UAH cybersecurity leads the way in education, research, outreach and advanced skills to counter critical threats

Situated in the heart of one of the biggest high-tech hubs in the south, The University of Alabama in Huntsville (UAH), a Carnegie R-1 top-tier research university, has a legacy of supporting advanced technology needs in the region and far beyond. In 2013, UAH began to lay the foundation for a world-class cybersecurity program that would command diverse academic and technical resources to provide training, research and outreach to this critical field.

UAH, a part of the University of Alabama System, was originally designated in the discipline by the National Centers of Academic Excellence in Cybersecurity (NCAE-C) in 2007 and has remained continuously designated ever since. When Dr. Tommy Morris, UAH eminent scholar of computer engineering, arrived on campus in 2015, he had a vision for UAH’s burgeoning cybersecurity program. “We already had a presence in the field,” he explains. “In 2014, our master planning included cybersecurity, and the following year the master’s degree was updated. Our national designation required UAH to have a center. I was recruited to join as the director.”

Dr. Morris soon became the founding director of the UAH Center for Cybersecurity Research and Education (CCRE). Following his vision, the CCRE embraced an interdisciplinary approach and built a center with three primary functions; research and development, education and training and workforce development. These areas overlap significantly with UAH students working in all three areas. The Center’s primary research and development expertise is related to defending cyber physical systems; embedded weapon systems; supervisory control and data acquisition (SCADA); networks; data and computer operating systems from adversarial attacks. Today, the UAH CCRE is one of the largest academic cybersecurity centers in the United States.

Officially launched in 2019, UAH’s bachelor’s degree in cybersecurity engineering program was unique in the state of Alabama. UAH undergraduate students prepare for cybersecurity careers in four primary degrees: cybersecurity engineering, computer engineering, computer science and information systems. The master’s of science in cybersecurity degree includes tracks from three different departments, electrical and computer engineering, computer science and information systems, with an additional master’s of science in software engineering and doctoral programs in computer engineering and computer science. By fall 2022, these initiatives had grown to support more than 1,700 students across all disciplines. Over time, the CCRE itself has come to encompass 95 students working for the Center, in addition to 40 full-time staff, accounting for $10,000,000 in research expenditures.

“We have components in engineering, science, business, cyber and an engineering degree through the College of Engineering, as well as computer science,” Dr. Morris notes. “And our information systems degree has a concentration of cyber as well. We hire from all of those degrees. We approach cybersecurity in three different departments because of the diversity of talents in Huntsville. We’re not all engineers. So, we’re listening to the community and providing the workforce they need, and it’s not a single flavor.”

Dr. Letha Etzkorn, chair of the UAH Department of Computer Science, agrees, touting the faculty cybersecurity resources that are available to prospective students in her area. “The department currently has six tenured/tenure track faculty with their primary research and teaching areas in cybersecurity with research areas in digital and mobile forensics, reverse engineering, privacy, cloud security, applications of artificial intelligence, ethical hacking, cryptography, malware analysis, signal processing/radio applications, cyber law and organized cybercrime, secure outsourcing of computation, satellite security and GPS-denied positioning. Two additional faculty offer cybersecurity as a major secondary research area: anomaly-based intrusion detection systems using machine learning.”

In addition to providing educational opportunities, such as camps and scholarships, the CCRE engages in cutting-edge research on a wide variety of cybersecurity topics, including identity management, supply chain security, instruction detection, vulnerability analysis, genomic data security and digital forensics.

“UAH's ECE department is heavily involved in cybersecurity education and research,” says Dr. Aleksandar Milenkovich, professor of electrical and computer engineering. “We offer a new bachelor's degree in Cybersecurity Engineering with 166 current students as of fall 2023. Our graduate program includes a multidisciplinary master's in cybersecurity, with a focus on the computer engineering track. Our faculty member, Dr. Tommy Morris, an eminent scholar of computer engineering, leads UAH's Center for Cybersecurity Research and Education. Within the department, eight faculty members are actively engaged in research in cybersecurity and related areas, such as cyber-physical systems security, cryptography, hardware and software reverse engineering, network security and hardware-oriented security.”

