As promised, I’m back with a follow-up to my recent post on how we need modernize the learning experience for cybersecurity professionals by gamifying training to make learning fun. Some of you may have attended the recent Microsoft Ignite events in Orlando and Paris. I missed the conferences (ironically, due to attending a cybersecurity certification boot camp) but heard great things about the Microsoft – Circadence joint “Into the Breach” capture the flag exercise. If you missed Ignite, we are planning several additional “Microsoft Ignite The Tour” events around the world, where you’ll be able to try your hand at this capture the flag experience. Look for me at the DC event, right after the Super Bowl, in early February.
In the meantime, due to the great feedback that I received from my previous blog (which by the way I do really appreciate, especially if you have other ideas for how we should be tackling the shortage of cyber professionals), I will be digging deeper into the mechanics of learning to understand what it really takes to learn cyber in today’s evolving landscape. I want to address the important questions of how a new employee would actually ramp up their learning, and how employers can prepare employees for success, and track the efficacy of the learning curriculum. Once again, I’m pleased to share this post with Keenan Skelly, chief evangelist at Boulder, CO-based Circadence. Take a look a look at some of her recommendations:
Q: Keenan, in our last blog, you discussed Circadence’s ‘Project Ares’ cyber learning platform. How do new cyber practitioners get started on Project Ares?
The way that Project Ares is set up allows for a user to acquire a variety of different skill levels when launched. It’s important to understand what kind of work roles you are looking to learn about as a user. What kinds of tools you’re looking to understand better before you get started on Project Ares. For example, if I were to take some of my Girls Who Code, or Cyber Patriot students and put them into the platform, I would probably have them start in the Battle School. This is where they’re going to learn about basic cybersecurity fundamentals, things like ports and protocols, regular expressions and the cyber kill chain. Then they can transition into Battle Rooms, where they will start to learn about very specific tools, tactics and procedures (TTPs), for a variety of different work roles. If you are a much more skilled cyber ninja, however, you can probably go ahead and get right into Missions, but we do recommend that everyone who comes into Project Ares does do some work in the Battle Rooms first, specifically if they are trying to learn a tool or a skill for their work role.
In Project Ares, we have a couple of different routes that an expert or an enterprising cybersecurity professional can come into that’s really focused more on their role. For example, we have an assessments area that is based entirely on the work role. That aligns to the NIST framework and the NICE cybersecurity work roles. For example, if you are a network defender, you can come into that assessment pathway and have steps laid out before you to identify your skill level in that work role.
Q: What areas within Project Ares do you recommend for enterprise cyber professionals to train against role-based job functions and prepare for cyber certifications?
You might start with something simple like understanding very basic things about your work role through a questionnaire in the Battle School arena. You may then move into a couple of Battle Rooms that tease out very detailed skills in tools that you would be using for that role. And then eventually you’ll get to go into a mission by yourself, and potentially a mission with your entire team to really certify that you are capable in that work role. All of this practice helps prepare professionals to take official cyber certifications and exams.
Q: Describe some of the gamification elements in Project Ares and share how it enhances cyber learning.
One of the best things about Project Ares is gamification. Everyone loves to play games, whether it’s on your phone playing Angry Birds, or on your computer or gaming console, so we really tried to put a lot of gaming elements inside Project Ares. For example, everything is scored within Project Ares, so everything you do from learning about ports and protocols, to battle rooms, to missions gives you points, experience points—those experience points add up to skill badges. All these things make learning more fun for the end-user. For example, if you are a defender, you might have skill badges in infrastructure, network design, network defense, etc. and the way Ares is set up, once you have a certain combination of those skill badges you can actually earn a work role achievement certificate within Project Ares.
This kind of thing is taken very much from Call of Duty, or other types of games where you can really build up your skills by doing a very specific skill-based activity and earning points towards badges. One of the other things that is great about Project Ares is it’s quite immersive, so the Missions, for example, allow a user to come into a specific cyber situation or cyber response situation (e.g. water treatment plant cyber attack) and be able to have multimedia effects that demonstrate what is going– very much reflective of that cool guy video look. Being able to talk through challenges in the exercises with our in-game advisor, Athena, adds another element to the learning experience. She, Athena, was inspired by the trends of personal assistants like Cortana and other such AI “bots” which have been integrated into games. So these things like chat bots, narrative storylines, and skill badges are super important for really immersing the individual in the process. It is so much more fun, and easier to learn things in this way, as opposed to sitting through a static Power Point presentation or watching someone on a on a video, trying to learn the skill passively.
Q: What kinds of insights and reporting capability can Project Ares deliver to cyber team supervisors and C-Suite leaders to help them assessing cyber readiness?
