognized cyber security leaders from academia, industry and government, and educating them to solve real-world problems in cyber security. To be selected, the present invention requires that applicants meet certain as follows: applicants must be U.S. citizens  110 ; applicants must be graduates of a reserve officer training program (ROTC) or a military academy  120 ; applicants must be upperclassmen  130 ; applicants must be pursuing a curriculum of study in either electrical engineering, computer engineering or computer science  140 ; applicants must have good academic standing of at least a 3.0 grade point average measured on a 4.0 scale  150 ; and applicants must maintain above average physical fitness  160 . If all of these criteria are met, the applicant is admitted to the program  170 . However, if any one or more of these criteria are not met, the applicant is rejected  180 . Additional applicants are selected or rejected in the same manner until a complete class is attained  190 .  
         [0018]     Referring to  FIG. 2 , the present invention develops cyber security leaders through a 6-pronged approach: by ensuring that students acquire the necessary technical expertise  200 ; by developing problem solving skills and the ability to deliver on-time performance  210 ; by communicating through impeccable technical writing and compelling presentations and by mentoring from experienced cyber security professionals  220 ; by acquiring actual cybersecurity workplace experience  230 ; by being exposed to a military environment  240 ; and through repetition of the training routine for a period of several weeks over the duration of the program  250 .  
         [0019]     The rhetorical question on whether leaders are born or developed can best be answered by looking at a four-minute miler. While genetics play a pivotal role in breaking the four-minute barrier, it takes years of hard training to prepare for the feat. Similarly, by starting with cadets who are committed to serving this Nation and who have demonstrated leadership qualities, and by equipping them with the tools to solve a series of real-world problems of increasing complexity, we will transform them into the next generation of cyber warriors. Therefore, physical conditioning and military type camaraderie  240  aspects of the present invention are required. Group eight mile runs are one typical military activity students must participate in.  
         [0020]     Effective communication is arguably a distinguishing trait of a leader. Therefore, the present invention focuses on developing the cadets into effective communicators  220  by requiring individual written reports every week, and several structured team presentations. The instructors and the director who practice the method taught in the present invention will evaluate the reports and the presentations of the cadets.  
         [0021]     The present invention requires provides a course meets once a week for a full day.  200  A typical class starts with the timely submission of written reports and the oral presentation of solutions for the previous week&#39;s problem. Cadets discuss their solutions with the course Director and the instructor, before moving on to a new problem. Each week brings a different instructor, who assigns a substantial real-world problem  200 , then lectures for six hours on the background material for that topic  200 .  
         [0022]     The instructors are drawn from government, academia and industry. They range from a State Supreme Court Justice teaching on the legal aspects of cyber security, to a college professor formulating encryption algorithms.  
         [0023]     The course carries four credit hours of academic credit from a university such as Syracuse University. Successful completion of the all course assignments permits the students to apply the earned credit towards their programs of study at their host institution.  
         [0024]     Finally, cadets are assigned to work with mentors at local private or government cyber security laboratories  230 . This mentoring relationship exposes the cadets to practical challenges of cyber security, and permits them to establish professional relationships with domain experts.  
         [0025]     The duration of the course implemented by the present invention is ten weeks during the June-August timeframe  250 . Each week focuses on one area of cyber security as detailed below: 
        Week 1: Legal Issues: Internet laws and cyber crime, the Fourth Amendment of the US Constitution, search and seizure of data, rights and privacy issues, government versus private workplace, search warrants and wiretap laws, the Patriot&#39;s Act.     Week 2: Security Policies: establishing and implementing security policies, confidentiality integrity and availability considerations, identifying vulnerabilities and threats, establishing disaster response and recovery procedures.     Week 3: Cryptography: mathematical basis for data encryption, substitution ciphers and the Data Encryption Standard, private-key and public-key cryptography, key distribution and trusted authority, digital signatures.     Week 4: Computer Security: operating systems and file system security, passwords and one-way hashes, user-space administration, archiving and back-up strategy, intrusion detection, disaster response and recovery.     Week 5: Digital Forensics: procuring and analyzing digital evidence, preserving the chain of custody of digital evidence, recovering hidden data on hard drives, classifying file systems, analyzing slack and sector data, recovering lost clusters.     Week 6: Network Security: TCP-IP packet format and vulnerabilities, protocol and implementation flaws, buffer overflow, denial-of-service attacks, distributed attacks, email, domain name system, web servers.     Week 7: Network Defense: host and network security, firewalls and periphery intrusion detection systems, bastion hosts, network monitors and traffic analyzers, network logfiles, detecting anomalous behavior, network recovery.     Week 8: Network Attack: port scanners and packet sniffers, IP spoofing, identifying vulnerabilities, designing and implementing network attacks, engineering malicious code, worms and viruses, offensive cyber warfare.     Week 9: Steganography: data hiding in images, classifying steganography algorithms and tools, categorizing vessel capacity, detection and recovery of hidden data, digital watermarking, streaming media steganography, multilingual steganography.     Week 10: Next-Generation Cyber Security: wireless local area networks, wireless encryption protocols, Next-Generation Internet Protocols IPv6, embedded systems, 3G cell phones and personal data assistants.        
 
         [0036]     For each topic, the instructor in charge will assign a substantial real-world problem that requires 40 to 80 hours of team work to solve  200 . Cadets work on teams of three to solve each problem, then write and submit individual reports  210 .