Safe Space

The Innovative Virginia Cyber Range is Giving Students in Virginia — and Beyond — a Chance to Hone Their Cybersecurity Skills

Commonwealth Cyber Fusion 2020, Virginia Military Institute

Between 2010 and 2014, the U.S. cybersecurity job market showed significant growth; job postings for positions within the industry increased 91%, according to data compiled by analytics software provider Burning Glass Technologies. States across the country have struggled to find qualified professionals to fill those roles.

In 2014, Virginia had the second-highest number of cybersecurity-related job postings of any state — 20,276, a 38% increase from 2010. Nearly a third of the cybersecurity jobs in the Commonwealth, though, were unfilled at the time, according to Virginia Cyber Range Director David Raymond, Ph.D.

In response, the Commonwealth established a cyber commission, which made a number of strategic planning-related recommendations — including one that led to the 2016 creation of the Cyber Range, a cloud-hosted platform designed to give students in the state practical cybersecurity learning experience.

Real-World Guidance

Through realistic labs and exercises performed in virtual environments, the Cyber Range serves as a training ground for high school and college students to practice activities associated with safeguarding network systems, such as securely configuring operating system access.

In addition to course materials written by Virginia educators, the virtual cloud-based platform, which is overseen by an executive committee comprising public institutions within the Commonwealth, is available at no cost to Virginia public schools, both K-12 and universities. Students can access its cybersecurity exercises via essentially any computer with a web browser and internet connection — whether they’re on a campus, at home, or in another location.

The program “is really about talent development,” said Raymond. “We tell educators: If you’re going to have a cybersecurity class, like any technical instruction, you have to have a hands-on experience along with it, or it’s not going to be very interesting or educational.”

After a spring 2017 pilot to test the Cyber Range platform that involved roughly 250 Virginia Tech and George Mason University students, high schools began using the program materials in the following fall semester.

Since the Cyber Range’s launch, its content has grown to include more nuanced topics, such as web application security. The platform, which initially included three network environments, now sports a menu of roughly two dozen.

Commonwealth Cyber Fusion 2020, Virginia Military Institute

“In the early stages, they were doing things like firewall configuration, password audits, and server hardening,” Raymond said. “Now they’re doing penetration testing and advanced digital forensics exercises. We have a variety of different environments [with] three to four virtual machines in a network, where the student is not only operating on a single host, but in an environment [where they] can do much more advanced exercises.”

Students may, for example, have a network penetration activity where they’re asked to view the contents of a file on a system they’re not supposed to be able to access. Educators can also fashion Capture the Flag events that let students demonstrate their cybersecurity knowledge in a competitive game — something GMU Cybersecurity Engineering Associate Professor Mohamed Gebril, Ph.D., says students in his classes have enjoyed participating in.

“I will assign a challenge — it can be anything. I can give them a file of maybe capturing network packets, and I want to see what type of network verticals were used, or whatever the case may be,” Gebril said. “Whoever gets the answer first captures that particular flag, and they will get an award for that.”

Jennifer Cramer Marden, who teaches IT classes at Loudoun County High School in Leesburg and serves as the Virginia Cyber Range K-12 Advisory Board chair, cites the platform’s customization capabilities and ability to let users work at their own pace as notable benefits.

“I can have one Linux environment, or Windows, or another that’s tailored to what I need,” Marden said. “Students love the Virginia Cyber Range because it’s interactive and allows them to practice what they learn. Many students come into my class not knowing about cybersecurity and leave learning so much and wanting to learn more.”

Expanding the Instruction's Reach

In tandem with the coursework component and online exercises it provides, the Virginia Cyber Range hosts an annual cybersecurity education conference and periodic boot camps to help educators understand the cybersecurity curriculum and how to use the online tool.

 

Technically, the original program resources are only offered to Virginia educators for use in Virginia educational institutions. However, since 2019, Cyber Range resources have been available to schools outside the state through a paid service model. Currently, approximately 120 high schools and colleges in 40 states utilize the platform and associated materials, according to Raymond.

“If you’re a teacher in Iowa trying to teach a cybersecurity class, and you don’t have somebody who brings a ready-made platform, in most cases, you’re left without a hands-on component,” he said. “So, we created the U.S. Cyber Range. We provide access to schools outside Virginia, and they basically reimburse us for costs we incur on their behalf.”

Commonwealth Cyber Fusion 2020, Virginia Military Institute

While the Virginia Cyber Range’s five-year tenure likely hasn’t been a long enough time frame to fully measure the initiative’s influence on the workforce, Raymond says its resources were being used by nearly every community college and university and about half to a third of the high schools in the state as of spring 2021.

The Cyber Range’s purpose, implementation, availability, and widespread use make the program a unique undertaking — which could potentially have a lasting effect on both education and the state’s economy, according to Judith Sams, specialist, business and information technology and related clusters at the Virginia Department of Education.

“The resources and support provided by [the] Cyber Range have made a significant impact, especially on high school cybersecurity courses,” Sams said. “This investment by the Commonwealth has made Virginia a nationally recognized leader in cybersecurity education — and has opened the door to high-skill, high-demand, and high-wage careers for our Virginia students, regardless of where they live and go to school.”