The new face of security

What will the next generation of America's cyber defenders look like? A mom? A dad? An Army national guardsman? A former singer in a rock band? The answer is yes — to all of the above.

Clearly, the days when the federal government draws its best security experts from the ranks of young computer geeks and converted hackers are passing. It's a matter of necessity. The need for security expertise has outstripped the pool of available talent.

So last year, the Bush administration awarded the first grants to establish the Cyber Corps as a way to attract and train needed cyber defenders. The program, a continuation of President Clinton's Federal Cyber Service program announced in January 2000, offers scholarships to undergraduate and graduate students studying information assurance in exchange for two years of government service in the Cyber Corps. As many as 300 people from all walks of life could be part of the government's scholarship-for- service program by the end of the year.

As recruits begin entering the federal workforce, they will change the face of cybersecurity. Here is a look at five individuals who could be your agency's next line of defense.

A Family's Crisis

Julie Evans is one of the 66 students currently enrolled in the Cyber Corps program.

For her, the decision to apply was personal. Several years ago, her oldest daughter, Brandy, was diagnosed with liver cancer and required a liver transplant or she would die. On Oct. 24, 2000, "the call came," Evans said. A liver had been found for Brandy via the organ donation network run by the United Network for Organ Sharing (UNOS). The liver was a successful match.

Seven months later, Evans read a story in an Oklahoma City newspaper about the Cyber Corps program. A computer science degree could be useful to the medical community, she thought. Perhaps she could get a job working at the Department of Health and Human Services or even with UNOS itself.

She discussed the idea with her family, then interviewed at the University of Tulsa in Oklahoma, one of the six schools that have received federal money to distribute as scholarships. A short time later, she was accepted. "I saw it as a once-in-a-lifetime opportunity," she said at the 2002 Cyber Corps Symposium at the University of Tulsa.

Evans began her master's degree courses last fall, and after 4,500 lines of code, "my compiler program worked." Evans admits she is a "nontraditional Cyber Corps student. I spent 21 years getting my undergraduate degree" in computer science.

She is nontraditional in another way, too. Her husband, Preston Gillmore, is also a Cyber Corps scholarship recipient studying at the University of Tulsa. He began the program in January after receiving his master's in business administration. They are one of three couples participating in the program. "We study together all the time," Evans said.

Evans and Gillmore, who are in the process of selling their house in Oklahoma City, work near each other, too. They have summer internships in the Washington, D.C., area. Evans is working at the Treasury Department pulling together best practices on how to secure Microsoft Corp. Windows 2000 servers before Treasury installs the servers departmentwide.

Gillmore, meanwhile, works at the National Institute of Standards and Technology where he is drafting systems administration guidance for securing Cisco Systems Inc. routers. The guidance is designed for smaller organizations with few resources that need a document to walk them through the process of securing routers, he said.

Gillmore, who was an information technology manager for five years, said he was able to jump right into his work at NIST. "I have a general idea of what help [organizations] need," he said.

When the two graduate next May, they will work for federal agencies, as required by the program. However, they still have to muddle through the job application process. "In my case, they told me I was overqualified, that they didn't have a position for me," Gillmore said, referring to his job opportunities at NIST after graduation.

But he is excited about future prospects in the government. "The Department of Homeland Security — that's a whole new ballgame," he said.

A Different Stage

Rick Ayers, a graduate student at the University of Tulsa, can soon add cyber defender to his resume — right after teen golf sensation and rock star. Ayers has two semesters remaining at the university before he starts his two-year stint at a federal agency, which he hopes will be in Southern California near the beach, he said.

Ayers spent some of his youth in San Diego. He participated in a junior amateur golf tournament that brought together the best teen golfers in the world. He placed a respectable 60th.

Ayers started his undergraduate degree at Louisiana Tech University where he was studying architecture. But a job with a market research firm during school introduced him to the world of IT, and a woman he met on the road while touring with a band called Apache Rain introduced him to Tulsa.

After the tour was over, Ayers decided to take some computer courses and finish his undergraduate degree at the University of Tulsa. "That's when I heard about the Cyber Corps," he said. Ayers applied and was accepted to the scholarship program, an opportunity he described as "a very big foot in a door."

For the summer, he is working at NIST where he is testing the security of two versions of the Linux operating system designed for personal digital assistants. "We're using smart cards, voice recognition, picture passwords — different ways of access controls," he said. "Four-digit passwords are too easy to crack."

Changing of the Guard

Despite his undergraduate degree in history, Chris Rush found that he was becoming a computer expert on the job mostly by being in the right place at the right time.

The Army National Guard's Camp Robinson in North Little Rock, Ark., where Rush was based, was the hub for the National Guard's high-profile, high-volume distance-learning program. One day, "they asked me what I knew about [setting up a] Windows NT domain," he said. With the help of two others, Rush succeeded. After that, "they kept handing us projects."

Rush had been on active duty with the Army National Guard for about seven years when he read about the Cyber Corps program in a magazine and decided to look into the program. He called Carnegie Mellon University, one of the six universities involved in the program, and within two weeks had submitted his paperwork to the school. "I found out in July that I would start in August," he said.

The opportunities have been "fantastic, particularly at Carnegie Mellon," Rush said. He has access to the school's CERT Coordination Center, which monitors computer security incidents and vulnerabilities and sends out security alerts to organizations.

"By doing work study at CERT, I get to see what happens with incidents, how they get reported, how we educate folks," he said.

Rush is finishing his summer internship at the Federal Aviation Administration and will graduate from Carnegie Mellon in December. At the FAA, Rush is working on long-range plans for researching enterprise-level security tools that will benefit the FAA as a whole.

And what will he do after graduation? "It depends on what the need is," Rush said. But a job at the FAA would suit him just fine.

Security-centric

Tony Meehan will be a junior at the University of Tulsa this fall, and already he's on his way to a job at the National Security Agency. Telecommunications security is his specialty. "I knew NSA focused on what I was focusing on," he said about his application to the agency.

Meehan is participating in the Defense Department's version of the Cyber Corps program. He will receive a full scholarship for the remaining two years of his undergraduate education, an internship next summer at NSA and a two-year stint at the agency when he graduates. "Almost immediately, I'll start the background check" that will allow him to work there, he said.

"When I was in high school, I never expected to work for the government," Meehan said at the Cyber Corps Symposium. But once he learned about the opportunities in government, he got excited about the prospects.

"The model is different in government, where the mission is to protect the national infrastructure," he said. "I've had so much fun here in my research," much of which he can apply at NSA. "The actual work you get to do [in government] is relatively more important — even extremely more important. I know I will help society." And, Meehan added, he doesn't care about the money.

The lure of government service may have already taken hold. Meehan admits he finds himself watching C-Span some nights just before he falls asleep.