Sharing Resources to Improve Cyberspace

Luiz DaSilva is executive director of the Commonwealth Cyber Initiative (CCI) and Bradley Professor in Cybersecurity at Virginia Tech. Before coming to Virginia, he served as the director of CONNECT, a telecommunications research center at Trinity College Dublin. VEDP President and CEO Stephen Moret spoke with DaSilva about the collaborative research taking place at CCI's member institutions and how that collaboration is positioning Virginia to set the course for the future of the internet.

Stephen Moret: As you know, the cybersecurity sector is one of the biggest and fastest growing sectors in the Commonwealth of Virginia. And one of the most exciting things that’s been happening over the last few years is the development of the Commonwealth Cyber Initiative. Can you share the mission of CCI, its vision, and its structure?

Luiz DaSilva: The vision of CCI is to establish Virginia as a center of excellence globally in cybersecurity and, in doing that, contribute to the economic development and diversification of our economy. We have three mission lines — research, workforce development, and innovation — and they’re all very much connected to each other. Without research, you don’t get innovation out of the universities and colleges that comprise CCI.

 

Workforce development is very tied in to education. We have these complementary mission lines at the intersection of cybersecurity, autonomy, and intelligence. Virginia has had the foresight to invest in this area in cybersecurity and to bring together 40 colleges and universities throughout Virginia. The combination of about 300 researchers across these 40 colleges and universities is what we call CCI.

There is a hub that coordinates a lot of the programs in CCI in their overall strategy. That hub is hosted by Virginia Tech in Arlington, and that’s where I sit. Then we have four regional nodes for CCI, each hosted by a different university. In Northern Virginia, the node is hosted by George Mason University, in Central Virginia by Virginia Commonwealth University (VCU), in Coastal Virginia by Old Dominion University (ODU), and in Southwest Virginia by Virginia Tech. Combined, the directors of these four nodes, plus myself and the managing director for CCI, form what we call the leadership council. We set strategy and run the programs of CCI.

Moret: When you think about the overall cybersecurity sector in Virginia, which is obviously a big, diverse, rapidly growing public sector, private sector — many different domains of work — how does CCI fit into that overall cyber ecosystem in the Commonwealth?

DaSilva: We have the largest cyber workforce in the eastern part of the U.S. and growing. And you have tens of thousands of job openings in cybersecurity — around 50,000 is the estimate that you usually see. A big part of our mission is contributing to forming professionals who are qualified and can take on all of these functions in Virginia and help the economy grow.

 

The other way that we fit into the general ecosystem is by bringing together these researchers from across the different universities and colleges. Virginia has a very strong university system. We have three of the top 30 public universities in the country. And it’s particularly powerful if we can bring people from across the universities to work together. The secret sauce for CCI is the ability to build these teams from across the state and not worry whether they’re Mason, UVA, or Virginia Tech. We bring together the researchers needed to do the job.

By doing that, we’re much more competitive for very large projects. We often partner with local and state agencies on initiatives. Right now, we’re partnering with Arlington County on a smart communities pilot the county is deploying. We make sure that all we do is complementary to other programs which already exist in Virginia.

Moret: As I think about the field of cybersecurity, it’s grown beyond just the internet. We’re seeing now, for example, the IoT, or the internet of things, is really exploding, creating a lot more capability, but also a lot more risk. How has IoT changed the importance of securing our connected devices? And I think more broadly as we look toward autonomous vehicles, are the stakes higher there? How are things going to be different or important relative to cyber and autonomy?

DaSilva: It’s certainly true that the adoption of IoT in various sectors increases the threat surface. There are new vulnerabilities as well as new opportunities, of course, which appear once we integrate IoT into various industries. For example, you mentioned autonomous vehicles. One can imagine that an attack on an autonomous vehicle can have extremely serious safety implications.

There are concerns regarding ransomware. Ransomware is very much top of mind at the moment because of recent large attacks on oil pipelines, as well as hospital systems, and so on. You can imagine ransomware attacks expanding toward smart homes or IoT in general. The other issue with IoT is privacy. As you have more and more devices collecting information about the way we live, how we move around, this information needs to be secured for privacy reasons.

IoT and autonomous systems being powered by and connected to the network is one of our areas of focus. We’re looking at how to better manage IoT devices — how to put them behind a virtual LAN, for example, to improve security and isolate the IoT devices, which are often less secure from the corporate network.

Moret: Shortly after I think you arrived back in Virginia last year, you wrote a piece in the Richmond Times-Dispatch. You talked about how the COVID-19 pandemic might have accelerated the adoption of autonomous systems technology by a decade or more. That resonated with us because, as we’ve looked at all these economic effects of the pandemic, we think the single most powerful change is a dramatic acceleration in the digitization of business. A year later, how do you think that’s come to pass?

DaSilva: It’s already clear that some technologies are accelerating because there’s this broad awareness that it’s possible to do things differently from the way we did them a year and a half ago. That, by itself, is also forcing some technologies to evolve faster.

My area of expertise is wireless networks. We’re very much involved in some research regarding 5G and what’s being called 6G, the sixth generation of mobile networks. One of the drivers, in terms of application, is really a better way for us to interact with each other and to work remotely. We believe that in the future, work is going to be increasingly hybrid, with some on-site and some remote aspects. But we need the tools to also evolve, and the network to evolve, to enable this interaction between people in a more natural way. People are starting to talk about teleportation through augmented reality, for example — a real sense of presence, even though we’re in different cities, but with an increased sense that we’re in the same room.

