Students Stop Hackers While Earning Course Credit

The University of Illinois at Urbana-Champaign is a hub of research activity that generates tons of research data. For the last six years, for instance, the National Science Foundation (NSF) has awarded more funding to Illinois than to any other university.

That means we’re also a big target for people looking to steal our data.

Illinois is under attack pretty much all of the time. The numbers are staggering. On an average day, our campus firewall intrusion prevention blocks 17,000 attacks against campus. Like a digital hydra, as soon as one attack is stopped, two more seem to pop up.

Technology Services is the central IT provider for the University of Illinois. Our security analysts work tirelessly to protect our network and data from these hydra-like attacks.

It’s a big job, and we need as much help as we can get.

Which got our security analysts thinking: why not bring on some really smart people who are heavily invested in keeping Illinois’ network reliable and safe?

This was Wayland Morgan’s thought when he proposed awarding students credit for spending a semester working with the Technology Services security team.

“We’re at a major research university with a world-renowned Computer Science department. And these students know a lot. They can look at some our code and clean it up, make it more efficient, in just a few minutes,” he said.

Morgan, who worked as a Senior IT Security Analyst with Technology Services, learned from instructors in the Department of Computer Science that many students are interested in cybersecurity. For instance, Miranda Kang, a junior majoring in Computer Science, wants to work in cybersecurity because it combines her love of puzzles with an interest in policy development, the latter of which she has been practicing since her debating days in high school.

But most college students like Kang don’t have a lot of opportunities to practice necessary skills outside of their classes. That is, until now.

Hydra, meet Hercules.

“Real scenarios with impactful outcomes”

In November 2016, Technology Services partnered with the Department of Computer Science to establish an independent study course in cyber security. According to the program’s Independent Study Charter, a handful of students would earn course credit while receiving hands-on training in incident and threat response, risk and compliance, and building infrastructure that helps protect sensitive data.

The independent study course officially started in January of 2017 - and its first semester was a big success. The goals of the project are--and remain--lofty. According to the course charter, the project “empowers researchers, enriches student success, and adds both operational and non-operational value to the University’s Information Security objectives.”

Sponsors and students alike say that the project has already achieved these goals.

“We couldn’t have asked for a better experience. The students did so much work, they learned so much about what it takes to defend a network of this size,” Morgan says.

Students worked on a variety of projects, from the Illini Secure program to cleaning up threat detection scripts. The sheer breadth of projects available to be worked on drew Shannon Strum, a Computer Science major, to the program. But Illini Secure was her favorite because it allowed her to see how security policies--which can be quite abstract--are working right here and right now at Illinois.

“With Illini Secure, we’re trying to take a pulse check as to how security is doing on this campus and to see if policies and standards are being implemented. And so seeing the data from various campus entities that I was familiar with was really kind of cool, to apply these standards to real life,” she says.

But this project is a learning opportunity for everyone, not just the students. Sponsors want the independent study course to continue to grow and develop.

Roy Campbell, Associate Dean for Information Technology and Sohaib and Sara Abbasi Professor of Computer Science, as well as Executive Sponsor for the independent study course, is looking toward the future.

“Illinois produces a lot of good security graduates that end up in terrific jobs; industry, government, education. This program adds an element to their skills that is difficult to come by: practical defense of a complex network in real-time cyberspace. It’s hands on, involves trust and integrity, involves them in teamwork with great colleagues, and they get to apply skills they hear about in our courses in real scenarios with impactful outcomes. I would like every student wanting to work in a professional security environment to graduate from this excellent program,” he says.

“To help protect my university”

For now, though, students are learning and having a great deal of fun while they’re at it.

Nicholas Hackmiller, a senior majoring in Computer Science, notes how cybersecurity is almost like playing a game.

“It’s you versus the bad guys, or the good guys, depending on what side you’re on,” he says. It’s this “competitive nature” that first attracted him to the field.

Almost all of the students involved in the project echoed this sentiment. Young Li, a junior majoring in Computer Engineering, added a slight twist, however.

For Li, cybersecurity is less of a sport and more of a love letter written with a really, really cool pen.

“Being able to help protect my university, the university that I love (I feel like my education couldn’t have been this good anywhere else, honestly), and so being able to defend university networks against attackers so that other students can feel that kind of safety in their environments, that’s very meaningful to me. And also very interesting from a technical perspective because I get to learn about all these cool tools that I never even heard of until, like, a month ago,” Li says.