Meeting cybersecurity challenges with innovation, excellence

The CCRE and the UAH College of Business currently hold a designation of National Center of Academic Excellence in Cyber Defense (CAE-CD). The National Center of Academic Excellence in Cyber Research (CAE-R) designation is based upon research completed as part of the Ph.D. in computer engineering and computer science and research completed in the Center. Both designations are managed jointly by the National Security Agency’s (NSA) and the Critical Infrastructure and Cybersecurity Agency (CISA). Only 48 schools in the United States hold both the CAE-CD and CAE-R designations.

Dr. Tommy Morris, eminent scholar of computer engineering and CCRE director.

Michael Mercier | UAH

“The National Center of Academic Excellence in Cyber Defense designation is a symbol of quality that tells students and employers that UAH cybersecurity degrees are mapped to knowledge units based on national standards, that the University implements a continuous improvement process to manage degree programs and that UAH contributes to the cybersecurity community locally and nationally,” Dr. Morris notes.

“The CAE-CD and CAE-R designations make UAH eligible for many grant programs, including the National Science Foundation CyberCorps: Scholarship for Service (SFS) and the Department of Defense Cybersecurity Scholarship Program (DOD CySP). Every year we offer 10-15 scholarships directly tied to this designation.”

Federal partners include CISA, the Federal Bureau of Investigation (FBI), the National Institute of Standards and Technology (NIST)/National Initiative on Cybersecurity Education (NICE), the National Science Foundation (NSF), the Department of Defense Office of the Chief Information Officer (DOD-CIO) and U.S. Cyber Command (USCYBERCOM).

UAH presence spells big advantages for local, national partners

“Over one million cybersecurity jobs are currently being advertised,” Dr. Morris says. “The U.S. Army, FBI and local companies are reaching out for us to help them build internships and workforce pipelines.”

UAH has continued to invest in CCRE research staff and affiliated faculty have continued to win new grants and contracts locally and nationally. One significant investment was $200,000 in research startup funds to attract a team of subject matter experts in malware analysis to support the DOD and the Defense Industrial Base. These experts and others hired since have expanded the CCRE’s customer base to include support for the U.S. Army Combat Capabilities Development Command; the U.S. Army Space and Missile Defense Command (SMDC); The Army Corps of Engineers Engineering Research and Development Center and many other Army commands and Federal agencies through contracts with industry.

“In today's environment, cyber ‘bad actors’ have ratcheted up the attacks on our nation's critical infrastructure,” says Dr. Morris. “CCRE’s expertise and capabilities address these attacks.”

“The Huntsville area has an extreme need of a good cybersecurity workforce, due to our extensive DOD work in the area, as well as NASA work related to propulsion systems,” adds Dr. Etzkorn. “In addition, Huntsville-area companies have need of extensive cybersecurity support to prevent theft of intellectual property. As in most cities with an extensive medical establishment, the various hospitals and doctor's offices in the community also need cybersecurity protection from ransomware attacks and patient information theft. Our graduates also work all over the country. For example, a number of our graduates have gone on to work for the National Security Agency.”

UAH was the first university in the state to offer Hacking for Defense (H4D) cybersecurity classes. The H4D initiative is led by the Invention to Innovation Center (I²C) and the UAH Department of Computer Science. H4D is a program of the National Security Innovation Network and associated with the Common Mission Project, an initiative that supports national security entrepreneurship. H4D students have the opportunity to work on "real-world" problem sets defined by various DOD agencies to provide solutions to respective stakeholders.

“Solving actual security problems facing DOD organizations provides immense exposure to real-world situations for students,” says Dr. Tathagata Mukherjee, a UAH assistant professor of computer science who administrates the program. “For students who are interested in pursuing careers related to defense, many technology companies, large defense contractors and even Department of Defense organizations actively recruit H4D alumni."

