Amid groundswell in cybersecurity courses, novel UMD seminar permits students to hack campus network

The young men and a lone woman arrive in dark T-shirts with logos for "Digital Forensics" and "Major League Hacking." They unzip sleeves to razor-thin laptops, plug into the lab monitors, and commence an assault that in another place and time could send them to jail.

Their assignment: hack their college.


They are a class of honors students at the University of Maryland, College Park who can read in C-code, compute in binary, and whose studies have brought them to this new frontier in cybersecurity education.

"We turn them loose on the larger campus network," said their instructor, Rob Maxwell, who has presented his teaching method at security conferences. "I've gotten some interest and a few people alarmed at the notion."


Maryland has emerged as a leader in cybersecurity education as its schools moved to meet a growing demand for workers qualified for jobs in the state's burgeoning cybersecurity industry.

As the internet exploded in use over the past 25 years, an entire industry sprang up in the state, largely around the National Security Agency, to protect the nation and its cyber infrastructure, communications and data. Maryland's cybersecurity workforce is estimated at about 37,600 people, but more than 16,600 jobs remain unfilled statewide, according to CyberSeek, a nonprofit working to close the gap.

"More and more things are connected to computers; soon your washing machine and fridge will be," said Anupam Joshi, director of University of Maryland, Baltimore County's Center for cybersecurity. "We're exposing more and more to people who wish us harm. That means the demand for people who know how to defend against it is not going away."

The surge in demand has spurred specialized programs at universities throughout the University System of Maryland, from courses like Maxwell's and dorms reserved for cybersecurity students at College Park and the UMBC center to online degree and certificate programs at its University College.

Instruction in cybersecurity has long been included in computer science studies, but the field evolved in recent years into distinct programs.

Morgan State University created its program about six years ago. About two years later, College Park began the first honors program in cybersecurity, the Advanced Cybersecurity Experience for Students, or ACES. About a month later in 2013, UMBC launched its own Cyber Scholars Program. Towson University said it was among the first to connect cybersecurity courses as an academic track for undergraduates.

A team of University of Maryland, Baltimore County students, the Cyber Dawgs, won the National Collegiate Cyber Defense Competition in April. The first cyber scholar to graduate from UMBC accepted his diploma with 11 job offers in hand.

Seventeen colleges in Maryland have earned federal distinction for excellence in cybersecurity — more than any other state.


"These schools have been doing this longer than anybody in the country and are the real leaders," said Casey O'Brien, executive director of the National CyberWatch Center, which tracks cybersecurity education across the country.

The center based at Prince George's Community College was founded with 10 colleges in 2005. Today, the network has grown to nearly 100 colleges, with 28 of them in Maryland.

The academic arms race continues today. Coppin State University announced plans last month to launch its own cybersecurity program. The U.S. Naval Academy is building a five-story, $120 million cyber center with security features to safeguard classified information.

The academic expansion is driven largely partly by the NSA, headquartered at Fort Meade in Anne Arundel County, and defense contractors such as Northrop Grumman Corp., which has poured money into college programs.

The state's politicians are working to secure what's become a vital industry. Gov. Larry Hogan designated October as Manufacturing and cybersecurity Month. Former U.S. Sen. Barbara Mikulski steered federal funding to local projects, such as the Naval Academy building.

"No other state has the cluster of both public and private universities working on this that can also connect to such a cornucopia of federal agencies," she said.


Since the demand for workers outstrips the supply, qualified candidates can expect an immediate return on their educational investment.

Companies routinely offer Towson's cyber graduates starting salaries that exceed $65,000, said Michael O'Leary, who coaches the cyber team and chairs the math department.

"I tell my students if they get a job offer for less than that to come talk to me," he said. "I would say, 'Let me call up a couple friends of mine.'"

O'Leary invites graduates back to campus each year for live-fire exercises in which his students defend their networks against professionals. Last year's exercise caused a stir when hackers hit the undergrad defenders with cunning French malware.

"If you've got the technical skills, you get jobs — you get piles of jobs," O'Leary said. "Name a big company that hasn't been hacked: Wal-Mart, Target, McDonald's."

Still, cyber classrooms remain dominated by men. Maxwell's course at the University of Maryland has just one woman this semester. At UMBC, senior Alejandra Diaz often finds herself outnumbered.


"I might be the only woman in the class," said Diaz, who turned down a job with Northrop Grumman to pursue her master's degree. "You almost feel like a leader for the other younger women."

UMBC, which has numerous cybersecurity companies located at its on-campus research park, is focused on shrinking the gender gap. It offers subsidized coding classes for teenage girls and started the Cyber Scholars Program to bring women and minorities into the field. The program is run by the college's Center for cybersecurity in partnership with its Center for Women in Technology.

Diaz's fellow seniors have signed with Silicon Valley companies and launched startups in their dorms. These are the college seniors for whom an idle summer in their parent's basement after graduation seems unlikely.

Those graduating this spring from the ACES program in College Park reported in a survey they had jobs with salaries between $80,000 and $120,000, said Michel Cukier, the program director.

ACES senior Andrew Liu of Olney said he turned down Facebook and Dropbox before signing with Google in November.

"You signed late," said his classmate Toby Lin of Rockville. "Most people signed in October."


Lin and classmate Franz Payer of Ellicott City started a company called Cyber Skyline. It offers online tests — to find the message hidden in programming code, for example — to help tech companies judge job applicants. The 22-year-old classmates secured funding in October, but didn't want to say how much.

"Enough for us to play around with it for a year," said Payer, a graduate of Centennial High School. "When I was in high school no one mentioned cybersecurity. It's changing fast."

One recent afternoon, the students settled into Maxwell's course, Advanced Seminar in cybersecurity: Penetration Testing. Here the line blurs between offense and defense, between Terps senior, IT staffer and hacker. But the rules are clear as cheap malware: Students must report all vulnerabilities; they may not pry open network doors to personal information like grades.

The Evening Sun

The Evening Sun


Get your evening news in your e-mail inbox. Get all the top news and sports from the

"It's kind of a forward-thinking model in trusting the students for something like this," said O'Brien, of CyberWatch, who said a few other schools have tried such courses.

Maxwell worked for about a decade as security operations manager at the College Park campus. He started the course about six years ago and unloosed his students to hunt for security weaknesses in the college network.

"I don't want to go into specifics," he said. "It feels like every year we find one really, really interesting thing."


The students have spent days prodding the defenses, scanning for hidden users, and turning the network's doorknobs, searching for one left unlocked.

Their laptop screens flash with streaming code when Maxwell opens class.

"I want to hear what you're finding," he says.