Members of the Center for Cybersecurity Research and Education in the SCADA Laboratory in UAH’s Engineering Building. Standing, from left: Rishabh Das, Sharon Johnson, Jesse Hairston and Kim Galkowski. Seated: SueAnne Griffith, Thiago Alves and Director Dr. Tommy Morris.
Michael Mercier | UAH
Work being done in cyber physical systems at The University of Alabama in Huntsville (UAH) Center for Cybersecurity Research and Education (CCRE) is grabbing attention in the broader cyber world.
Part of CCRE’s mission is to research and develop cutting-edge protections for cyber physical systems that are lower-level computing workhorses found in industrial systems, civil infrastructure, medical devices and anywhere a computer interacts to monitor and control objects in the physical world. Cyber physical systems do many of the more mundane tasks involved in keeping our lights on, our water clean, our cars running and, for some, our medicine pumping or hearts beating.
Another part of CCRE’s mission is to educate and develop the growing workforce needed to create, maintain and improve these systems.
In cyber physical systems, the center focuses particularly on supervisory control and data acquisition (SCADA) systems. These systems are the backbones that run operations in everything from power plants to hospital elevators to hydroelectric dams. These systems are critical to a functioning society and are often overlooked and therefore can be vulnerable to attacks from hackers.
That’s how at the end of 2015, for example, hackers broke in to SCADA systems at electric utilities in the Ukraine and turned off power serving 250,000 utility customers. And in early 2016, the U.S. Justice Department filed charges against seven hackers who hacked the SCADA system managing a flood control dam in Rye, N.Y. Luckily there was no water behind the sluice gate at the time of the attack.
Against that backdrop, CCRE’s efforts to improve cyber physical system protections and to find ways to bring security measures into the very beginning of the design and manufacturing processes, rather than to add them later, have attracted great notice. The center is expanding rapidly since Dr. Tommy Morris became its founding director in August 2015.
An associate professor in the Department of Electrical and Computer Engineering, Dr. Morris came to UAH after seven years at Mississippi State University, where he was director of the Critical Infrastructure Protection Center and associate director of the Center for Computer Security Research, among other posts, and worked with some organizations on Redstone Arsenal.
Now he finds his efforts accelerating in a more cybersecurity conscious world.
"We've had a tremendous amount of success with grants and contracts," Dr. Morris says. In February 2017 alone, the center won a $198,000 grant from the National Security Agency and was notified it is on track to receive a $243,000 grant from the U.S. Army Engineer Research and Development Center in Vicksburg, Miss. Both grants pertain to the center's SCADA cyber physical systems research, and Dr. Morris expects CCRE staff will increase again with the new work.
The staff has already grown to include two research scientists and a staff assistant specific to the center, which also involves UAH faculty across computer science, information systems and engineering disciplines in its research and programs.
"The largest portion of our research is in SCADA," Dr. Morris says. Working with the CCRE, UAH faculty research the development of secure architectures for cloud computing and for systems embedded into a product in order to make security integral to the device itself.
The center collaborates with the U.S. Army's Aviation and Missile Research, Development and Engineering Center (AMRDEC) on Redstone Arsenal, as well as the National Science Foundation (NSF) and others. One NSF-funded project is to develop virtual SCADA systems, a full SCADA system simulation running on a computer from which researchers and students can safely mount cyber-attacks and test defenses.
That project also touches on CCRE’s role in developing the cyber physical systems security workforce. The virtual SCADA systems will be used to provide hands-on cybersecurity education to students in four different engineering disciplines – civil, chemical, electrical and mechanical.
"We wanted to find a way students could continue learning their discipline, but at the same time be exposed to cybersecurity issues and training," Dr. Morris says. "These virtual SCADA systems are relevant to their degree. For example, we're creating a distillation tower like you would find at a refinery for chemical engineering, a mass damper used to steady tall buildings for civil engineering, a robotic arm like those on factory floors for mechanical engineering and an electric generator for electrical engineering students."
Important components of the education and training function are the NSF CyberCorps Scholarships for Service (SFS) program and the U.S. Army Reserve's Private Public Partnership Initiative, or P3I, program.
A National Center of Academic Excellence in Information Assurance Education, a National Center of Academic Excellence in Cyber Defense and a National Center of Academic Excellence in Cyber Defense Research, UAH is in the fourth year of its five-year, $4.2 million NSF CyberCorps SFS program.
In the program, full-time scholarship students studying cybersecurity are provided full tuition, fees, books and a salary. In return, after graduation they work for the government one year for every year of scholarship.
"We have 23 students on NSF scholarships at the moment, and will award about 10 more this year," he says. "It’s a really great program."
The CCRE is one of the largest P3I program participants in the country, with 22 reservist students who have scholarships to pursue cybersecurity degrees.
"The Army is trying to build a cadre of cyber-trained reservists," Dr. Morris says, "and we're helping do that for them."
Grants are also helping the center recruit new students to UAH, such as summer cybersecurity camps that have been held for eighth, ninth and 10th graders and teachers. The camps are funded by the joint NSA/NSF GenCyber program, which is allowing CCRE to offer a unique camp this year.
"We are partnering with the Alabama School for the Deaf and the Rochester Institute of Technology's National Technical Institute for the Deaf to offer a GenCyber camp for about 20 deaf or hard of hearing high school students in July, here on campus," Dr. Morris says.
The university’s genuine commitment to cybersecurity has been key to the growth of the CCRE, he says.
"I've been enthused by the support from the faculty, staff, administration – everyone is on board," says Dr. Morris, "and that makes it fun and easier to be successful."
For Dr. Morris, the best is still on the horizon, as he leads a committee charged with establishing a bachelor of science degree program in cybersecurity and hopes it can be offered to students as soon as the fall of this year.
"The thing that excites me most is creating a bachelor of science in cybersecurity," Dr. Morris says. "It's going to have an impact for a long, long time."