To support the military, the UAH CCRE also worked with US Army Cadet Command and SAIC locally to develop the U.S. Army JROTC Cyber Program. “This four-year JROTC program provides cybersecurity education mapped to industry recognized certifications,” Dr. Morris adds. “We have nine schools nationally now and expect to see this program continue to grow.”

Taking care of business every day

The UAH College of Business constructed a state-of-the-art Cybersecurity Lab to emphasize the specialized cybersecurity programs offered by the College to provide students with the knowledge and expertise needed to secure and defend businesses and organizations against cybersecurity threats. “The lab offers our students access to the latest cloud-based cyber technologies, as well as a state-of-the-art learning environment that fosters collaboration and a team approach to problem solving,” explains Dr. Jason Greene, dean of the UAH College of Business.

“In the College of Business, we look at cybersecurity from the enterprise perspective,” reports Dr. D.J. Hovermale, a clinical assistant professor. “We challenge our students to learn about the many subfields of cybersecurity so they have an understanding of how all the parts work together for the security of the whole. In recent years we have revamped our coursework to include a lot of hands-on technical projects. Some of those projects include designing an enterprise network and building a simulated version of it from scratch. Many students have gotten jobs or internships just from completing this project. We also have students analyze cybersecurity breaches to learn how to develop policies and practices that will help prevent similar breaches in the future.”

The business-focused curriculum covers a wide range of technical expertise, including cyber threat intelligence; incident response; evidence collection; risk mitigation and response; organizational recovery and response; fraud and fraud mitigation; governance; and protection of intellectual property.

Through a program funded by the DOD called ACCESS, or Alabama Cybersecurity Coaching, Education and Support Services, the UAH Office for Operational Excellence provides small to medium-sized businesses in Alabama with cybersecurity education and technical assistance to meet DOD cyber requirements to progress toward compliance with DOD cybersecurity regulations. ACCESS is a partnership between the Office for Operational Excellence and the UAH Information Technology and Systems Center to conduct education seminars, workshops and offer direct technical assistance. Partners include the Alabama Small Business Development Center, the APEX Accelerator and the Alabama Technology Network.

“By helping our students become competent professionals, we are making an impact on the labor shortfall in this field,” says Dr. Hovermale. “The end result is that government agencies, defense contractors and private-sector companies here in Huntsville are able to fill critical vacancies on their cybersecurity teams, which helps elevate the overall cybersecurity posture of our community and the nation. In addition, we teach our students how information systems fit into the larger picture of running an organization and how the security of those information systems is critical for smooth business operations.”

UAH cybersecurity impacts Huntsville, the state and beyond

The University actively engages in solutions to challenges facing cybersecurity education. “We have done camps, teacher training and curriculum development every summer since 2015,” Dr. Morris notes. “Now teachers know UAH is the place to go for cybersecurity.”

In fact, UAH created a K-12 education program called RING, which stands for Regions Investing in the Next Generation. “The curriculum was generated through a NSA grant and offers free curriculum, all the training, lab guides, in one package, which has been downloaded hundreds of times by teachers across the nation,” Dr. Morris says. “We also have two teachers on staff to administrate this material online for underserved communities and homeschoolers. This is also a huge program for the NSA.”

Sharon Johnson, a principle research scientist with the CCRE, created a program called the Cyber Force Incubator (CFI), a capability that creates an employment pipeline for students pursuing cybersecurity careers. The CFI is an experiential laboratory that serves to increase high school and university student exposure to cybersecurity, science, technical, engineering and mathematics fields to prepare them to enter the workforce. Upon completion, students are provided an internship with a sponsoring government agency, contractor or industry partner.

The Center was recently chosen to receive the FBI J. Edgar Hoover Memorial Scholarship by the Huntsville Chapter of the Society of Former Special Agents of the FBI. The scholarship was presented to eight UAH students and CCRE employees to support certification training, testing vouchers and training books.

