Written by Richard Forno, principal lecturer in computer science and electrical engineering, UMBC

Editor’s note: This article contains plot spoilers.

Society’s understanding of technology and cybersecurity often is based on simple stereotypes and sensational portrayals in the entertainment media. I’ve written about how certain scenarios are entertaining but misleading. Think of black-clad teenage hackers prowling megacities challenging corporate villains. Or think of counterintelligence specialists repositioning a satellite from the back of a surveillance van via a phone call.

But sometimes Hollywood gets it right by depicting reality in ways that both entertain and educate. And that’s important, because whether it’s a large company, government or your personal information, we all share many of the same cybersecurity threats and vulnerabilities. As a former cybersecurity industry practitioner and current cybersecurity researcher, I believe the final season of “Star Trek: Picard” is the latest example of entertainment media providing useful lessons about cybersecurity and the nature of the modern world.

So how does “Star Trek: Picard” relate to cybersecurity?

The nature of the threat

The show’s protagonist is Jean-Luc Picard, a retired Starfleet admiral who commanded the starship Enterprise-D in a previous series. Starfleet is the military wing of the United Federation of Planets, of which Earth is a member. In Season 3, the final season, Picard’s ultimate enemy, the Borg, returns to try conquering humanity again. The Borg is a cybernetic collective of half-human, half-machine “drones” led by a cyborg queen.

The Borg has partnered with other villains and worked for over a decade to deploy hidden agents able to compromise the DNA data contained in the software underpinning the transporter – a teleportation device used regularly by Starfleet personnel. Over many years, a certain subgroup of Starfleet personnel had their DNA altered by using the transporter.

Thus, in launching their final attack, the Borg is able to instantly activate thousands of “drones” to do its bidding in the form of altered, compromised Starfleet personnel. As Geordi La Forge, the Enterprise-D’s engineer, notes, “They’ve been assimilating the entire fleet this whole time, without anyone ever knowing it.”

The Borg’s prolonged, stealthy infiltration of the federation is indicative of how today’s most effective cyberattackers work. While it’s relatively easy to detect when hackers attempt to breach a system from the outside, experts worry about the effects of an enemy infiltrating critical systems from within. Attackers can put malicious code in software during manufacturing or in software updates, both of which are avenues of attack that do not arouse suspicion until the compromised systems are activated or targeted.

This underscores the importance of ensuring the security and integrity of digital supply chains from product development at the vendor through product deployment at client sites to ensure no silent “drones,” such as malware, are waiting to be activated by an adversary.

Equally important, “Star Trek: Picard” presents the very real and insidious nature of the insider threat faced by today’s organizations. While not infected with a cybernetic virus, recently arrested Massachusetts Air National Guard airman Jack Teixeira shows the damage that can occur when a trusted employee has malicious intent or becomes co-opted and inflicts significant damage on an employer.

In some cases, these compromised or malicious individuals can remain undiscovered for years. And some global adversaries of the U.S., such as China and Russia, are known for taking a long-term perspective when it comes to planning and conducting espionage activities – or cyberattacks.

Humans remain the weakest link

“Synchronistic technology that allows every ship in Starfleet to operate as one. An impenetrable armada. Unity and defense. The ultimate safeguard.”

With these words, humanity’s military defenders activated a feature that linked every Starfleet vessel together under one unified automated command system. While intended to serve as an emergency capability, this system – called Fleet Formation – was quickly hijacked by the Borg as part of its attack on Earth. In essence, Starfleet created a Borg-like defense system that the Borg itself used to attack the federation.

Here, the most well-intentioned plans for security were thwarted by enemies who used humanity’s own technologies against them. In the real world, capabilities such as on-demand real-time software updates, ChatGPT and centrally administered systems sound enticing and offer conveniences, cost savings or new capabilities. However, the lesson here is that organizations should not put them into widespread use without carefully considering as many of the potential risks or vulnerabilities as practical.

But even then, technology alone can’t protect humans from ourselves – after all, it’s people who develop, design, select, administer and use technology, which means human flaws are present in these systems, too. Such failings frequently lead to a stream of high-profile cybersecurity incidents.

Resiliency is not futile

To counter the Borg’s final assault on Earth, Picard’s crew borrows its old starship, Enterprise-D, from a fleet museum. The rationale is that its ship is the only major combat vessel not connected to the Borg collective via Starfleet’s compromised Fleet Formation protocol and therefore is able to operate independently during the crisis. As La Forge notes, “Something older, analog. Offline from the others.”

From a cybersecurity perspective, ensuring the availability of information resources is one of the industry’s guiding principles. Here, the Enterprise-D represents defenders in response to a cyber incident using assets that are outside of an adversary’s reach. Perhaps more important, the vessel symbolizes the need to think carefully before embracing a completely networked computing environment or relying on any single company or provider of services and connectivity for daily operations.

From natural disasters to cyberattack, what’s your plan if your IT environment becomes corrupted or inaccessible? Can your organization stay operational and still provide necessary services? For critical public messaging, do governments and corporations have their own uncorruptible Enterprise-D capabilities to fall back on, such as the fediverse, the decentralized microblogging platform that is immune to the impulsive manipulations of Twitter’s ownership?

Prepare for the unknown

The “Star Trek” universe explores the unknown in both the universe and contemporary society. How the crews deal with these experiences relies on their training, the appreciation of broad perspectives and ability to devise innovative solutions to the crisis of the week. Often, such solutions are derived from characters’ interests in music, painting, archaeology, history, sports and other nontechnical areas of study, recreation or expertise.

