During the Oct. 27 Massachusetts Cybersecurity Forum, officials announced grants to help construct ranges and SOC facilities at Bridgewater State University and Springfield Technical Community College (STCC), the first two campuses participating.
The other big news from the forum was the launch of CyberTrust Massachusetts, a membership nonprofit that will fund SOCs’ and ranges’ ongoing expenses, as well as bring together business, government and public higher ed participants. State funding will cover CyberTrust Massachusetts’ first six months of operating expenses and a yearlong cyber range services contract.
Once underway, the SOC and ranges initiative aims to address cyber workforce and resource challenges statewide.
New college graduates often find that even entry-level cyber jobs demand several years of experience, said Stephanie Helm, director of the Massachusetts Cybersecurity Center at the Mass Tech Collaborative (MassCyberCenter), a public-sector organization involved in launching the initiatives. Putting their learning into practice at SOCs and ranges, however, could give students a leg up, she told Government Technology.
This, in turn, would bring more experienced entrants into the cyber workforce, helping address a talent shortage. Massachusetts has roughly 20,700 unfilled public- and private-sector cyber roles, according to cyber job market analysis tool CyberSeek.
Plus, local government, nonprofits and small businesses could turn to the SOCs and ranges for low-cost services to meet their needs and budgets. Organizations could receive security services from the SOCs and train staff at the ranges.
FIRST CAMPUSES
Bridgewater State and STCC became the first higher ed participants, after responding to a February request from MassCyberCenter.
Now Bridgewater expects to open its main range in summer 2023, followed by its SOC in late 2023 or early 2024, per a state press release. The range will accommodate 24 in-person students at a time. STCC’s facilities, meanwhile, are slated to open in 2024 and will be managed in collaboration with consortia of nearby higher education institutions. Those include Bay Path University, the University of Massachusetts Amherst, Western New England University, Elms College and Springfield College.
MassCyberCenter has also been seeing interest from additional higher ed institutions as more details on the program emerge.
Several more applied in May and, at the Oct. 27 event, “we were hearing from people [who said,] ‘I saw that [request] when it came out, and I didn’t answer it, but I’m thinking I should have,’” Helm said. “I think part of it was just trying to understand what the concept was and not understanding there was going to be funding available.”
Colleges and universities also don’t need to host their own SOCs and ranges to participate. The facilities will have cloud-based infrastructure, enabling additional students to join remotely, CyberTrust Massachusetts CEO Peter Sherlock said.
BUILDING CYBERTRUST MASSACHUSETTS
The state is funding the SOC-and-range program’s initial launch, while CyberTrust Massachusetts is expected to finance continuing operations. The nonprofit looks to do that through business members’ dues, sponsorships, philanthropic contributions and scholarships, Sherlock said. Other members might also pay membership fees.
“We’re looking to transition to support primarily from the business community,” Sherlock said.
Business members could include any company with cyber staff and a presence in Massachusetts. Companies joining CyberTrust Massachusetts could benefit, in part, by connecting with higher ed members over aligning curriculum to better suit the skills employers needs from new cyber hires.
Academic institutions interested in participating in ranges and SOCs would also join, as would local governments seeking the help of these services.
Local governments must clear one step, though: They must write down incident response plans and walk through them at least once before becoming members, Helm said. That will set governments up to use the intelligence the SOCs provide.
“The reason for that [requirement] is, it isn’t good training for a student to call a municipality and say, ‘You’ve got something going on in your network,’ and the muni going, ‘Oh, no, what do I do next?’” Helm said.
The MassCyberCenter provides resources to help municipal governments establish such plans. Helm said many municipal officials say they’re aware they need incident response plans but “haven’t really gotten around to it.” Having CyberTrust Massachusetts membership as another incentive might prompt more action.
Another reason to encourage action, Helm said, is that some cyber insurers may ask prospective clients to share incident response plans.
Sherlock said he aims to see SOCs provide a bundle of cybersecurity services that can help under-resourced communities boost security and preparedness for minimal costs. Services that could help local governments become more insurable could be particularly valuable, he said.
BUT WILL IT WORK?
There will be a lot of metrics to look to when assessing if the program is successful. Sherlock anticipated examining the initiative’s impact on the quantity and diversity of the state’s cybersecurity graduates over time. He’d also look to CyberTrust Massachusetts’ membership counts as well as the income it generates from services fees and membership dues to assess its performance.
Another question remains: will students who train up cyber skills in the new facilities stay in Massachusetts or depart to work or live elsewhere?
“That’s the million-dollar question,” Sherlock acknowledged.
Locating the ranges and SOCs at community colleges and state universities means they’re reaching a student body that tends to already live in-state, increasing chances they’ll stay put, he said. Plus, Helm said, public institutions are more likely to draw some enrollment from older students who hold part-time jobs and are already building their communities locally.
While residents could still be lured into remote work for out-of-state firms, Sherlock said he expects cyber employees to prefer hybrid options.
“I think there is still a geographic factor in employment, despite the fact that it’s possible to work remotely in most ... of these cyber jobs,” he said. “It’s not necessarily as rewarding as if you can be in the same local area and work part-time on site, part-time remotely. We’re seeing some emerging results that those kinds of arrangements tend to be best for the workers’ careers [and] best for companies.”