Additionally, UAH hosts Tech Trek every year, an event designed to raise awareness and interest in STEM fields for rising eighth grade girls nominated by their teachers from across Alabama. The core experiences in this year’s camp included cybersecurity.

The CCRE recently supported AEOP, the Army Educational Outreach Program, as well, to provide historically underrepresented students hands-on experience as participants visited the Center to learn about cybersecurity directly under the guidance of a professional scientist.

UAH hosts GenCyber camps for deaf and hard of hearing students, as well as a camp for blind, visually impaired students, both funded by the National Security Agency, Microsoft and the Alabama Institute for Deaf and Blind’s Regional National Technological Institute for the Deaf STEM Center. “Students learn about online safety, cybersecurity careers, cryptography and more,” says Jesse Hairston, CCRE assistant director. “We partner with the Rochester Institute of Technology’s National Technical Institute for the Deaf Regional STEM Center and the Alabama Institute for Deaf and Blind to bring in students from across the country. Our partnership with the FBI gives our campers experience with real-world tools as they learn about cybersecurity careers.” UAH has been hosting these camps since 2017.

The CCRE has also held a GenCyber virtual training camp for more than 50 teachers. The Center used these experiences to develop a nationwide, high school-level cybersecurity curriculum for students who are deaf through a grant provided by the National Technical Institute for the Deaf Regional STEM Center.

In addition, the Center has teamed with the U.S. Army Space and Missile Defense Command to develop a cybersecurity workforce from students in underserved areas of academia, called the SMDC Underserved Community Cybersecurity and Engineering Education Development (SUCCEED) program. The program demonstrates UAH’s commitment to creating opportunities for students to learn, gain experience and network within the Department of Defense community.

"SUCCEED helps the SMDC develop a robust and qualified pipeline of technical students into industry,” says Dr. Morris, “while simultaneously reaching into diverse and underserved areas to accomplish these goals, enacting partnerships that will leverage the talent of students attending Historically Black Colleges and Universities and underserved high school communities throughout the state.”

The CCRE administers the CyberCorps^Ⓡ Scholarship for Service (SFS) program to offer cybersecurity scholarships funded by the National Science Foundation. These scholarships pay for tuition, health insurance, books and professional development travel, as well as a stipend each academic year totaling $22,500 for undergraduates or $34,000 for graduates. As of 2022 data, it’s the sixth largest program of its kind in the U.S.

Building experience with outreach to meet future needs, aspirations

The CCRE has been dedicated to bringing cybersecurity to a younger audience. Sharon Johnson coordinates a CCRE program that gives high school students in rural Alabama who have little to no exposure to STEM the opportunity to gain insight into cybersecurity. With an eye to bolstering future workforce opportunities, the research scientist and the CCRE have also provided training to enable Girl Scouts to earn Cybersecurity 2: Safeguards and Cybersecurity 3: Investigator badges.

UAH is contracted with the Niswonger Foundation in Tennessee to train teachers in cybersecurity education as part of an $8.8 million grant from the U.S. Department of Education with matching funds. The grant serves 126 mostly rural schools in 21 school districts in grades 6-12 in northeast Tennessee. These experiential opportunities train educators on how to implement cybersecurity knowledge into their classrooms, another step in the evolution of CCRE’s support for the field, from cyber camps into school curriculum and teacher training.

“We are making an impact with middle schools and high schools by going to their clubs and mentoring their CyberPatriot teams and holding our own events, such as Charger Cyber Conference, to foster interest in cybersecurity by providing a venue for hands-on experience and connecting with others who have the same interests,” reports Dr. Hovermale. “Cybersecurity careers often come with great salaries, which help break the cycle of poverty that many in the region are caught in. Those students who graduate and find employment are coming back to UAH to provide mentoring, which helps inspire the next generation to succeed.”