Project Ares offers a couple great features that are good for managers, all the way up to C-Suite individuals who are trying to understand how their cybersecurity team is doing. The first one is called Project Ares Trainer View. This is where a supervisor or manager can actually jump into the Project Ares environment with the students or with the enterprise team members and actually do that in a couple of different ways. So for example, the instructor, or the manager can jump into the environment as Athena, so that the user doesn’t know that they are in there, they can provide additional insight or help that is needed to a student.
A supervisor or leader can also jump in as the opponent, which gives them the ability to see someone who is just breezing by everything, to maybe make it a little more challenging; and then of course, they can just observe and leave comments for the individuals. That piece is really helpful when we are talking about managers who are looking to understand their team’s skill level in much more detail.
The other piece of that is a product we have coming out soon called Dendrite. Dendrite is an analytics tool that looks at everything that happens at Project Ares so we record all the key strokes, any chats that a user has with Athena, the in game advisor, and any chatting a user may have done with other team members while in a mission or battle room. Cyber team leads can really see what’s going on, and as a user, you can see what you’re doing well, and what you’re not doing well. That can be provided up to the manager level, the senior manager level, and even to the C-Suite level to demonstrate exactly where that individual is, in their particular skill path. It helps cyber team leads to understand what tools are being used appropriately and which tools are not being used appropriately.
For example, if you are a financial institution and you paid quite a bit of money for Tanium, but upon viewing tool use in Dendrite, you find that no one is using it. It might prompt you to rethink your strategy on how you are using tools in your organization optimally. Or, how you’re training your folks to use those tools. These types of insights are absolutely critical if you want to understand the best way to grow the individual in cybersecurity and make sure they are really on top of their game.
Q: How do non-technical employees improve their cyber readiness?
Here at Circadence we don’t just provide learning capabilities for advanced cyber warriors. For mid-range people just coming into the technical side of cybersecurity, we have an entire learning path that starts with a product called inCytÔ. Now, inCyt is very fun, browser-based game of strategy where players have some hackable devices that they have to protect, like operating systems and phones. Meanwhile, your opponent has the same thing objective: protect their devices from attacks. Players continually hack each other by gathering intel on their opponent and then launching different cyber attacks. While they’re doing this, players actual get a fundamental understanding of the cyber kill chain. They learn things like what reconnaissance means to a hacker, what weaponizing means to a hacker, what deploying that weapon means to a hacker, so that they can start to recognize that behavior in their everyday interactions online.
Some people ask why that’s important and I always say: “I used to be a bomb technician, and there is no possible way I could defuse an IED or nuclear weapon without understanding how those things are put together.” It’s the same kind of concept.
It’s impossible to assume that someone is going to learn cyber awareness by answering some questions or watching a five-minute phishing tutorial, after they have already clicked on a link in an suspicious email. Those are very reactive ways of learning cyber. inCyt is very proactive. And we want to teach you in-depth understanding of what to look for, not just for phishing but for all the attacks we are all susceptible to. inCyt is also being used by some of our customers as a preliminary gate track for those who are interested in cybersecurity. So you may demonstrate a very high aptitude within inCyt in which case we would send you over to our CyberBridge portal where you can start learning some of the basics of cybersecurity and see if it might be the right field for you. Within our CyberBridge access management portal, you can then go into Project Ares Academy which is just a lighter version of Project Ares.
Professional and Enterprise licenses in Project Ares pave more intricate learning pathways for people to advance in learning from novice to expert cyber defender. You’ll be able to track all metrics of where you started how far you came, what kind of skill path you’re on, what kind of skill path you want to be on. Very crucial items for your own work role pathway.
How to close the cybersecurity talent gap
Keenan’s perspective and the solution that is offered by Project Ares really helps to understand how to train security professionals and give them the hands-on experience they require and want. We’re in interesting times, right? With innovations in machine learning and artificial intelligence, we’re increasingly able to pivot from reactive cyber defense to get more predictive. Still, though, right now we are facing a cybersecurity talent gap of up to 4 million people depending on which analyst group you follow, so the only way that we are going to get folks interested in cybersecurity is to make it exactly what we have been talking about: a career-long opportunity to learn.
Make it something that they can attain, that they can grow in, and see themselves going from a novice to a leader in an organization. This is tough right now because there are relatively few cybersecurity operators compared to demand, and the operators on the front lines are subject to burnout, with uncertain and undefined career paths beyond tactical SecOps. What’s to look forward to?
We need to get better as a community in cybersecurity, not only protecting the cybersecurity defenders that we have already, but also helping to bring in new cybersecurity defenders and offenders who are really going to push the boundaries of where we are at today. This is where we have an excellent and transformational opportunity to introduce more immersive and gamified learning, to improve the learning experience and put our people in a position to succeed.
To read more about how to close the cybersecurity talent gap, please read this ebook.
For more information on Microsoft intelligence security solutions visit: https://www.microsoft.com/en-us/security/business