Arkansas Universities Build Cybersecurity Hub with $5M Grant

Lee Watson of the Forge Institute, left, here with Professor Philip Huff, says Arkansas is on “the cusp of a national revolution in cybersecurity and grid resilience.” (Steve Lewis)

Armed with a $5 million federal grant and a regiment of interested students, Arkansas’ universities are building a cyberdefense hub and workforce conduit to help parry computer attacks that have crippled hospitals, schools and businesses.

The effort’s main focus will be shielding America’s power systems.

The U.S. Department of Energy’s Office of Cyber Security, Energy Security & Emergency Response allocated the money to further work at the Emerging Threat Information Sharing & Analysis Center — a sort of cybersecurity clinic — at the University of Arkansas at Little Rock.

The grant came on top of a $1 million grant announced in 2023.

“The grant supports the creation of a national infrastructure in Arkansas … which expands the workforce in cybersecurity and energy and industrial technology and advances us in innovation and community cybersecurity services,” said Philip Huff, an assistant professor of computer science who is leading the analysis center on the Little Rock campus.

He and his team hope to generate workforce innovation and leverage their cybersecurity students’ emerging skills to protect businesses, government offices, small electric cooperatives and other enterprises that lack resources for their own cybersecurity professionals.

“It’s education, innovation and community services,” said Huff, who compared the community service component to programs using health care students to treat patients in underserved communities.

The grant is for only one year, “but the vision is to expand our offerings as a state and as a region for critical infrastructure security,” Dr. Huff said.

The global need for more cybersecurity professionals “is famous,” the professor said. “Every business and every industry is affected. You pick up the news, and another school, another hospital or another county has been hit by ransomware. And that’s been the same story for the past 10 years. We have to protect essential services like the power system.”

Past Raids, Future Defenders

Criminals took over the Little Rock School District’s computer system in 2022 and forced it to pay about $240,000 in bitcoin to regain control.

Legal expenses for negotiations and consulting, as well as new threat detection software, brought the school district’s total expense to almost $700,000.

Last week, Arkansas Business reported on fallout from a February cyberattack on health care billing and payment clearinghouse Change Healthcare, which froze cash flows to Arkansas hospitals, physicians and pharmacies. And other examples abound.

“The issue goes beyond just cybersecurity workforce needs,” Huff said. “Cybersecurity fits into the labor market in general. Students in advanced automation technology, manufacturing and construction and building automation can all benefit.

“Cybersecurity knowledge in any field that involves industrial technology is crucial. We can upskill those students with lifelong skills they’re going to need.”

UA Little Rock is handling the DOE grant, working with the the Forge Institute, the University of Arkansas at Fayetteville, the University of Arkansas at Pine Bluff, and five of the UA System’s two-year colleges.

Dr. Huff said major work will begin next month. Students will work at their own pace to prove their skills and earn a “cyber informed engineering” certificate.

“Some students may take three weeks [to finish]; others may take a year, but they have that flexibility,” Huff said. “It’s a much better approach, I think, and students will be coming out with skills that industries have told us that they need.”

The certificate holders will emerge with practical experience and the knowledge that they helped Arkansas enterprises protect their systems, Huff said. “It’s very similar to the health care worker shortage. Those students don’t learn everything about health care by sitting in front of a book all day. They are actively working with people to understand how to better help them. We want to apply that model.”

Eventually, the certificate program could attract thousands of students; 100 undergraduates are now working toward degrees in cybersecurity at UA Little Rock alone.

‘Value Add’

Students in industrial technology, engineering and related fields can get the cybersecurity certification as a “value add,” Huff said. “It’s a national initiative that the Department of Energy is pushing,” enlisting Auburn University, Georgia Tech, Idaho State University and other institutions. “The program will be competency based. So rather than sitting in class for a semester listening to long lectures, students will acquire the competencies that we expect them to have once they come out of the certificate program.”

And those are the skills that industries are looking for, he said.

