Scholarship program targets need for cybersecurity skills

As a graduate student in computer science at George Washington University five years ago, Mischel Kwon never expected to become the model for a federal scholarship initiative. But Kwon’s rapid rise through the government ranks to a high-powered position as director of the Homeland Security Department’s U.S. Computer Emergency Readiness Team is one of a growing number of successes arising from a Scholarship for Service program aimed at narrowing a critical need for cybersecurity skills at federal agencies.

“When I graduated from the SFS program, I really thought I was going to do my two years [of government service] and then jump to industry and make big bucks,” Kwon said. “But I was given opportunities through the program that I wouldn’t have had otherwise.”

However, the program, run jointly by the National Science Foundation and DHS, is proving to be more than a source of promising talent. In the information assurance community, SFS is becoming widely recognized as indispensable, especially when government demand for highly skilled information technology security professionals is surging because of Information Systems Management Act requirements, the inexorable growth in security operations centers and an impending wave of retirements.

The government is desperate for cybersecurity pros, said Alan Paller, director of research at the SANS Institute. “We probably have only 1,000 of those people in the whole country, and we need between 10,000 and 30,000 in the next couple of years,” he said.

A glance at the lists of openings for GS-2210 series IT security specialists on the Office of Personnel Management’s USAJobs.gov Web site underscores how acutely the government needs cybersecurity expertise. The list runs more than a half-dozen pages with many agencies posting dozens of openings at multiple work sites.

SFS was designed to increase and strengthen the government’s cadre of cybersecurity professionals. It underwrites two-year stipends for full-time students who specialize in information assurance at approved four-year colleges and universities. In exchange for agreeing to serve at a federal agency in a cybersecurity position for at least two years, the program provides scholarships covering tuition, room and board, and books. Since its inception in 2001, the program has channeled almost 900 students into federal cyber positions.

For Kwon, the SFS program paved the way to a dream career in government. After leaving George Washington with a master’s degree in computer science and a graduate certificate in computer security and information assurance, she became director of wireless security at the Justice Department and later was appointed deputy director for information security at the department. Last year she was named director of US-CERT.

“I’m running a national-level program and influencing national policy,” she said. “That’s the dream of a lifetime.” As head of US-CERT, the operational arm of the National Cyber Security Division at DHS, she manages an agency that is responsible for analyzing cyber threats and vulnerabilities in government networks, disseminating cyber threat warnings and coordinating incident response programs. She also continues to keep a hand in the academic side, serving as a lecturer in information assurance at George Washington.

One of Kwon’s former SFS students, P.J. Kelly, graduated last year from the university’s cybersecurity program and immediately took a job with the Federal Reserve Board of Governors, where he works as an IT analyst.

The program “just opens up so many doors,” Kelly said. A self-described “computer geek since birth,” Kelly took up a rigorous, dual program at George Washington, pursuing a master’s degree in public policy and certification in information assurance under SFS. He reaped the benefits of Kwon’s information assurance lab class, which provided practical experience in computer security.

It’s precisely such technology-savvy employees that the government needs, Kwon said, not “security operations people staring at a screen.”

“We’re looking for technologists who can build better mousetraps,” she said. “We’re looking for analysts who can get to the real crux of the threat, and we’re looking for writers who can articulate our geeking and beeping so that management, Congress and the public can understand what we’re talking about. With that in mind, there’s a huge critical demand for qualified people in the information assurance field.”

Paller calls SFS a “cool” program for helping to fill that demand.

“The government is desperate for strong, technical security talent,” Paller said. “You want kids with passion who’ve done a lot of academic work and understand this stuff.”

SFS presently supports about 250 students on two-year scholarships in competitively selected information-assurance programs at 26 accredited universities and colleges around the nation, said Victor Piotrowski, director of the Scholarship for Service program at NSF. About 80 percent of the students are enrolled in master’s degree programs. The rest are enrolled in bachelor’s degree programs and a handful of scholars are working toward doctoral degrees. About 120 students graduate annually and move into federal jobs at a placement rate of about 97 percent, he said.

The outlook for SFS wasn’t always so propitious. Launched eight years ago under a mandate from Congress, SFS was already facing trouble as its first students began to graduate in 2003: Only about 50 percent of the students were able to find federal jobs. And officials had no choice but to release them from the program’s service requirement.

“You invest millions of dollars in students who are obligated to work for the government for two years, and they cannot find a place to work,” Piotrowski said.

The problem was that agencies didn’t know about the program.

SFS officials realized it wasn’t enough to develop SFS, select universities to host it and graduate superb students. They had to sell it to agencies. “We found we had to work on the other end — the marketing part,” Piotrowski said.

Working with OPM, officials began to communicate with agencies and devise a marketing program that included an annual November briefing for agencies and a job fair, staged every year in January.