Similarly, as modern digital defenders, to successfully confront our own cyber unknowns we need a broad appreciation of things beyond just cybersecurity and technology. It’s one thing to understand at a technical level how a cyberattack occurs and how to respond. But it’s another thing to understand the broader, perhaps more systemic, nuanced, organizational or international factors that may be causes or solutions, too.

Lessons from literature, history, psychology, philosophy, law, management and other nontechnical disciplines can inform how organizations plan for and respond to cybersecurity challenges of all types. Balancing solid technical knowledge with foundations in the liberal arts and humanities allows people to adapt comfortably to constantly evolving technologies and shifting threats.

Dystopic metaphors in fiction often reflect current social concerns, and the “Star Trek” universe is no different. Although rooted in a science fiction fantasy, “Star Trek: Picard” provides some accurate, practical and understandable cybersecurity reminders for today.

Season 3, in particular, offers viewers both entertainment and education – indeed, the best of both worlds.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 250 UMBC articles available in The Conversation.

Kayla Tomas

Degrees: B.S., Information Systems
Hometown: Silver Spring, MD
Post-grad plans: Cybersecurity Consultant for KPMG

Kayla Tomas cites UMBC’s Center for Women in Technology (CWIT) Scholars Program for empowering her and giving her a sense of community, especially as a Latina woman in STEM. In CWIT Scholars, a merit-based scholarship for talented undergraduates in computing and other technical fields, she developed friendships, found mentorship, and was able to create a close network of colleagues.

A star athlete, Tomas played on the women’s Division 1 volleyball team all four years of her time at UMBC, and helped guide the team to championships in three consecutive years. She participated as a member of the Hispanic Latino Student Union, and started her own Latin dance team. As a Grit Guide, she gave more than 50 tours of campus.

UMBC’s alumni community has celebrated and supported Tomas through one of the university’s coveted Alumni Endowed Scholarships, awarded to six students each year through support from UMBC’s Alumni Association.

Has there been a mentor or fellow student who influenced your time at UMBC?

“Gina Ralston, a coordinator in admissions and orientation, was a staff mentor who influenced my time at UMBC. She continuously reassured me of how much of a positive impact I have. Gina was my boss when I worked as a Grit Guide. She made me feel appreciated and seen. I loved this job because I got to share my knowledge with younger students who are new to this process, maybe even women looking to be in STEM.”

What has been the best part of your UMBC experience?

“The best part of my UMBC experience would have to be winning the America East title in volleyball three years in a row. So much hard work, time, and dedication went into training, and it truly paid off. The friendships I made, the breakthroughs I experienced, and the challenges I faced, made me into a stronger individual and this couldn’t have happened without an amazing group of teammates. It has always been a dream of mine to play collegiate volleyball at the highest level and I achieved that. Seeing my family at every home and away game always put a smile on my face. They are my rock and have been through the highs and lows with me.”

More than 40 active UMBC researchers are listed among the top 2% of the world’s most-cited scientists and engineers in an analysis recently published by Elsevier.  

These researchers include faculty across all three of UMBC’s academic colleges as well as UMBC’s NASA-funded centers, such as the Goddard Earth Sciences Technology and Research (GESTAR II) Center. Their work covers an incredibly diverse array of topics. Represented academic departments include:

“We perform research to further our understanding of how the various aspects of our world function,” says Karl V. Steiner, vice president for research and creative achievement. “One of the highest recognitions in the scientific community is when other members of this community cite our work.”

He notes, “The Elsevier analysis shows that our researchers are truly impacting the scientific community in a significant way.”

History of citation honors

The list includes faculty researchers who have also received other “highly cited” researcher accolades. In 2022, Erle Ellis, professor of geography and environmental systems (GES), was featured on Clarivate’s Highly Cited Researchers list, which includes papers ranked in the top 1% of citations within Clarivate’s Web of Science database. About 0.1% of the world’s researchers have received this distinction. Ellis is known for his transformational work on human-managed ecosystems, with his research described as top discovery of 2021 by the Smithsonian National Museum of Natural History.

Lorraine Remer, research professor for the Joint Center for Earth Systems Technology, who is affiliated with both GES and physics, is frequently honored for her geophysics publications. She received the 2019 UMBC Research Faculty Excellence Award following her recognition as one of “The Most Influential Scientific Minds” on the Thomson Reuters highly cited researchers list.

Anupam Joshi, director of UMBC’s Center for Cybersecurity and professor and chair of computer science and electrical engineering, was also included on Elsevier’s highly-cited list. His career trajectory demonstrates how UMBC faculty balance high-impact research with other forms of leadership. He has published more than 275 papers, has been granted nine patents, and has obtained research support from a variety of federal and industrial sources. At the same time, he is now serving as a 2022–23 American Council on Education (ACE) Fellow, an intensive program focused on agility and innovative problem solving among higher education leaders. 

Measuring impact

This latest most-cited researchers list is based on data annually compiled from author profiles in Elsevier’s abstract and citation database, Scopus. 

Elsevier’s 2022 database of standardized citation indicators classifies researchers into 22 fields and 174 subfields. Those with a composite indicator (c-score) within the top 2% of each subfield are included in the most-cited list. The list’s authors indicate that c-score is used because it “focuses on impact (citations) rather than productivity (number of publications)” and because it includes granular information on authorship, including co-authorship and author position (e.g., single, first, or last author). 

UMBC researchers designed the Cybersecurity for Manufacturing Operational Technology (CyMOT) program to help manufacturing professionals grow their cybersecurity skills, protecting the sector from cyber threats and increasing their career opportunities. Now, the program has received significant additional funding to expand its impact.

