On May 3, UMBC President Freeman Hrabowski joined WAMU’s The Kojo Nnamdi Show for a discussion about the state of diversity in STEM fields and the importance of connecting STEM with work in the arts, humanities, and social sciences.

Pres. Hrabowski was joined by Brian Kelly, editor of U.S. News & World Report, and James Maiden, assistant dean of student affairs at University of the District of Columbia and principal investigator of the Minority Male Makers Program. The wide-ranging discussion covered several issues, including how studying the arts, humanities, and social sciences can help students develop the skills and knowledge needed to address some of society’s most pressing challenges.

“One of the ways we can get students to appreciate what STEM can do for our country is through the humanities, not only through reading skills, but understanding many of the ethical issues involved in the achievement gap, in health disparities, and in the environmental issues that we face,” Dr. Hrabowski said.

Pres. Hrabowski highlighted UMBC’s national leadership and strengths in inclusive excellence and focus on under-representation in STEM. Mentioning centers and programs like the Center for Women in Technology (CWIT), Meyerhoff Scholars Program, Sondheim Public Affairs Scholars Program, and Humanities Scholars Program, Pres. Hrabowski shared how many students are combining majors in the arts and humanities with taking courses in STEM disciplines to pursue careers in a range of professions.

“We need many solutions that will connect disciplines that will solve the problems we find in society,” Dr. Hrabowski explained.

Later in the program, President Hrabowski also described UMBC’s partnership with Northrop Grumman and Baltimore City Public Schools to support students, teachers, and communities in science, technology, engineering, arts, and math (STEAM) education.

Listen to the full segment “Local D.C. STEM careers are soaring-but for whom?” on the WAMU website.

Image: Pres. Hrabowski speaks at Lakeland Elementary/Middle School, Jan. 2016. Photo by Marlayna Demond ’11 for UMBC.

The leak of confidential financial documents from a Panamanian law firm, known as the “Panama Papers,” has raised major questions about how wealth moves across international borders. For governments and companies that manage sensitive information, it’s also raised questions about the possibilities and limitations of safeguards designed to protect data. Karuna Pande Joshi, research assistant professor of computer science and electrical engineering, explains through a new op-ed in The Conversation how data breaches occur, how to avoid them, and how they are, at some point, unavoidable.

Joshi describes how companies often devote resources to protect data from external hackers and cyber attacks, but that internal threats raise different challenges. “Organizations spend significant resources to firewall their data against attacks by external hackers and cybercriminals,” Joshi says. “However, they have to often face the dichotomy of effectively preventing leaks of data by the very employees who need to use it for their daily work.”

One common issue that companies need to deal with is the use of smartphones in the workplace, and the increasing capacity of smartphones, Joshi says. Some employers allow employees to access confidential data with their smartphones and store it on the device for easier access in the future.

Companies can configure computers in ways that prevent people from printing, moving, or copying documents, Joshi says, but doing so can have the negative impact of restricting employee access to documents and data in ways that make it difficult for them to accomplish their duties. “In today’s world, where employees often collaborate on documents and use shared data sets to complete their work, it is impossible to prevent an insider attack,” notes Joshi.

Read the full article, “Panama Papers: how do leakers leak?,” in The Conversation.

Image: Karuna Pande Joshi. Phoyo by Marlayna Demond ’11 for UMBC.

Arti Deore Choudhary
Master’s in Professional Studies, Cybersecurity
Summa Cum Laude
Hometown: Pune, India
Plans: Cloud Support Engineer, Amazon Web Services

This UMBC cybersecurity master’s program has helped me to sharpen my professional, as well as management skills in a most demanding field. Without my degree and UMBC’s support I would not have been able to reach out to professionals and grow as a cybersecurity professional.

Arti Deore Choudhary arrived at UMBC with an impressive academic and professional background, including a B.S and M.S. in computer science from Pune University in India and years of experience as an IT professional, and she graduates from her cybersecurity master’s program with a 4.0 GPA. She has been actively involved in sharing her knowledge and experience with others in the fields of computer science and cybersecurity, particularly through mentoring.

Choudhary partnered with UMBC alumnus and co-founder of LKA Computer Consultants, Larry Aikins ‘14, M.P.S. cybersecurity, to lead Teens in Technology, a seven-day cybersecurity workshop designed to educate high school students about tech security. She also competed in the Maryland Cyber Challenge in 2015, with her UMBC team making it to the semifinal round.

Choudhary has received an Ethical Hacker Certificate and has interned with Ridgeback Network Defense, a startup technology company at bwtech@UMBC. She will soon begin a position as a cloud support engineer at Amazon Web Services.

Images: Arti Deore Choudhary leads a UMBC workshop for aspiring cybersecurity and technology students; photo courtesy of Arti Deore Choudhary. Portrait by Marlayna Demond ‘11 for UMBC.