“Educating hiring officials across the federal government has been a challenge,” said Brenda Oldfield, director of cyber education and workforce development at DHS, which serves as the marketing wing for SFS. “But we’re making progress.”

Participation in the annual job fair has soared to more than 75 agencies this year from about 29 in 2005, Oldfield said. “We had to turn people away.”

The core message to agencies — that SFS delivers cybersecurity talent on a silver tray — is working, Oldfield said.

“The table turned 180 degrees [since 2003] because we have agencies now that really compete for what we can offer,” Piotrowski said.

Skewed skills

Although the program is thriving, SFS faces other issues and challenges as it matures. Paller, for example, contended that some of the campus programs are producing too many “soft-skilled” security professionals “who can write reports but don’t secure any machines.”

“Some of [the SFS institutions] are putting out extraordinary, great technical people,” he said, citing the University of Tulsa, New Mexico Tech and George Washington as examples. “There are other schools that have gotten the money for these programs but wouldn’t recognize a secure computer if it bit them. So the students that come out [of those schools] can talk about it, but they can’t do it. The country does not need any more soft-skilled security people.”

Piotrowski conceded that “there is some truth” in Paller’s point. “I don’t want to name specific schools, but we have some that are extremely experience-oriented — very hands on. Then you have schools that are very policy-oriented [where] some students never touch the real hardware. The proper [approach] would be to have a mixture, where students are exposed to the applied, practical part but, at the same time, should be able to write a security policy.”

Kwon agreed. “One of the things we need is policy people who are technical,” she said. “I don’t know that we need to choose the either/or. I think we need to cross-pollinate and make technical people better writers and understand policy, and we need to take policy people and inject a little [technical acumen] in them.”

SFS institutions are selected to receive scholarship grants through a competitive process. To compete, each school must be designated by the National Security Agency and DHS as a Center of Academic Excellence in Information Assurance Education. These schools also feed SFS’ sister program, the Defense Department’s Information Assurance Scholarship program, which supplies graduates to DOD agencies.

SFS officials have formed a working group to examine the question of standards for cybersecurity curricula, Piotrowski said. The group will attend an international information assurance convention in Paris this summer to study model curricula and exchange ideas on an ideal body of knowledge information assurance education. Now, standards are derived more from workforce training programs across the government. “We really do not have academic-flavor educational standards for information assurance [in SFS], and our working group hopefully will have some [recommendations] by the end of July,” Piotrowski said.

Another crucial issue is keeping SFS graduates in government after they have completed their required service. Piotrowski said officials conducted a survey of former students currently working for the government and found that about 40 percent weren’t sure if they would stay in federal service after their requirement expired. “That is not the best [result] for the program,” he said.

One strategy to improve post-service retention is to match students with mentors early in their federal service period or during the 10-week internships that are required for graduation. SFS officials are developing a program through OPM to recruit mentors from the Senior Executive Service, Piotrowski said.

Mentoring will help students adjust to an environment that is new to many of them. “A lot of students come from small places, like Oklahoma, it’s their first time on the East Coast, and the government culture is different,” he said. “Mentorship is our experiment to see if there is significant improvement in retention in two years.”

Mentoring will help promote the benefits of government work to students, Oldfield said.

“It will help generate the idea that there is this opportunity to make a difference in the government and that you’re going to have opportunities that you wouldn’t have as an entry-level employee in the private sector,” she said.

Public-sector appeal

You don’t have to convince P.J. Kelly of the advantages of an IT career in government. “The most common draw you hear about in the private sector is higher salaries,” he said. “But in [private industry], you never get to work directly toward the mission of an agency, and you don’t always get to see projects through their cycles and to effect as much change because you’re jumping from project to project, from contract to contract. You have the ability to leverage your education over a longer period of time through government employment.”

SFS officials are also banking on government efforts to streamline the security clearance process on the civilian side to make it easier for agencies to hire and retain students. Unlike the SFS program, the Information Assurance Scholarship Program at DOD pairs students with department agencies at the start of their course of study, which lets those agencies initiate the clearance process right away. “That’s a hiring flexibility that the civilian agencies don’t have,” she said.

The Scholarship for Service program is limited to institutions that grant bachelor’s degrees or higher. But to help meet the need for highly specific security skills, officials are exploring the idea of expanding SFS to community colleges, Piotrowski said. For example, an area where two-year colleges could assist in closing the skills gap is digital crime-scene investigation, he said.

Officials are also beginning to market the program to secondary school students, said Jordana Seigel, director of outreach and awareness at DHS, “so once they get to college, they are already interested in these topics and can better take advantage of these programs.”

Although SFS’ output can meet only a small slice of the demand for IT security specialists in government, it can be counted on to turn out exceptionally talented professionals and future leaders in the field, observers say.

“SFS is a drop in the bucket, but it’s a wonderful drop in the bucket,” Paller said.