The $5 million grant provides funding for what Huff called a three-ring circus: advancing artificial intelligence to fight cyber criminals’ growing bag of tricks, devising a curriculum for the cyber informed engineering certificate and developing new programs with the Forge Institute of Little Rock, already a fortress against cyberattacks.

The Forge Institute is creating an energy innovation center to enhance cybersecurity techniques and commercialize them. The institute, founded in 2018 to enhance community and national cybersecurity resilience, emphasizes workforce development, innovation, research and collective defense, according to Chairman and CEO Lee Watson.

“We are on the cusp of a national revolution in cybersecurity and grid resilience, right here in Arkansas,” Watson told Arkansas Business. Forge partnered with UA Little Rock, UA and UAPB in 2019 to create the state’s Consortium for Cyber Innovation, focusing on “aligning capabilities and efforts to make a measurable impact” in Arkansas and beyond.

“The collaboration … signifies a monumental leap towards safeguarding our nation’s energy infrastructure,” Watson said, giving particular praise to UA Little Rock Chancellor Christina Drale, Huff, Professor Chris Farnell of the University of Arkansas and Grant Wangila, interim dean of the School of Arts & Sciences at UAPB.

Both Huff and Watson also cited U.S. Sen. John Boozman for his support of the program.

The Forge Institute will lead development of a national innovation center for grid security, “not just incubating early stage ideas,” Watson said. “We are nurturing the seeds of national security and resilience.”

He expects the Arkansas center to be a “beacon of American innovation and determination, setting a pioneering path” for the rest of the country.

Huff said the clinic model gives students a chance, under close supervision, to help utilities, electric distribution cooperatives, public power districts and municipal utilities improve their cyberdefenses and innovate grid safeguards.

The Forge Institute will deploy students to work on technologies that utilities have developed in-house but lacked the resources to commercialize, Huff said.

“The Department of Energy itself has a tremendous amount of intellectual property that they want to move to commercialize,” Huff said.

“We have a great partnership with them and with the Idaho National Laboratory” in Idaho Falls, which has been a hub of nuclear power research and electric system innovation for more than 50 years.

Cyber Nightmare

What kind of cyberattack worries Huff the most? Something that would take down big sections of the power grid. “The grid is normally very resilient, and it recovers extremely well [in the face of natural hazards like storms or extreme weather],” Huff said.

“But if attackers were to damage very expensive equipment, like transformers, and take large numbers out of service, recovery becomes much more difficult.” He said distributed power infrastructure, like solar farms, are even softer targets. “So as we’re developing new technologies for the power grid, there’s a lot of innovation space for securing these technologies.”

The cybersecurity clinic is using artificial intelligence, including large language models and autonomous reinforcement learning, to develop cyberattack mitigation techniques that aren’t readily apparent.

“We have an Arkansas company, Bastazo, that’s working with us on the grant as well,” Huff said. “They’re leading that initiative on the cybersecurity clinic side.” Bastazo, Greek for “to carry the burden,” is also partnering with Salvador Technologies of Israel on the protection project, known as “eXExtracted Configuration Security,” which is funded through the BIRD Foundation and the state of Arkansas.

Part of the big job ahead will be staying ahead of new global cyberattack techniques, Huff said.

“It’s a daily battle. You have nation-states that are developing capabilities. You’ve probably heard of the People’s Republic of China developing capabilities to attack the power grid. The FBI director went on the record about it recently.”

FBI Director Christopher Wray, speaking at an April 4 conference of cybersecurity experts, described his bureau’s aggressive tracking of cyber threats and its ceaseless pursuit of attackers.

“There’s a threat to our utilities, because they are kind of on the front lines of international cyber warfare,” Huff said. “So the way I think of emerging threats, I think of new ways that could threaten new technologies being deployed in our critical infrastructure technology. Artificial intelligence and other new technology trends can be misused. But we’re also thinking about how we can use those technologies to defend ourselves better. Automating defensive actions is much easier today than it used to be.”