The CyMOT program—launched in 2020 in collaboration with the Chicago-based MxD (Manufacturing x Digital) and UMBC Training Centers—has been renewed with a $1.2 million grant from the U.S. Department of Defense’s Office of Local Defense Community Cooperation (OLDCC). The funding will support the implementation of new training curricula around machine learning and cybersecurity. 

“In recent years, there has been a large number of cyber attacks on the manufacturing sector,” says Nilanjan Banerjee, professor of computer science and electrical engineering and the grant’s principal investigator. To address this rising concern, Banerjee explains, CyMOT aims to “make sure that people that are in the manufacturing business can get trained and upskilled in cybersecurity concepts around manufacturing.”

Expanding the curriculum

The first initiative of the multi-phased project included developing a cybersecurity curriculum tailored for people who already worked in the manufacturing industry, building on their existing expertise. It provided training for a manufacturing cyber systems operator role and offered content through an online training platform. 

The first cohort included 25 manufacturing professionals. In summer 2022, the program expanded when community college students in Chicago were invited to participate in a modified version of the course.

With this recent 12-month contract renewal, the next phase of the project will include courses for two more senior roles: a manufacturing artificial intelligence/machine learning engineer and an advanced manufacturing cybersecurity operator. This phase is slated to begin in February 2023. The additional funding will cover the cost for up to 150 new students interested in the programs. 

Creating an operational technology cyber range at UMBC

As this program continues to grow, Banerjee also has a related objective in mind: building an operational technology (OT) cyber range at UMBC focused on cybersecurity in manufacturing. 

“We will have equipment on campus with software to run exercises for small and medium manufacturing businesses in Maryland and students at UMBC,” Banerjee explains. “The cyber range will include red team-blue team exercises, as well as exercises to learn about cyber attacks on a company’s infrastructure. We will also conduct exercises around attacks at the interface between information technology networks and operational technology networks.”

With the cyber range, manufacturing professionals in the state can learn how to detect and mitigate cyberattacks through hands-on exercises using similar equipment found in a manufacturing OT environment.

The cyber range will be a unique resource for training and research in Maryland. It will also tie to several cybersecurity programs offered by UMBC and an apprenticeship program offered through the Maryland Extension Partnership (MEP). With emphasis on digitizing the manufacturing sector in Maryland at a time of continually increasing interconnectivity and automation (known as Industry 4.0), the cyber range will act as the testbed to train manufacturers across the state.  

Workforce development in Maryland

Donna Ruginski, UMBC’s executive director of cybersecurity initiatives and a co-PI of CyMOT, shares that the project has the potential to expand Maryland’s workforce development in a significant way, whether through curriculum development and delivery or an OT cyber range. 

“As the manufacturing industry implements digital transformation to Industry 4.0, cybersecurity training resources have become more important,” says Ruginski. “There is a shortage of people who can do cyber-related jobs. CyMOT is an avenue to up-skill and train a talent base positioned to fill those gaps in the workforce.” 

After getting its start with implementation in Chicago, CyMOT has attracted the attention of Maryland state agencies, such as the Department of Commerce, and has been recognized by leaders in manufacturing, such as the Regional Manufacturing Institute of Maryland (RMI). UMBC was named as one of RMI’s Champions of Maryland Manufacturing at its 2022 Maryland Manufacturing Celebration, held earlier this fall. 

On behalf of UMBC, Banerjee and Ruginski accepted an executive citation in recognition of CyMOT’s contributions to Maryland’s manufacturing industry.

“It is a great honor to be awarded an RMI Champions award,” says Banerjee. “The work around cybersecurity training and research performed at UMBC is having a true impact on growing the workforce and digitizing the regional manufacturing ecosystem, and the award is testimony to that fact.”

Francisco Cartagena describes his academic journey as unorthodox. Now an employee for the City of Gaithersburg, Cartagena started his educational path as an undocumented student. While charting numerous challenges, Cartagena ’19, political science, M.P.S. ’22, cybersecurity, also found ample opportunities for growth along the way, becoming an effective leader of social change at UMBC at The Universities at Shady Grove.

Cartagena arrived with his family from El Salvador as a preteen. In 2009, he graduated from high school and set out to Montgomery College to pursue his associate’s degree in general studies—a goal that would take him a decade to accomplish because of his legal status. There, Cartagena joined the college’s Latino Student Union and together they advocated for the Maryland Dream Act—a statute that would allow undocumented high school students to pay for in-state college tuition.

“That experience really exposed me to the political science environment and how policy, with momentum, people, and activism, can actually be changed,” says Cartagena, who hopes eventually to leverage his role in local government to share the message that there are many attainable pathways to and through higher education.

Finding his momentum

Prior to the Maryland Dream Act’s passing in 2012, Cartagena was paying the international student rate for community college classes. To him, pursuing a bachelor’s degree seemed like a faraway dream.

“There were some instances when I couldn’t attend school or when I could only attend one class,” reflects Cartagena. “But it gave me that momentum to say, ‘I’m just going to keep at it.’”

Francisco Cartagena

At Montgomery College, Cartagena learned about the UMBC-Shady Grove campus and its political science program. As a full-time working adult, he believed that UMBC-Shady Grove would be a good fit. With an extra push from his wife Cora Trelles Cartagena ’12, social work, Cartagena reached out to Sunil Dasgupta, political science program director and professor at UMBC-Shady Grove, to find out more.

To Cartagena’s surprise, Dasgupta asked a question that would sell him on applying: “Why do you think you can complete this program?” Motivated by the challenge, Cartagena pushed forward and eventually proved that he would do more than succeed—he would lead.