There’s also the other side of the coin, which is that the pandemic exposed how inequalities can increase due to unequal access to network and communication infrastructure, which allows some people to be more effective than others in remote work and education, and so on. I think it’s quite clear that the communication infrastructure and the need to secure it is part of our critical infrastructure for the country — that is, to deal with some of the economic inequalities we see. We also need to work at access to these technologies that are going to be increasingly adopted for everything in our lives, from work to play.

Moret: How can universities like Virginia Tech and others, and initiatives like CCI, help develop the talent needed to meet cybersecurity industry needs of the future?

DaSilva: We already have some unique cybersecurity programs throughout Virginia. Mason has a Department of Cybersecurity Engineering, which is quite unique. ODU started the School of Cybersecurity. There’s a host of degree programs, from certificates all the way to Ph.D., focusing on cybersecurity. So, we start from a strong base. One thing CCI adds to that mix is experiential learning — opportunities for students to actually have hands-on experiences that complement what they see as part of their degree program.

The demand is there. Students really value those opportunities, and it’s something that we can bring to the table. But then the other aspect of developing talent, I think, is recognizing that the talent won’t just come from traditional cybersecurity programs in computer science or computer engineering or electrical engineering.

We need to broaden the scope of what we think of as cybersecurity to other disciplines. Because many times the competency that’s needed requires knowledge of the domain, and not just knowledge of cybersecurity. We’re working with researchers at William & Mary in the law school, for example, looking at cybercrime and some of the legal implications of cybersecurity. We’re working with political scientists, looking at the role of cybersecurity in the spread of disinformation and misinformation.

We’re working with operations researchers who are studying and modeling ransomware attacks on hospital systems and other critical systems in society. I think having this holistic view of what cybersecurity is and being inclusive of other disciplines is also very important if we are to expand the workforce to fill all this demand for professionals.

Moret: Could you elaborate on the importance of those partnerships between or among universities, not unlike CCI but even beyond that, relative to cybersecurity research?

DaSilva: This is important even at the national level. I think we do a better job of bringing together experts from throughout the country and working together on this. What we’re seeing already in CCI is some large-scale projects we wouldn’t be able to engage in if it weren’t for this ability to work across universities.

Recently, we were awarded a project to work with the Marine Corps Logistics Base in Albany, Ga., on the development of a pilot for a smart warehouse. It’s a very large $13 million project. And it involves researchers from five CCI universities — Mason, VCU, UVA, ODU, and Virginia Tech. That’s a great example of something that’s enabled by CCI and this collaboration, and which wouldn’t have happened without CCI. It touches on a lot of key technologies that I think are going to be important for cybersecurity.

Moret: Which research projects are you most excited about? In particular, which do you think have the greatest relevance or potential for impact relative to the near-term future of cybersecurity?

DaSilva: The one I just mentioned that we’re doing for the Marine Corps. It’s a pilot project that touches on a lot of important and interesting technical questions in cybersecurity. How do you deal with positioning, especially indoor positioning? How do you integrate autonomous systems and what are sometimes called cyber-physical systems in a secure way? I think they position us well to look into a lot of issues currently being examined, as well as have impact on the vision for 6G, the sixth generation of mobile networks.

In CCI, we have invested in research infrastructure that’s aligned with artificial intelligence and also with next-generation communication systems. I think that project will actually contribute a lot to the understanding of how the next generation of communication systems is going to enable new things — in this case, a smart warehouse.

We have invested in a number of pilot projects. These are small projects that essentially build capacity in Virginia for us so we can then go after some larger-scale projects. I would single out an investment we’re making in how cybersecurity can be used to limit the spread of disinformation and misinformation. This is a highly multidisciplinary project. There are experts from the technical side of cybersecurity — computer science, computer engineering, electrical engineering, math — but also from political science and communication and the library system. Together, they’re looking into how artificial intelligence can be used to detect the deliberate spread of misinformation and disinformation, which I think is a big concern for the country and the world.

Moret: I’m very excited and bullish about the work you’re doing, that CCI is doing, and that each of the participating institutions are doing in Virginia. It’s exciting on multiple fronts. You touched on them, but research, workforce development, innovation, we’re already seeing a lot of impact coming out of CCI. But to end on a personal note, what are your favorite places to visit in the Commonwealth of Virginia?

DaSilva: There’s one particular trip that became very memorable to me. A couple of years ago, I went to Shenandoah National Park. I took a few of my graduate students for a few days of hiking. It was just beautiful. I had never been, even though I had lived in the area for a number of years. On one of those very long hikes, we didn’t see anyone for hours.

In the middle of the trail, there was a black bear. It was momentarily scary, but memorable as well. To this day, I tell my students I saved them from a bear, which may not be completely true, because I think the bear just saw us and ran away. It wasn’t really interested. But it’s a story I keep repeating to new generations of students.

Moret: Luiz, thank you so much again for joining us. We look forward to following your progress, as well as that of all the higher education institutions participating in the Commonwealth Cyber Initiative. We’re particularly excited about what’s coming in terms of the research, the workforce development impacts, and the innovation that’s going to come out of this effort.

DaSilva: Thank you very much.