In the rapidly changing world of cybersecurity, who better to learn from than the professionals who live in that world every day? High school students are getting just that opportunity through Sandia’s Cyber Technologies Academy, free classes for high school students interested in computer science and cybersecurity.

“The Cyber Technologies Academy is a critical piece of our talent pipeline strategy for cyber professionals,” says Navid Jam (8965), manager of the information assurance group. “The sooner we can engage with students and shape their thinking about computer security and the hard problems we and the nation face, the sooner they can be part of the solution. These students will amplify our national security impact and develop a desperately needed national cyber capacity.”

Jeremy Erickson (8965) and Steve Hurd (8958) started the academy after running the Center for Cyber Defenders (CCD) at Sandia/California, a summer internship for students from high school through doctoral studies.

The goal of the Cyber Technologies Academy is to take motivated students — even those with no computer experience — to a high level of cyber proficiency during high school. The classes combine instruction with hands-on learning, giving students an actual cyber environment in which to network and program.

Academy fills critical education gap

“We noticed that high school students entering the CCD had vastly different levels of skills and experience,” Jeremy explains. “High schools are not well-equipped to teach cybersecurity. Most schools only offer basic computer science classes. It’s rare to find a high school teacher with a computer science background, and high school computer labs typically aren’t set up to run multiple operating systems and allow students to experience networking.”

Drawing on their experience with the CCD, Jeremy and Steve realized Sandia already had the essential elements to teach cybersecurity to high school students — instructors, technology, and space. Jeremy, Steve, and Craig Shannon (8966) taught the first session of classes using Corporate Sponsored Community Service time off for K-12 education activities; computers and networking equipment are available through reapplication; and the Cybersecurity Technologies Research Laboratory (CTRL), which houses the CCD in the summer and had available space.

The academy was an immediate success. For the first session, which ran from March to May, the organizers planned for 54 students in three classes of 18, but quickly added a fourth session after 69 applied. The summer session also had more applicants than space available.

“I wanted to learn networking, which wasn’t taught in my high school computer science classes,” says Kimberli Zhong, a senior at Dublin High School. “The class is interesting, especially the hands-on exercises. We can put the concepts we learn into practice immediately.”

Nikhil Singh, a sophomore at Foothill High School in Pleasanton, Calif., signed up for the academy because he’s interested in a career in cyberintelligence.

“I’m taking computer science classes at my high school, but here we get to program in a ‘real deal’ environment,” he says. “It’s been a real eye opener to learn about other career paths in computer science.”

Extending the academy’s reach to teachers

The academy’s summer session is underway — five weeks of classes that meet for four hours a week for students and a weeklong intensive session for teachers.  Among the participants are students from 23 local high schools and nine students and teachers from several South Carolina schools.

“Clearly, there is a limit to the number of students we can reach directly,” says Jeremy. “So we are offering teacher training and developing curriculum so those teachers can bring this instruction back to their schools.”

That includes building the classroom exercises into a live CD, essentially an operating system on a disk. Once complete, the system will be available free of charge to schools. “This gets schools over the technology hurdle, because with live CD there is no need to install anything on a school computer, but students can still do cyber exercises in an authentic environment,” he says.

The academy is seeking federal and private grants and partnerships to support further curriculum development. Sandians or retirees interested in sharing their experience and expertise through the academy can email cta@sandia.gov to find out about getting involved. Steve and Jeremy will be teaching summer session classes, along with Elisha Choe (8965), John Floren (8961), Kevin Hulin (8136), Thomas Kroeger (8965), Mike Kurtzer (89451), Gabe Nunez (8949), Greg Tubbs (LLNL), Kina Winoto (8965), and CCD interns Steven Barker and Nick Ward (both 8965).

In mid-August, the academy will begin taking applications for the fall program, which will run from September through November. The application and other details can be found at the academy website (https://share-ng.sandia.gov/cta/). Selection is based on student motivation.

“We don’t require any experience or prior knowledge in cyber,” Jeremy explains. “We are looking for students with a passion for this subject, who have the potential to become the best and brightest in the field.”

Cyber Technologies Academy graduates first class

On May 12, the Cyber Technologies Academy recognized its first set of graduates. There are no tests or grades in the program — rather, it offers innovative, hands-on learning opportunities that most students had never before experienced.

“This is an amazing day for all of us,” said Jeremy Erickson (8965). “You all have inspired us to think well beyond the three courses we offered this spring. We would like to expand beyond Tri-Valley and bring this program into high schools across the country.”

Jordan Robertson, a technology writer with Bloomberg News, shared with the students his experiences reporting on the cyber world for the last 10 years.

“Cyber is one of those rare fields where you can have independence and impact,” he said. “Creativity, initiative, and even challenging authority are rewarded in this field. You can create your own opportunities and potentially have national, even international, impact.”

He told the students about three researchers he has written about who exemplify this potential: Jay Radcliffe, who hacked the insulin pump that enables him to control his diabetes and ultimately forced medical device makers and the FDA to address vulnerabilities with wireless devices; Kristin Paget, now at Apple, who demonstrated how easily radio-frequency identification (RFID)-enabled cards can be hacked; and Barnaby Jack, best known for a 2010 demonstration of “Jackpotting” in which he remotely hacked into several different ATMs and caused them to spit out cash. (He died in 2013). 

Robertson closed with some advice for the students — keep studying computer science. “A college degree in computer science, even if you don’t go into that field, demonstrates competency in thinking and analysis that employers really like,” said Robertson. “If you pursue computer science of any kind, you will have lots of options.”