Cybersecurity concerns continue to make headlines, including the recent attacks at MedStar Health and fraudulent tax returns being filed for Baltimore City employees. In response to this, many local governments, like their counterparts in the private sector, are taking steps to protect their websites and information.  

UMBC’s School of Public Policy hosted a forum on “Cybersecurity Concerns in Local Governments” on Friday, April 15 to present research on cybersecurity initiatives in local governments in Maryland and to highlight the policy implications of these initiatives. The event was sponsored by the UMBC School of Public Policy, bwtech@UMBC Cyber Incubator, and the UMBC Center for Cybersecurity. 

Speakers included School of Public Policy Professor and Director Donald Norris, Anupam Joshi, professor and chair of computer science and electrical engineering (CSEE) and director of UMBC’s Center for Cybersecurity, Rob O’Connor, chief technology officer for Baltimore County, and Gayle Guilford, chief information security officer for Baltimore City.

Norris discussed cybersecurity challenges in local governments across the country based on his research. In 2013, along with Joshi, he convened a focus group of technology officers from around Maryland to identify challenges and what governments are doing to help prevent cyber attacks.

“It was fascinating, because in part, we went in thinking cybersecurity is a technology problem and that the technology would fix itself,” Norris explained. “But people, policy, and process in government and large organizations are almost always the problem.”

Norris found that technology professionals in government identified people as the weakest link in cybersecurity threats because of phishing emails, lack of user training, under enforced and inefficient policies, and lack of funding to deal with cybersecurity threats.

To further research constantly evolving cybersecurity challenges in local government, Norris and his colleagues developed a questionnaire which will be conducted through the International City and County Management Association (ICMA) for city and county governments with populations greater than 50,000 around the country. They anticipate receiving the results this summer.

“We want to find out what local governments across the nation say are their biggest cybersecurity problems and the barriers that they face in addressing cybersecurity,” Norris said.

Joshi discussed various policies that are needed to keep computer and data systems secure, and said that policies should ideally be written in terms that both people and computers can easily interpret. “We need shared ontology that many systems can understand,” he explained. Computer systems can use policies to better understand the computer system’s actions and behaviors and identify issues and cybersecurity threats as they arise.

To regulate access to information, Joshi recommends having adjustable responses and a “need to know versus need to share” framework that can determine who has access to what levels of information. For example, he said that a general question, such as a person’s location, can be answered generally or very specifically. Sharing the state where the a person is located is less helpful than knowing what city they are in, and sharing GPS coordinates is the most helpful information. This method can be applied to providing access to information and data that needs to be kept secure and confidential.

He says that it is increasingly difficult to walk away from a cyber attack, especially if the cyber attack is in progress. “Technology evolves so quickly that hacks also have to evolve rapidly,” Joshi said.

Gayle B. Guilford, chief information security officer for the City of Baltimore, pointed out that the “new ransomware does not require human interaction,” so education about maintaining security on computers needs to change. “It used to be ‘don’t click,’ now you don’t even have to click,” she said, adding that the users should be the biggest group identifying oddities and suspicions.

“End users are the biggest vulnerability, but need to be the biggest defense,” said Rob O’Connor, chief technology officer for Baltimore County.

Note: On the same day as the forum, Norris and Richard Forno, assistant director of UMBC’s Center for Cybersecurity, were quoted in a Baltimore Sun article about fraudulent tax returns being filed for Baltimore City employees. Read “Federal, state authorities investigating source of data used to steal city employees’ tax returns” on the Baltimore Sun website, and “Investigation into Baltimore City Employees’ Stolen Tax Returns Underway” in Government Technology.

Forno also was quoted in “Maryland National Guard steps up role in cyberspace” on the Baltimore Sun website, and “Why haven’t hackers taken down the power grid?”in Parallax.

Image: Cybersecurity Forum Speakers (from left to right): Donald Norris, Gayle Guilford, Anupam Joshi, and Rob O’Connor. Photo by Marlayna Demond ’11 for UMBC. 

As ransomware reportedly held MedStar Health’s records system and data hostage, two UMBC cybersecurity experts offered insight on the situation and the possibilities for preventing future cyber attacks.

Anupam Joshi, director of UMBC’s Center for Cybersecurity and professor and chair of the department of computer science and electrical engineering (CSEE), spoke with CBS Baltimore (WJZ) about what MedStar Health or other organizations in similar situations can do to better understand and address the threats of ransomware.

He explained that ransomware takes over a computer system and holds it hostage until a demand is met, often a demand for bitcoins in exchange for returning access to the threatened data.

“Unbreakable. It’s simply unbreakable,” said Joshi, in describing how ransomware is highly challenging to crack.

