The problem of cyberattacks is getting worse. New Bremen-based forklift manufacturer Crown Equipment dealt with a cyberattack that shut down many of its 24 manufacturing sites during most of June. Auto dealer software company CDK Global wrestled with a June 19 cyberattack and reported ransom demand that forced the company to shut down its systems.
Cyberattacks have more than doubled since the COVID-19 pandemic, according to the International Monetary Fund.
Many attacks are focused on monetary gain. The number of ransomware attacks worldwide grew as much as 74% in the past year, Director of National Intelligence Avril Haines told Congress in May.
In the AFIT course, civil engineers are taught to protect the infrastructure that keeps a military installation running, the same infrastructure on which civilian communities also depend — water, wastewater, power and more.
“The civil engineers are responsible for the maintenance and cybersecurity of those systems,” said Jonathan Butts, co-founder of QED Secure Solutions and an AFIT instructor. “So this course is focused on teaching them on an hands-on level how to recognize cybersecurity concerns.”
Part of what the course teaches is how to ensure that these systems aren’t exposed to the Internet, to minimize what Butts called their “attack surface.”
“The less the connectivity, the better,” said Butts, a retired Air Force officer.
The five-day course helps civil engineers better understand ladder logic, human-machine interfaces and networking, an Air Force account of the course says.
Students tackle lab exercises using a “mobile industrial control system security trainer,” with the curriculum culminating in a capstone exercise, the account said.
The “defensive posture” has its challenges, instructors note. Students are trained to assess their systems and spot problems. But they must be ready.
“The challenge with the defense is you have to be right 100% of the time,” Butts said. “From an offensive perspective, you just have to find that gap you can leverage.”
“A lot of the attacks we’re seeing now didn’t exist 10 years ago,” said Nick Kulesza, a instructor with the AFIT’s civil engineering school. “If you were to look up ransomware and the amount of money that was lost from ransomware 10 years ago ... it’s very, very different. That’s one of the challenges.”
Attacks are taking advantage of new tools. ChatGPT and other generative Artificial Intelligence platforms make some attacks easier, Kulesza said.
“That’s where we thought it might be appropriate for us to equip airmen with the education and knowledge just to raise awareness about what the art of the possible is,” he said. “A lot the defenses are very basic things we can do. You don’t have to be a cyber-expert, so to speak.”
About 250 civil engineers have taken the cybersecurity course. A fifth day was recently added to what originally was a three-day course.
“When we get feedback from the students, one of the most dramatic trends we’ve gotten is, they desire a longer course so they can have greater absorption of the material,” Kulesza said.
About the Author