“Francisco is somebody that intuitively knew the importance of politics in transforming and changing our lives,” says Dasgupta. “I think part of the reason that happens is because he comes from an immigrant family. When you’re in that position, you quickly realize you have to master this if you want to help yourself, your family, and your community.”

An uplifting environment

Cartagena saw The Universities at Shady Grove (USG) as a place to practice his role in politics. As one of two students representing UMBC on the Student Government Association’s executive board, he learned more about the funding process at USG, the development of programs on campus, and the ins-and-outs of university partnerships.

“When you have an environment with multiple people from different schools, you can truly see the different backgrounds, their intent, and how people process things,” Cartagena says.

When Cartagena attended USG’s job fair and spotted a table for Congressman Jamie Raskin’s office staffed by a fellow Latina, he saw a vision for his future. “At the time, a career in government or interning for a government official was so far-fetched, whether because of my status or my prior experiences. It was something I would just dream of,” explains Cartagena, who wound up spending the summer splitting his internship between Raskin’s Rockville office and his congressional office on the Hill—two experiences that propelled his career in government.

“I still pinch myself because I’m a first-generation immigrant who came here from El Salvador with my parents…To be able to represent the county I grew up in—it was a bunch of mixed feelings that were finally culminating into something very positive,” says Cartagena.

In 2018, Cartagena started with a role in the City of Gaithersburg’s human resources department and in 2021, transitioned to his current role as an I.T. project manager. Now, he oversees applications, business needs from different departments, and processes in the technology sector.

Continuing to lead

In 2019, as a master’s student studying cybersecurity at UMBC-Shady Grove, Cartagena continued his ongoing involvement on campus, joining the Graduate School Council and USG’s Advisory Board.

During his final year in the program, Cartagena received a phone call from Dasgupta, who was creating an interactive bot to help Maryland voters identify political candidates most aligned with their values. He hoped that the bot, along with his podcast, I Hate Politics, would serve as informative tools. But realizing that a significant portion of the county was Spanish speaking, he enlisted Cartagena’s help.

“The first person I called was Francisco. And it wasn’t a small job; it was pages and pages of translation,” Dasgupta says, adding that they only had about a couple of weeks to complete the project before elections began. Still, Cartagena took on the translation task without hesitation.

“That kind of collaboration uplifts UMBC and the community,” notes Dasgupta. “We continue to work with our students and alumni, and those interactions are very revitalizing. We find meaning through those relationships.”

Cartagena notes he wouldn’t have made it this far without the resources and opportunities he found at UMBC-Shady Grove. “If there was a change I could recommend, it would be showing students and adult learners that there are other pathways for you to get that Ph.D., get that bachelor’s, or get that associate degree,” says Cartagena. “I think oftentimes students are afraid; it’s an investment of money and time, and you don’t know if you’re going to make it through…but you will find your niche if you stick it out.”

Anupam Joshi, a professor focused on both high-impact computing research and expanding access to computer science and cybersecurity education, has been named a 2022–23 American Council on Education (ACE) Fellow.

Joshi is the Oros Family Professor and chair of computer science and electrical engineering at UMBC and director of UMBC’s Center for Cybersecurity. He will spend the coming academic year with University System of Maryland (USM) leaders, shadowing both USM Chancellor Jay A. Perman and Bruce Jarrell, president of the University of Maryland, Baltimore (UMB). 

UMBC has a strong history of leaders participating in the ACE Fellows program, an intensive mentorship program that has prepared faculty, staff, and administrators for senior positions in college and university leadership since it began in 1965. More than 80 percent of the program’s 2,500 past Fellows have gone on to serve as chief executive officers, chief academic officers, other cabinet-level positions, or deans following their fellowship.

“The ACE Fellows program embodies ACE’s goal of enriching the capacity of agile leaders to problem-solve and innovate, and it fuels the expansion of a talented and diverse higher education leadership pipeline,” said ACE President Ted Mitchell. “Fellows continue to excel in prominent leadership roles, and the potential of this new cohort to bring strong leadership to institutions across America greatly excites me.”

Focus on innovating institutions

Following a rigorous application process, ACE selected 46 Fellows this year from colleges and universities across the United States. Throughout the year, these Fellows will observe and work with senior leaders at their host institution, attend decision-making meetings, and focus on issues of interest. They will also conduct projects of pressing concern for their home institutions, with the goal of returning after their fellowship year prepared to guide positive change.

“I am thrilled and honored to be mentored by two stalwarts of higher education in Chancellor Perman and President Jarrell,” Joshi says. “I look forward to learning from these leaders and working together to make a difference for the students in USM universities. I thank President Emeritus Hrabowski, President Sheares Ashby, and Provost Rous at UMBC for nominating me for this opportunity and their support.”

Leadership trajectory

Joshi obtained a B.Tech degree from the Indian Institute of Technology (IIT) Delhi in 1989, and a master’s and Ph.D. from Purdue University in 1991 and 1993, respectively. He has published more than 275 technical papers, has been granted nine patents and obtained research support from a variety of federal and industrial sources. In 2014 he was named a Fellow of the Institute of Electrical and Electronics Engineers, or IEEE.

As chair, Joshi leads one of UMBC’s largest departments. There he has overseen a near doubling of student enrollment at the graduate level and a 50% growth rate at the undergraduate level, accompanied by an increase in student body diversity. 

