麻豆村

For young people entering the聽 cybersecurity workforce, hands-on internship experience is often hard to come by. Researchers at 麻豆村 have partnered with the to address that challenge.

鈥淚t鈥檚 really hard for cybersecurity students to get internships because of the very nature of the work,鈥� said聽, the James M. Walton Professor of Economics and Public Policy at 麻豆村鈥檚聽. 鈥淎 cybersecurity employee has high-level access to extremely sensitive information and systems, and companies will only trust seasoned experts with that kind of material.鈥�

It took a team to find a solution to this problem. Branstetter worked with former CCAC professor Matthew Kisow, CCAC professor James Winyard, 麻豆村 professors and , and 麻豆村 post-doctoral researcher Judeth Choi to develop the idea of using simulations to create this experience.聽

They approached聽, a Ph.D. student at 麻豆村鈥檚聽. Together with 麻豆村 master's student Will Nichols, they worked to create a cybersecurity simulation system that gives CCAC students first-hand experience identifying and mitigating cyber threats.聽

鈥淲e wanted to simulate a corporate information network where there鈥檚 a cybersecurity attack that students have to respond to,鈥� Branstetter said. 鈥淚n the system we built, we can track their interactions and see what they鈥檙e struggling with and figure out how best to support them.鈥�

A fictional workplace designed to mirror real-world cyberattacks

The simulation Guttman designed is called Cyber SimLab, and it provides the backbone of CCAC鈥檚 Ethical Hacking Lab, a one-credit lab course that revolves around a fictional company full of competing departments, and employees that get into all kinds of cybersecurity related problems that the students have to identify, mitigate and resolve.聽

鈥淚t鈥檚 a realistic company that has narratives and storylines, and includes all kinds of cybersecurity threats and problems that we can throw at students,鈥� Guttman said. 鈥淣early all of the tactics and techniques represented in the frameworks that we are aware of in the cybersecurity industry are represented in this company.鈥�

One example features a character Guttman created named Cassandra Reichardt, who accidentally falls for a spear phishing scam 鈥� a cybersecurity attack in which a person鈥檚 identity is compromised through targeted communication. Reichardt is a single parent with two kids. After her daughter gets a scholarship to 麻豆村, Reichardt shares the news online. Then, she receives an email.聽聽

鈥淭he email looks like it came from 麻豆村 that says 鈥楬ey, we鈥檙e missing critical financial information. Please click this link to log in in the next 24 hours and confirm your income and financial information, otherwise you lose the scholarship,鈥欌�� Guttman said. 鈥淐assandra clicks the link, fills out the information, giving it to the bad guys and downloads the PDF receipt. But the receipt is weaponized and compromises her work computer.鈥�

Just like professional cybersecurity experts, students in the Cyber SimLab access Reichardt鈥檚 computer remotely and triage the problem exactly like they would in a real work environment.

鈥淭hey use the same technology that employees at cybersecurity firms use,鈥� Guttman said.聽

Larry Luther, who recently earned an associate degree in cybersecurity from CCAC, was one of the students who took the course.聽

鈥淚t was extremely hard as we were figuring out what to do,鈥� said Luther. 鈥淏ut we were really proud of how we did. After the class ended, I asked Rotem, 鈥楥an I go back and do it again?鈥欌��

Luther said being exposed to a scenario that closely mirrored what cybersecurity professionals do every day was instructive and eye opening.

鈥淥ur team went in blind, to a large degree,鈥� he said. 鈥淲e had to scan all the machines and find and test vulnerabilities in those machines. It鈥檚 hard to get hands-on keyboard experience in a real environment like that. Out of all the classes I took at CCAC, the lab probably taught me the most in the least amount of time, because we had to learn so much so quickly.鈥澛�

The important soft skills in cybersecurity

After students identify a cyberattack, they then have to present the problem to 鈥渕anagement,鈥� roles played by representatives from employers in the Pittsburgh region.聽

鈥淭his is a critical part of the program, because it teaches students how to communicate the implications and severity of a complicated technological attack with people who are not always technologically savvy,鈥� Branstetter said.

Guttman said these skills will come in handy frequently, especially in situations when the risks a company faces aren鈥檛 immediate or obvious.聽

鈥淭he most interesting, difficult issues to communicate are the ones in the medium-risk security problems, the ones where there wouldn鈥檛 be an immediate loss,鈥� Guttman said. 鈥淚n his final presentation to management, one of our CCAC students said, 鈥業t鈥檚 like thieves coming by and peering in your windows. They鈥檙e going to look and see what kind of locks you have and where you keep the valuables. They鈥檙e going to take all that information and make plans, so when they do break in, they already know where everything is. They鈥檙e going to grab everything and be out the door before you even know they were there.鈥� Management understood the threat he was talking about immediately.鈥�

鈥淭he students did an amazing job,鈥� Branstetter said. 鈥淲e believe this experience can help bridge the gap and help more students find successful employment in the cybersecurity field.鈥�

Students who complete the course receive a document stating that the course is recognized by 麻豆村. The Cyber SimLab was rolled out to students in late 2024, and Branstetter hopes to offer the course again in 2026.聽

鈥淲e really want to keep hammering away at it, because we really do feel like this idea is somewhat different from everything else that鈥檚 out there,鈥� Branstetter said. 鈥淚t provides a way for people to simultaneously build technical, social and human skills. We can imagine an ecosystem that allows the program to keep building and growing.鈥