WRIGHT-PATTERSON AIR FORCE BASE, Ohio -- The Air Force Institute of Technology’s Civil Engineer School recently revamped its Advanced Control Systems Cybersecurity course, expanding the curriculum to include new exercises targeting wireless access points, fire alarms, traffic lights and other enhanced material supporting base critical infrastructure protection.
Before attending the course, students typically have a basic awareness that cybersecurity is important but may not fully understand its relevance to their work.
“There's a lack of understanding and awareness of the risks, threats and knowing what an attacker can do to a system, so that's really the focus of this class,” said Dr. Jonathan Butts, course instructor and co-founder of QED Secure Solutions. “We provide not only awareness of what the risk and threats are but also actionable items so when students return to their base, they can start implementing measures to secure and harden the devices and systems they support.”
The five-day course provides hands-on education for civil engineers to understand the impact of cyberattacks on control systems. Students are able to engage in various lab exercises using the Mobile Industrial Control System Security Trainer. The curriculum also introduces students to ladder logic, human-machine interfaces, and basic networking principles that emulate a real-world control system. These lesson concepts are applied during a capstone exercise demonstrating how malicious code can create physical effects on control systems.
“We focused on expanding the hands-on aspects of the labs and real-world components within the class,” Butts said. “We did that to provide more realistic training scenarios for the students so they can apply the principles taught in class to their home installations.”
A notable addition to the course is a fully functional stoplight in the classroom, allowing students to experience real-time cybersecurity impacts.
“Students create stoplight logic and upload it to a real stoplight,” said Billy Rios, course instructor and co-founder of QED Secure Solutions. “Instructors then show the hacked stoplight or what happens if the coding wasn't done right or wasn't secure. This helps students conceptualize the cyber-to-physical world relationship.”
Following the hands-on exercises, students complete an incident response exercise, creating plans for defending against and responding to cyber threats at their base. A new capstone group project, derived from a real-world event, tasks students with evaluating a fire suppression system for vulnerabilities an attacker could exploit. They then develop a plan to counter the system’s weaknesses, implement and demonstrate the attack, and trigger the fire suppression alarm.
Instructors include case studies of real-world events to help the students apply their learning. One case study involves assessing vulnerabilities in an electric power grid.
“We walk students through evaluating the cyber vulnerabilities of a real-world example, showing how an adversary can attack military and commercial systems, potentially impacting the mission,” Butts said.
Staff Sgt. Jeremy Vasquez, from Air Force Strategic Operations Command at Hurlburt Field, Florida, said, “Coming to this course has definitely opened up my eyes to issues that can occur at my home station and the importance of securing systems and networks.”
“At first I was very apprehensive about taking this class because it is definitely outside of my skill set,” said Staff Sgt. Jesse Burton, from Air Combat Command at Mountain Home Air Force Base, Idaho. “But I’ve been surprised at how quickly I’ve picked it up. The instructors do a great job of relating this to my job. I can definitely see the need for this class now.”
Instructors have noted that students often are unaware of the resources available to them for mitigating cybersecurity attacks. As more systems are automated to save personnel and money, the threat for cyber-attacks increases, especially in deployed locations.
“This course gives us an opportunity to educate them that there are personnel assigned to their respective installations who handle many cybersecurity responsibilities,” said Nicholas Kulesza, course director for the CE School. “This helps reduce response time if they encounter a cyber incident or event.”
The course has been offered 17 times, and at least one student has contacted the instructors with a concern at their base.
“We connected the student with the Air Force Civil Engineer Center, which took proactive measures on the issue,” Kulesza said. “It was a pleasant surprise to see the student quickly applying the knowledge from the course.”
The course is required for 7-level technicians from electrical, power production, HVAC/R, water and fuels Air Force Specialty Codes and must be complete for promotion to technical sergeant.
“Our primary target audience is staff sergeants,” Kulesza said. “We have also seen rising demand from civilians who are responsible for the continued operations of control systems.”
Students praised the expertise and helpfulness of the faculty.
“I feel confident asking questions about any of this information, knowing the instructors will have the knowledge or resources to help,” Vasquez said.
“The instructors have done a great job of bringing in people like me, with zero experience, and making me feel capable of doing this,” Burton said.
The Civil Engineer School provides technical and management oriented professional continuing education courses to more than 12,500 students a year in a variety of subject areas to prepare officer, enlisted, and civilian professionals to be more efficient and effective in current and future assignments in the CE fields. The school provides technical engineering, environmental, asset and engineering management, and expeditionary-focused instruction. The school also provides the initial skills training for all newly commissioned CE officers. Visit www.afit.edu/CE for more information.