Indiana turns to college students to bolster new cybersecurity effort

To help keep its network secure against a seemingly endless stream of cyberthreats, Indiana is turning to an unlikely source: college students.

Last week, the state unveiled the Indiana Security Operations Center, which brings together several state security analysts and a dozen students from Purdue University who will work to detect and respond to threats to the government’s systems.

“It was a win for Purdue in getting students some early experience in the cyber world, and for us, there’s a lot of noise coming through on the cyber front,” said the state’s new Chief Information Officer Dewand Neely. “All the things we’re looking at and monitoring and we kind of focus on the high level things, but we don’t want to forget about the little things.”

The new center, based in a research park just outside of Purdue’s campus, operates under the state’s broader cybersecurity partnership, known as the Indiana Information Sharing and Analysis Center.

Under the supervision of the state’s analysts, the students will get a chance to do some low-level monitoring of Indiana’s network to take some of the strain off the state’s more senior workers.

“Those lower level tickets for malware, if there’s certain sites that haven’t been vetted yet that users are trying to get to through the Web filter, they’ll be evaluating those and taking a look and checking them off, or if they’re bad, flagging those and sending things back to our staff on the ground to do the proper remediation stuff,” Neely said.

The student workers will be paid as part of Purdue’s “Pathmaker Internship Program,” which places tech-focused students with companies looking for help on short-term projects.

“It gives them real work experience in a real work environment using real commercial tools,” said Purdue CIO Gerry McCartney, who directs the “Pathmaker” program. “This is a line on your resume that you’re going to be proud of … and it’s great for the state because it gets a service it probably couldn’t otherwise.”

McCartney noted that the students will be provided with the “training they need to do the job,” so anyone can join the program. While McCartney acknowledged that the people most interested would likely be students pursuing science, technology, engineering and math degrees, he said similar programs in the past have had success with students studying a range of subjects.

“In fact, we’ve seen good success from students in other disciplines like history and political science that have come in and done well in these kinds of environments,” McCartney said.

Currently, the students and analysts work from 8 a.m. to 5 p.m. during the week, but Neely and McCartney hope to see the center expand its hours quickly.

“Their goal, and certainly our interest here, is that they bring this out to a 24/7 operation for all the agencies and the state because clearly the bad guys aren’t just working 8 to 5,” McCartney said.

To reach that goal, McCartney estimates that the center would need to bring on at least 50 students to cover all the shifts. So long as the students show competence within the next year or so, McCartney expects to hear from the state about making that change.

“The best indicator of happy customers is they come back and they want more,” McCartney said. “For the state to come back and say, ‘This is working out great, we want to get this up to 50 as quickly as possible,’ that would be the best indicator of success to us.”

But Neely added that Indiana would also like to see the students gradually start taking on more advanced projects to help the state reach the “next level of security.”

“If the students working in the center can take a lot of the day-to-day remedial stuff that’s got processes attached to it … that would be a definite win for us,” Neely said.