New cyber range helps future tech workers wargame cybersecurity

In central New York, a dozen men and women gathered in a pared down, “War Games”-like room earlier this month. 

It was a small room, about 800 square feet, with mostly white walls and commercial carpet. There were three rows of desks, each lined with computers and facing three large panoramic monitors that spanned one entire wall of the room. 

Quite suddenly, the overhead lights dimmed and an ominous red light flashed on. A cyberattack was underway. The people at the desks quickly got to work.

Those people were students at Fulton-Montgomery Community College. The physical space was not a war room, but a lab. And the cyberattack was just a simulation in the controlled environment of a cyber range, the first such one on a campus in the nation.

Leaders at the college, which is part of the State University of New York system, opened the cyber range designed by IBM and powered by Amazon Web Services software, to the public on May 2, with student use to begin this fall. It is partially funded by a $350,000 grant from the SUNY Transformation Fund, which exists to help support innovation on campuses in the system, as well as by county and philanthropic money, matched by the state.

The idea for the cyber range came after Billy Eipp, a computer science instructor at SUNY-FMCC, saw a demonstration of an IBM cyber range in Cambridge, Massachusetts, and decided it needed to be brought to the college. He watched between eight and 10 people navigate a simulated attack on their business.

“It really blew me out of the water,” Eipp said of the experience. 

During the demonstration, Eipp watched as technologists worked to mitigate the attack and protect systems, and as communications staffers prepared a media strategy to disclose the hack. The communications staff initially botched the media statement during the exercise, and, as a result, a screen showed the company’s stock price drop.

Scenarios can be tailored to just technologists who act as first responders to an attack, or can, like the demonstration, include the business side of the company, so employees can practice planning strategies, a media response and next steps.

Cyber ranges have become more widespread in recent years as states have embraced them as a way to train a desperately needed new generation of cybersecurity workers. Now, a college is embracing the approach. 

SUNY-FMCC will integrate its cyber range into its existing cybersecurity curriculum. Past courses were typically taught in a computer lab or classroom, with students learning from textbooks about attacks or other historical cyber threats. The range is a whole different ball game, said Martin Waffle, an associate professor of computer science.

“When you are using a traditional lab, although you can teach those courses, it’s not as exciting as it will be in the cyber range,” he said. 

Enrollment has increased since the cyber range was announced. Last year, Waffle said, the community college had 32 applicants; this year, that number has grown to 66, with officials expecting even more interest once the range is fully operational.

The cyber range will help students better prepare for entry into the cybersecurity workforce, a sector that has more than 500,000 vacancies nationwide. The lack of workers has prompted the federal government to act, including to encourage skills-based hiring and apprenticeships in a bid to open up nontraditional pathways to employment.

But a cybersecurity workforce deficit comes as cyber criminals continue to try to exploit vulnerabilities and use new technologies to do so. 

“We always talk about this as this asymmetric threat,” said Ross Maughan, IBM Consulting’s managing client partner for state, local and education in New York. “The attack vector is increasing all the time, and the bad actors out there are getting more and more sophisticated. As much as it is about people, it’s also about the skills in terms of them being able to combat what is still a rapidly evolving threat.”

The unveiling earlier this month was attended by business representatives, county officials and SUNY system leadership.

The range will be free to SUNY-FMCC for two years, then it will be up to the school to find ways to pay for its continued use. Much of that will be absorbed in the overall operating budget, Waffle said, but there will also be opportunities for local businesses, government agencies and others to book the range and use it for their own exercises. 

Eipp said the college is at the “tip of the iceberg” of potential future uses. Having that facility available will be a game-changer, he said.

“The immersive hands-on education is just going to be to die for,” Eipp said. “It’s a new model for education, for cybersecurity, for technology.”