Rick Forno, assistant director of the UMBC Center for Cybersecurity and director of UMBC’s graduate program in cybersecurity, spoke with The Daily Record about the MedStar Health system attack, specifically how ransomware attacks can be prevented.

Organizations like hospitals should back up their systems and data regularly, says Forno. However, he explains, malicious programs, like ransomware, can be hard to detect. This means that companies may not be able to guarantee that if encrypted backup files don’t contain  viruses or malware.

See “Cyber Attackers Who Broke Into MedStar Want Big Payout” on CBS Baltimore, and “MedStar cyberattack highlights health care IT challenges” in The Daily Record.

Photo by Yuri Samoilov, CC by 2.0.

UMBC and U.S. Naval Academy (USNA) faculty researchers presented updates on five collaborative cybersecurity projects funded by the Office of Naval Research (ONR) during the inaugural USNA-UMBC Partnership Symposium, hosted by UMBC’s Office the Vice President for Research on March 22, 2016.

The five projects presented are supported by three-year grants from the ONR, most of which are entering their second year of funding.

When the joint research initiative launched a year ago, Karl V. Steiner, vice president for research at UMBC, described it as “the start of a long-term partnership.” The recent symposium was the first formal opportunity for the research teams to formally present their progress on tackling major cybersecurity challenges outlined when the partnership began.

One team is developing a way to ensure that cloud-based storage services are secure, and that consumers can store their files with confidence. UMBC principal investigator (PI) Karuna Joshi, assistant research professor of computer science and electrical engineering (CSEE); Tim Finin, professor of CSEE; and USNA faculty are developing a cloud storage system that will make it impossible for deleted data to be restored or recovered.

Another group is developing a system that can continuously monitor itself and detect potential threats more quickly than human monitors. This technology has important safety as well as security implications. In cars, for example, hackers can gain control of a vehicle through Bluetooth or other existing systems, potentially having deadly effects. UMBC PI Ryan Robucci, assistant professor of CSEE; Chintan Patel, assistant professor of CSEE; Nilanjan Banerjee, associate professor of CSEE; Anupam Joshi, professor and chair of CSEE; and USNA faculty are now completing tests that involve working to detect anomalies in various systems.

Drawing on the finding that many online attacks follow predictable patterns, UMBC PI Tim Oates, professor of CSEE, and USNA PI Nate Chambers, assistant professor of computer science, presented their work on a tool to monitor social media networks, like Facebook and Twitter, in real-time to detect likely attacks. The team is analyzing language trends on social media platforms around the times that previous attacks took place. Regular social media users often notice attacks or threats of attacks first, and by analyzing and characterizing the content of their posts on “normal days” compared with “attack days” the team is developing a way to automatically generate an alert when real-time social media posts indicate a possible attack.

Understanding the strengths and limitations of the range of existing mobile authentication methods is important in protecting individuals’ devices from getting hacked. UMBC PI Ravi Kuber, associate professor of information systems, and USNA faculty are studying the strength of various authentication tools on Android devices to develop new methods that use tactile cues, like vibrations, to authenticate mobile devices. The team conducted research to understand authentication practices of people who are conscious of security issues, and the susceptibility of current authentication methods to over-the-shoulder breaches. Kuber and his team developed a secure authentication tool called H4Plock that prompts individuals to enter strokes in response to cues, where response patterns would be unique to an individual user.

The fifth group including UMBC PI Nirmalya Roy, assistant professor of information systems; Todd Pittman, associate professor of physics; James Franson, professor of physics; and several USNA faculty, is working to create quantum computers that can help identify abnormal behavior or patterns at much faster speeds than current computing technology. The team is extracting photons that will then be included in optical fibers to emit light. They are working to pull bundles of optical fibers thinner to create nanofiber cavities.

Don Engel, assistant vice president for research at UMBC, thanked the ONR for their close collaboration and shared his excitement that the research collaborations have already shown such “fruitful findings.”

Image: Karuna Joshi presents during the USNA-UMBC Partnership Symposium. Photo by Marlayna Demond ’11 for UMBC.

The UMBC’s Cyberdawgs have emerged victorious from the finals of the 2015 Maryland Cyber Challenge (MCC), winning the top prize for a student team with a total of 18,979 points and outscoring the professional division’s winning team by more than 5,500 points.

UMBC’s winning Cyberdawgs 1 team included Tyler Campbell ‘16, computer science; Josh Domangue ‘16, computer science; Chris Gardner ‘18, computer science and mathematics; Anh Ho ‘17, computer science; Jacob Rust ‘16, computer science; and Julio Valcarcel ‘16, information systems, all members of the UMBC Cyber Defense Team. The UMBC team Cyberdawgs 2 also participated in the final round of the challenge.

The final round of competition began on October 28, but was paused due to technical difficulties. The contest resumed on Saturday, February 20, 2016, and the Cyberdawgs hit the ground running.

