Story by Jay Murdock, FSB Marketing Coordinator

In Cambridge, MA, there’s a room where disasters can happen daily, where battles are fought, vulnerabilities are discovered, questions are raised and answered, and untold amounts of data and personal information are at risk.

It’s a drill this time, but the point being made is that it won’t always be a drill.

The room is IBM Security’s X-Force Command Cyber Range. Students from Miami's College of Arts and Science, College of Engineering and Computing and the Farmer School of Business were there as part of a Boldly Creative grant funded through the Cybersecurity proposal.

Students, along with their professors, took part in an exercise usually reserved for C-suite executives willing to spend thousands of dollars to attend. Those participating were: Zaobo He, assistant professor in computing science and engineering; graduate student Josh Morgan, and senior Hanzhou Zhang (both in computer science and engineering); Arthur Carvalho, information systems and analytics professor; and Farmer School Information Systems and Analytics seniors Kyle Kofsky and Yefe Soriano.

The two-day event is designed to help educate the next generation of cybersecurity professionals and give them a taste of the constant war of information being waged through firewalls, hacks, backdoors, and terminals.

 “The Cyber Range is pretty much like a gun range. When you go to a gun range, you shoot in a safe place, you learn how to shoot the gun. The Cyber Range pretty much accomplishes the same thing with cybersecurity,” Carvalho said.

Before taking on a cyber attack, he noted, it’s important that those tasked with defending the data understand that the issue isn’t something that can be dealt with just by using a keyboard and a mouse.

“A kind of a common misconception that we have about cybersecurity is it's a technology problem, which it’s not. It’s actually a human problem, a people problem,” Carvalho explained. “So the first day was trying to understand different roles and our conception, our understanding of cybersecurity in different roles, not only the technical ones but more managerial positions as well.”

Day two put the attendees in the Cyber Range itself for a real-time simulation of a data breach. The simulation is very detailed in the actions and questions that participants must deal with, such as calls from executives, mitigating the attack, identifying the attacker, handling social media reports, right down to holding a press conference and taking questions about the breach from reporters.

“It looks like something out of a movie. There are screens all around you. You're sitting there and all of a sudden, someone gets a phone call and it sends the room into panic mode,” Kofsky recalled. “In the classroom, we learned a lot about how to mitigate security breaches or how to deal with things beforehand, but not how to deal with things ‘post-boom,” deal with the press, how to keep everyone in the company on a short leash to see if it was an internal issue.”

“At some point, they said that they needed a volunteer. I raised my hand, someone pointed at me and said, ‘You are now the incident commander. From here on out, everyone reports to you on what they're doing and you're going to be the face of the response,’” Soriano recalled. “I didn't know what I was doing, but I had a lot of fun doing it.”

The situation gets worse when hackers access the company’s infrastructure, shutting down power, turning off water, or trapping employees in stalled elevators. “Now we are in the position of decision makers who have to very quickly make decisions that could potentially affect people’s lives,” Carvalho remarked.

“The whole process was about three hours, but we were so caught up in the moment, it felt like 20 minutes,” Soriano said. “The biggest take away for me was how important incident response is. It's not really something I considered as a career in cyber security before, but now that I realize how important it is, and more specifically how similar it is to other incident response jobs like firefighting, I'm really intrigued now.”

Information Systems and Analytics recently added an information security minor program, one that Kofsky hopes to help tweak a bit now that he’s been through the Cyber Range. “I'm actually working with Professor Carvalho to try and see if we can alter our curriculum, to see if we can really hone in and get some hard skills in the cyber fields here at school.”

“It's really cool. It really puts you under the gun and really gets you scared and motivated to try to figure things out,” Kofsky said. “It really put an emphasis on how important this sort of event can become and how often it can happen. It’s not ‘if it's going to happen,’ but ‘when it's going to happen,’ and how you're going to respond to a breach.”

Pictured: Zaobo He, Josh Morgan, Hanzhou Zhang, Yefe Soriano, Kyle Kofsky, and Arthur Carvalho in the IBM Cyber Range