He has worked with partners in the UMBC Office of Institutional Advancement to raise funds supporting research from such industry partners as Northrop Grumman, GE, and Cisco. As a result of these efforts and collaboration with Jack Suess, UMBC’s chief information officer and vice president of information technology, the state recently announced the creation of a Maryland Institute for Innovative Computing at UMBC. 

Joshi directs the Center for Cybersecurity, which brings together scholarship and research in cybersecurity from computer science, information systems, social sciences, humanities, public policy, and natural sciences. In this role, he serves on the Maryland Cybersecurity Council. 

Additionally, Joshi directs UMBC’s Cyber Scholars Program, a joint effort between the Center for Cybersecurity and UMBC’s Center for Women in Technology. This program is focused on supporting a diverse next generation of leaders in cybersecurity and computing.

At the conclusion of the fellowship year, Joshi will return to these leadership roles with new knowledge and skills to expand UMBC’s work in innovative ways, supported by a network of emerging and longstanding university leaders across the nation.

This UMBC News story draws from an USM press release (8/31/2022). Learn more about ACE through stories on UMBC’s prior fellows, such as Tim Nohe, visual arts; Kate Tracy M.A. ‘01, Ph.D. ‘03, psychology; Sarah Shin, education; and Anne Brodsky, psychology, among others. UMBC President Emeritus Freeman Hrabowski currently serves as the inaugural ACE Centennial Fellow.

By Richard Forno, Principal Lecturer,Computer Science and Electrical Engineering, UMBC

Twitter’s former security chief, Peiter “Mudge” Zatko, filed a whistleblower complaint with the Securities and Exchange Commission in July 2022, accusing the microblogging platform company of serious security failings. The accusations amplified the ongoing drama of Twitter’s potential sale to Elon Musk.

Zatko spent decades as an ethical hacker, private researcher, government adviser and executive at some of the most prominent internet companies and government offices. He is practically a legend in the cybersecurity industry. Because of his reputation, when he speaks, people and governments normally listen – which underscores the seriousness of his complaint against Twitter.

As a former cybersecurity industry practitioner and current cybersecurity researcher, I believe that Zatko’s most damning accusations center around Twitter’s alleged failure to have a solid cybersecurity plan to protect user data, deploy internal controls to guard against insider threats and ensure the company’s systems were current and properly updated.

Zatko also alleged that Twitter executives were less than forthcoming about cybersecurity incidents on the platform when briefing both regulators and the company’s board of directors. He claimed that Twitter prioritized user growth over reducing spam and other unwanted content that poisoned the platform and detracted from the user experience. His complaint also expressed concerns about the company’s business practices.

Alleged security failures

Zatko’s allegations paint a disturbing picture of not only the state of Twitter’s cybersecurity as a social media platform, but also the security consciousness of Twitter as a company. Both points are relevant given Twitter’s position in global communications and the ongoing struggle against online extremism and disinformation.

Perhaps the most significant of Zatko’s allegations is his claim that nearly half of Twitter’s employees have direct access to user data and Twitter’s source code. Time-tested cybersecurity practices don’t allow so many people with this level of “root” or “privileged” permission to access sensitive systems and data. If true, this means that Twitter could be ripe for exploitation either from within or by outside adversaries assisted by people on the inside who may not have been properly vetted.

Zatko also alleges that Twitter’s data centers may not be as secure, resilient or reliable as the company claims. He estimated that nearly half of Twitter’s 500,000 servers around the world lack basic security controls such as running up-to-date and vendor-supported software or encrypting the user data stored on them. He also noted that the company’s lack of a robust business continuity plan means that should several of its data centers fail due to a cyber incident or other disaster, it could lead to an “existential company ending event.”

These are just some of the claims made in Zatko’s complaint. If his allegations are true, Twitter has failed Cybersecurity 101.

Concerns over foreign government interference

Zatko’s allegations might also present a national security concern. Twitter has been used to spread disinformation and propaganda in recent years during global events like the pandemic and national elections.

For example, Zatko’s report stated that the Indian government forced Twitter to hire government agents, who would have access to vast amounts of Twitter’s sensitive data. In response, India’s at-times hostile neighbor Pakistan accused India of trying to infiltrate the security system of Twitter “in an effort to curb fundamental freedoms.”

Given Twitter’s global footprint as a communications platform, other nations such as Russia and China could require the company to hire its own government agents as a condition of allowing the company to operate in their country. Zatko’s allegations about Twitter’s internal security raise the possibility of criminals, activists, hostile governments or their supporters seeking to exploit Twitter’s systems and user data by recruiting or blackmailing its employees may well present a national security concern.

Worse, Twitter’s own information about its users, their interests and who they follow and interact with on the platform could facilitate targeting for disinformation campaigns, blackmail or other nefarious purposes. Such foreign targeting of prominent companies and their employees has been a major counterintelligence worry in the national security community for decades.

Fallout

Whatever the outcome of Zatko’s complaint in Congress, the SEC or other federal agencies, it already is part of Musk’s latest legal filings as he tries to back out of his purchase of Twitter.

Ideally, in light of these disclosures, Twitter will take corrective action to improve the company’s cybersecurity systems and practices. A good first step the company could take is reviewing and limiting who has root access to its systems, source code and user data to the minimum number necessary. The company should also ensure that its production systems are kept current and that it is effectively prepared to contend with any type of emergency situation without significantly disrupting its global operations.

From a broader perspective, Zatko’s complaint underscores the critical and sometimes uncomfortable role cybersecurity plays in modern organizations. Cybersecurity professionals like Zatko understand that no company or government agency likes publicity for cybersecurity problems. They tend to think long and hard about whether and how to raise cybersecurity concerns like these – and what the potential ramifications might be. In this case, Zatko says his disclosures reflect “the job he was hired to do” as head of security for a social media platform that he says “is critical to democracy.”