“We are delighted that the competition was able to finish, and are very pleased that we were able to do as well as we did,” said Charles Nicholas, professor of computer science and electrical engineering (CSEE). Nicholas is a faculty adviser of the Cyber Defense Team, with Richard Forno, assistant director of the UMBC Center for Cybersecurity and director of the cybersecurity graduate program.

Approximately 25 teams from colleges and universities across the state qualified for the semifinals of the challenge. Two of the eight teams that moved on to the finals were from UMBC, representing the maximum number allowed from an individual university.

The annual MCC competition offers participants the opportunity to complete hands-on cybersecurity challenges, and allows teams to test their ability to break into a target machine and secure the machine against other teams’ attacks.  

“The Maryland Cyber Challenge is one of several competitions that I enjoy because we get to compete as a team. Participating in this competition is a great deal of fun because we get to learn new skills every year and always come away with new ways of thinking about cybersecurity issues,” said Valcarcel.

The Cyber Defense Team is looking forward to participating in the National Collegiate Cyber Defense Competition (NCCDC) in the spring. Last year, UMBC placed fourth overall at NCCDC.

Image: A computer circuit board. Photo by Harland Quarrington, CC BY-NC 2.0. 

The U.S. Department of Justice has a issued a court order to Apple for their assistance with unlocking an iPhone that may contain information about the San Bernardino shooting that took place in December 2015. Rick Forno, director of UMBC’s graduate program in cybersecurity and assistant director of the UMBC Center for Cybersecurity, reflected on how this case puts Apple in an unusual and challenging position, during an interview on the BBC’s Up All Night program.

From his perspective, Forno thinks it is possible for Apple to update one specific device so that the Department of Justice can access the content on that device, which would allow Apple to comply with the order. However, Forno explains that the real issue involved is the question of the future. “What is to stop the FBI or law enforcement—state, local, global—from contacting Apple asking for the same consideration on other devices,” he says.

Forno also spoke with Southern California Public Radio (KPCC) about the issue. He says that there is some information that may be solely on the phone and may point investigators to encrypted data and communications.

“A phone is a almost a digital archive of our entire lives,” he said.

On February 23, Forno was a guest on WEAA’s The Marc Steiner Show to discuss the ongoing issue between Apple and the FBI. He talks about the importance of acknowledging the nature, capabilities, and risks that the technology presents.

Listen to the full interview, “Up All Night: 18/02/2016” on the BBC. Forno’s interview begins around 1:21:00. Read “What the FBI might be looking for on the San Bernardino shooter’s iPhone,” on Southern California Public Radio. Listen to the full episode of The Marc Steiner Show. Forno is introduced around 02:50.

Photo by Yuri Samoilov, CC by 2.0. 

Bachelor’s and master’s programs in cybersecurity at Maryland colleges and universities are growing rapidly as more students become interested in careers in the industry. At UMBC, the number of graduate students studying cybersecurity has grown nearly five-fold over the past six years, explains Rick Forno, director of UMBC’s graduate cybersecurity program and assistant director for UMBC’s Center for Cybersecurity, in an article in The Daily Record.

UMBC’s proximity to government agencies like the National Security Agency (NSA) and private security and tech firms, has contributed to the growth of the university’s cybersecurity programs. One draw, engaging both introductory students and more advanced experts in the field, is the Maryland Cyber Challenge, a statewide competition for high school and college students and cybersecurity professionals held during the CyberMaryland Conference, which Forno founded.

Forno says that there are between 12,000 and 13,000 job openings in the cybersecurity industry across the state, which is good news for graduates from UMBC’s programs.   

In a separate article in The Daily Record, Tim Finholm, cybersecurity instructor at UMBC Training Center, shares his perspective on risks that companies must identify and be alert for to protect private information. He explains that companies must fend off threats that employees may unknowingly click right into—links that seem innocuous but are really traps left by hackers, designed to gather information or lead the user to a site where a server can take control of the computer, says Finholm.

Image: UMBC cybersecurity class in 2014. Photo by Marlayna Demond ’11 for UMBC.

Our alumni have gone on to excel in many arenas, and we couldn’t be prouder of them. Today, take a look at a couple of computer science alumni who are helping to advance the increasingly vital field of cybersecurity. 

As team technical director for the NSA’s Laboratory for Telecommunication Sciences, Josiah Dykstra ’13, Ph.D. computer science, is always coming up with new ways to combat cyber threats,
including a Google Glass-like device that alerts analysts to new threats in real time. Read more about Dykstra and his work with NSA at Fedscoop.

Jamie Butler ’02, M.S. computer science, is now the chief technology officer of the Arlington, Va.-based cybersecurity firm Endgame. Butler’s cybersecurity career began at NSA, and he’s also worked for Mandiant and FireEye. Read more about Butler here.

Have your own news to share? Send in a class note!