For companies like Twitter, bad cybersecurity news often results in a public relations nightmare that could affect share price and their standing in the marketplace, not to mention attract the interest of regulators and lawmakers. For governments, such revelations can lead to a lack of trust in the institutions created to serve society, in addition to potentially creating distracting political noise.

Unfortunately, how cybersecurity problems are discovered, disclosed and handled remains a difficult and sometimes controversial process, with no easy solution both for cybersecurity professionals and today’s organizations.

Richard Forno, Principal Lecturer in Computer Science and Electrical Engineering, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article.

In early 2022, Nadja Franklin ‘23 was exploring summer opportunities through the UMBC Career Center when she heard about a chance to connect with tech internships at Maryland’s state agencies. As a business technology administration major, her interest was piqued. She arrived at the on-campus internship event with résumé in hand, ready to discuss her skills, and her preparation and enthusiasm paid off. 

The hiring event was hosted by the Maryland Institute for Innovative Computing (MIIC) to help state agencies expand their technical talent pipeline through intern recruitment. The MIIC is a collaboration between the University System of Maryland and partners in the public and private sectors, launched in 2021. Administered by UMBC, the MIIC addresses workforce challenges related to computing and analytics in state agencies. Students at colleges and universities across Maryland are eligible to apply for internships through the MIIC, connecting skilled students with state employers seeking fresh tech talent.

Talent meets opportunity

The MIIC is continuously growing the pipeline of tech talent ready to support state agencies in the longer term, helping them run securely and efficiently. So far, in 2022, they’ve connected nearly 40 interns with opportunities at state agencies across Maryland, including the Department of Labor, Department of Information Technology, Department of Health, Department of Transportation and the Chief Data Office within the Governor’s Office.

“The MIIC reflects Maryland’s dedication to ensuring our state agencies have the technical staffing and internal infrastructure they need,” explains Annie Weinschenk, program director of workforce initiatives in the UMBC Career Center. 

“With cyber crime on the rise, including attacks on government agencies, MIIC is helping to build a skilled workforce dedicated to service within the state of Maryland,” Weinschenk says. “MIIC internship areas range from data science, cybersecurity, and artificial intelligence, to geographic information systems at seven agencies across Maryland.”

Prepared to succeed

Franklin is a T-SITE Scholar in UMBC’s Center for Women in Technology who transferred to UMBC from the Community College of Baltimore County. At the MIIC event, she connected with the Maryland Department of Transportation (MDOT) about projects that would draw on her interests and experience, and she realized the opportunity could be a great match.

Afterward, she quickly completed her application for a project management internship in MDOT’s information technology department. She also accessed other Career Center resources to help her stand out as a top candidate, including interview prep with Weinschenk and Career Center Director Christine Routzahn.

“Students come to their internship experiences with a variety of backgrounds, levels of experience, and majors,” says Weinschenk. “We work to make sure they put their best foot forward, so they can access these unique hands-on learning opportunities.” 

Meaningful connections

Franklin’s primary project with MDOT involves radio frequency identification (RFID), tagging IT and non-IT assets for use in various projects across the agency. But she has particularly enjoyed the chance to meet with MDOT’s chief information officer and deputy chief information officer. She’s also had a chance to learn about the broad range of projects across MDOT, and how project management works, through supporting directors’ meetings. 

Franklin also drew on her writing skills and creativity to help develop scripts for MDOT training videos, and she enjoyed a unique chance to participate in the video filming and production process. 

Beyond learning new skills, her favorite aspect of the internship has been MDOT’s inclusive, welcoming environment.

K-12 and higher ed partnerships

While Franklin came to UMBC interested in a career in tech, that’s not the case for many students who have the talent and skills to succeed in tech fields. With this in mind, the MIIC has also focused on expanding K-12 initiatives, to help prepare students earlier on for these high-demand careers, particularly in cybersecurity.

Earlier this year, Governor Larry Hogan announced the launch of the Maryland Cyber Range for Elevating Workforce and Education, operated by the MIIC. This $1.2 million initiative will expand cybersecurity education and training through collaboration with the Maryland Center for Computing Education (MCCE), Virginia Tech U.S. Cyber Range, and the nonprofit Teach Cyber.

This partnership will include initiatives at all educational levels, from K-12 through higher education and workforce training. The U.S. Cyber Range will provide access to a high quality simulated environment for teachers and students to learn cybersecurity. 

Overall, this collaborative effort will enable Maryland to continue to grow and strengthen the state’s cybersecurity education infrastructure, explains Jack Suess, UMBC’s vice president of information technology and chief technology officer. 

Innovating cybersecurity education 

A leader in cybersecurity education, UMBC is also advancing the field in other ways, complementing the work of the MIIC. For example, Alan T. Sherman, professor of computer science, recently received more than $260,000 of a $500,000 grant from the National Science Foundation (NSF) to study and improve how cybersecurity is taught at the U.S. Naval Academy and U.S. Military Academy. 

The project, Examining Pedagogy in Cybersecurity (EPIC), is collaborative with the University of Illinois Urbana-Champaign and University of Minnesota Duluth, and is funded through NSF’s Secure and Trustworthy Computing (SaTC) program. Because the academies teach cybersecurity to all first-year students, EPIC offers a large-scale opportunity to investigate how simulation-based teaching and learning affects different student populations.

In the first phase of the research, Sherman and his collaborators—including computer science Ph.D. student Andew Slack and Linda Oliva, assistant professor of education—will study how instructors at the academies structure and teach their cybersecurity courses. In the second phase, they will introduce active simulation-based learning exercises and pedagogies and assess their effectiveness. 

UMBC’s championship-winning Cyberdawgs cyberdefense team will help adapt and improve learning materials. As one quantitative measure of the new pedagogy’s effectiveness, EPIC will assess students’ conceptual understanding using the Cybersecurity Concept Inventory (CCI), developed by Sherman and his team. 

Benefits for Maryland

MIIC initiatives continue to expand in new directions. In research, The Hilltop Institute at UMBC is receiving funding to bring together health data related to opioid addiction from different state sources to more accurately identify patients’ risks for relapse. Like the MIIC’s educational initiatives, this work demonstrates how innovations in computing can benefit Maryland and its residents.

By Richard Forno, principal lecturer, Computer Science and Electrical Engineering, UMBC

President Joe Biden on March 21, 2022, warned that Russian cyberattacks on U.S. targets are likely, though the government has not identified a specific threat. Biden urged the private sector: “Harden your cyber defenses immediately.”

It is a costly fact of modern life that organizations from pipelines and shipping companies to hospitals and any number of private companies are vulnerable to cyberattacks, and the threat of cyberattacks from Russia and other nations makes a bad situation worse. Individuals, too, are at risk from the current threat.

Local governments, like schools and hospitals, are particularly enticing “soft targets” – organizations that lack the resources to defend themselves against routine cyberattacks, let alone a lengthy cyber conflict. For those attacking such targets, the goal is not necessarily financial reward but disrupting society at the local level.

From issuing business licenses and building permits and collecting taxes to providing emergency services, clean water and waste disposal, the services provided by local governments entail an intimate and ongoing daily relationship with citizens and businesses alike. Disrupting their operations disrupts the heart of U.S. society by shaking confidence in local government and potentially endangering citizens.

In the crosshairs

Local governments have suffered successful cyberattacks in recent years. These include attacks on targets ranging from 911 call centers to public school systems. The consequences of a successful cyberattack against local government can be devastating.

A cyberattack on the city of Baltimore disrupted municipal services for weeks in 2019. AP Photo/Patrick Semansky

I and other researchers at University of Maryland, Baltimore County have studied the cybersecurity preparedness of the United States’ over 90,000 local government entities. As part of our analysis, working with the International City/County Management Association, we polled local government chief security officers about their cybersecurity preparedness. The results are both expected and alarming.

Among other things, the survey revealed that nearly one-third of U.S. local governments would be unable to tell if they were under attack in cyberspace. This is unsettling; nearly one-third of local governments that did know whether they were under attack reported being attacked hourly, and nearly half at least daily.

Ill-equipped

Lack of sound IT practices, let alone effective cybersecurity measures, can make successful cyberattacks even more debilitating. Almost half of U.S. local governments reported that their IT policies and procedures were not in line with industry best practices.

In many ways, local governments are no different from private companies in terms of the cybersecurity threats, vulnerabilities and management problems they face. In addition to those shared cybersecurity challenges, where local governments particularly struggle is in hiring and retaining the necessary numbers of qualified IT and cybersecurity staff with wages and workplace cultures that can compare with those of the private sector or federal government.

Additionally, unlike private companies, local governments by their nature are limited by the need to comply with state policies, the political considerations of elected officials and the usual perils of government bureaucracy such as balancing public safety with the community’s needs and corporate interests. Challenges like these can hamper effective preparation for, and responses to, cybersecurity problems – especially when it comes to funding. In addition, much of the technology local communities rely on, such as power and water distribution, are subject to the dictates of the private sector, which has its own set of sometimes competing interests.

Large local governments are better positioned to address cybersecurity concerns than smaller local governments. Unfortunately, like other soft targets in cyberspace, small local governments are much more constrained. This places them at greater risk of successful cyberattacks, including attacks that otherwise might have been prevented. But the necessary, best-practice cybersecurity improvements that smaller cities and towns need often compete with the many other demands on a local community’s limited funds and staff attention.

Getting the basics right

Whether they are victimized by a war on the other side of the world, a hacktivist group promoting its message or a criminal group trying to extort payment, local governments in the U.S. are enticing targets. Artificial intelligence hacking tools and vulnerabilities introduced by the spread of smart devices and the growing interest in creating “smart cities” put local governments even more at risk.

There’s no quick or foolproof fix to eliminate all cybersecurity problems, but one of the most important steps local governments can take is clear: Implement basic cybersecurity. Emulating the National Institute of Standards and Technology’s national cybersecurity framework or other industry accepted best practices is a good start.

I believe government officials, especially at the local level, should develop and apply the necessary resources and innovative technologies and practices to manage their cybersecurity risks effectively. Otherwise, they should be prepared to face the technical, financial and political consequences of failing to do so.

*****

Header image: Hackers can disrupt local government services, like this library in Willmar, Texas. The town suffered a cyberattack in August 2019. AP Photo/Tony Gutierrez

Richard Forno, Principal Lecturer in Computer Science and Electrical Engineering, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article.

By Helena M. Mentis, professor, Information Systems, UMBC and Nora McDonald, assistant professor, Information Technology, University of Cincinnati

Recently, the U.S. Social Security Administration sent out an email to subscribers of its official blog explaining how to access social security statements online. Most people know to be suspicious of seemingly official emails with links to websites asking for credentials.

But for older adults who are wary of the prevalence of scams targeting their demographic, such an email can be particularly alarming since they have been told that the SSA never sends emails. From our research designing cybersecurity safeguards for older adults, we believe there is legitimate cause for alarm.

This population has been schooled in a tactical approach to online safety grounded in fear and mistrust – even of themselves – and focused on specific threats rather than developing strategies that enable them to be online safely. Elders have been taught this approach by organizations they tend to trust, including nonprofits that teach older adults how to use technology.

These organizations promote a view of older adults as highly vulnerable while also encouraging them to take gratuitous risks in defending themselves. As information technology researchers, we believe it doesn’t need to be this way.

Older adults and online safety

Older adults may be at heightened risk of cybersecurity breaches and fraudulent behavior because they lack experience with internet technology and represent a financially attractive target. Older adults may also be more susceptible because they struggle with their confidence in using technology even as they recognize its benefits.

We have been developing technology tools that help aging Americans maintain their own online safety no matter what challenges they may face, including cognitive decline. To do so, we needed to understand what and how the people we study are learning about cybersecurity threats and what strategies they are being taught to reduce their vulnerabilities.

We have found that older adults attempt to draw on personal experience to develop strategies to reduce privacy violations and security threats. For the most part, they are successful at detecting threats by being on the lookout for activities they did not initiate — for example, an account they do not have. However, outside experts have an inordinate amount of influence on those with less perceived ability or experience with technology.

What ‘experts’ are telling older Americans

Unfortunately, the guidance that older adults are getting from those who presumably have authority on the matter is less than ideal.

Perhaps the loudest of those voices is the AARP, a U.S. advocacy group that has been carrying out a mission to “empower” individuals as they age for over six decades. In that time, it has established a commanding print and online presence. Its magazine reached over 38 million mailboxes in 2017, and it is an effective advocacy group.

What we found was that the AARP communiqués on cybersecurity use storytelling to create cartoonish folktales of internet deception. A regularly featured diet of sensational titles like “Grandparent Gotchas,” “Sweepstakes Swindles” and “Devilish Diagnoses” depict current and emerging threats.

Much of the cybersecurity advice given to elders fosters the cartoonish misconception that flesh-and-blood scam artists lurk in their midst. 5m3photos/Moment via Getty Images

These scenarios appeal to readers the way crime shows have historically appealed to TV audiences: by using narrative devices to alarm and thrill. Ultimately they also delude viewers by leaving them with the misconception that they can use what they’ve learned in those stories to defend themselves against criminal threats.

Folktales and foibles

One job of folktales is to spell out the hazards that a culture wants its members to learn in childhood. But by presenting cyber-risk as a set of ever-evolving stories that focuses on particular risks, the AARP shifts attention away from basic principles to anecdotes. This requires its members to compare their online experiences with specific stories.

Readers are implicitly encouraged to assess the plausibility of particular scenarios with questions like, Is it possible that I have any unpaid back taxes? And, Do I actually have an extended warranty? It requires people to catalogue each of these stories and then work out for themselves each time whether an unsolicited message is a real threat based on its content, rather than the person’s circumstances.

No, it’s not personal

Through this inventory of stories and characters, we also found that the AARP was personalizing what is, at root, a set of structural threats, impersonal by nature. The stories often characterize scammers as people in the reader’s very midst who use local news to manipulate older adults.

Real threats are not “sweepstake swindlers” or “Facebook unfriendlies,” with a live scam artist sensitive to the needs and foibles of each intended victim. There is rarely a human relationship between the cyber-scammer and the victim — no con artists behind the notorious “grandparents scam.” The AARP bulletins and advisories imply that there is — or, at least, implicitly foster that old-fashioned view of a direct relationship between swindler and victim.

Don’t engage

Perhaps even more worrisome, AARP advisories appear to encourage investigation into scenarios, when engagement of any sort puts people at risk.

In one post alerting people to “8 Military-Themed Imposter Scams,” they discuss “prices too good to be true,” when the very concept of buying a car on Craigslist, or an “active-duty service member” urgently selling a car, should be a red flag discouraging any form of engagement.

Internet users of any age, but especially more vulnerable populations, should be urged to withdraw from threats, not be cast as sleuths in their own suspense stories.

Protecting older adults in the age of surveillance capitalism

In order to reduce everyone’s risk while online, we believe it’s important to provide a set of well-curated principles rather than presenting people with a set of stories to learn. Everyone exposed to threats online, but especially those most at risk, needs a checklist of cautions and strong rules against engagement whenever there is doubt.

In short, the best strategy is to simply ignore unsolicited outreach altogether, particularly from organizations you don’t do business with. People need to be reminded that their own context, behaviors and relationships are all that matter.

Because, in the end, it’s not just about tools, it’s about worldview. Ultimately, for everyone to make effective, consistent use of security tools, people need a theory of the online world that educates them about the rudiments of surveillance capitalism.

We believe people should be taught to see their online selves as reconstructions made out of data, as unreal as bots. This is admittedly a difficult idea because people have a hard time imagining themselves as separate from the data they generate, and recognizing that their online lives are affected by algorithms that analyze and act on that data.

But it is an important concept — and one that we see older adults embracing in our research when they tell us that while they are frustrated with receiving spam, they are learning to ignore the communications that reflect “selves” they don’t identify with.

*****

Nora McDonald, Assistant Professor of Information Technology, University of Cincinnati and Helena M. Mentis, Professor of Information Systems, University of Maryland, Baltimore County

Header image: Telling elders scary stories about online scammers is not the best way to keep them safe. Olga Gavrilenko/EyeEm via Getty.

This article is republished from The Conversation under a Creative Commons license. Read the original article.