EWU earns rare NSA accreditation

CHENEY – Eastern Washington University has been named a National Center of Academic Excellence in Cyber Operations, according to an announcement from the university.

The designation comes from the National Security Agency, the federal agency responsible for collecting foreign signals intelligence and protecting U.S. government communications and information systems.

“The CAE-CO designation is rare, difficult to earn, and serves as a national signal that an institution is equipped to produce graduates capable of working on some of the most sensitive and technically demanding cybersecurity challenges,” Associate Professor Stu Steiner, director of the EWU Cybersecurity Institute, wrote in the announcement.

The CAE-CO designation opens the door to funding and student opportunities not available to other cybersecurity programs, according to the announcement. It also qualifies EWU for priority access to grants from the NSA and the Department of Defense, makes the school eligible for specialized research collaborations that involve sensitive material and strengthens its position for workforce initiatives by ensuring that its graduates meet the highest technical standards. For students, the designation means jobs and training in high-security environments and access to scholarships and internships at the NSA that other students don’t qualify for.

The designation opens doors to more than just the NSA. According to the cybersecurity job search site cyberseek.org, there were 13,027 jobs open in the cybersecurity field Tuesday in Washington state alone, and only 78 workers available for every 100 open positions. That demand has increased recently as world events have brought the cybersecurity field into even greater demand, Steiner told the Columbia Basin Herald.

“When the Israeli-Iran-US war broke out, there was (encouragement from the Department of War) to see if we could graduate students faster,” he said.

Obtaining the designation was no easy task, Steiner said.

“Last year we when we graduated students in June, we started the designation process, and it took from June until February for us to get the designation,” he said. “It’s a very complex, very scrutinized process.”

First, the university had to prove that its curriculum contained everything students would need to know to qualify, and match the graduates’ competencies up with what the Department of War would require.

“You have to provide labs, you have to provide graded homework … you have to provide transcripts of students to show they’ve taken the classes and they pass the classes. You have to map (those classes) to either the NSA framework or to the (War) Department’s workforce framework for cybersecurity.”

EWU also had to provide the NSA with detailed information about the students in the program: their grades, their homework, their extracurricular activities and how they did in cybersecurity competitions.

“It’s not just about coursework,” Steiner said. “It’s about actually applying that coursework in real-world situations through competitions and internships.”

Beyond that, the university had to prove that its faculty met the designation’s criteria, and that the university could screen its students to keep out hackers.

Many people think of cybersecurity as keeping thieves from stealing an individual’s identity or emptying their bank account, but that’s only part of the picture, Steiner said.

“We call that cyber defense,” Steiner said. “Cyber defense is both precautionary and reactionary. If you get hacked, you’ve got to get back into your system, get the hackers out and figure out why, and how long they’ve been in there. The other side of the thing is you’ve got to patch your machines. Microsoft releases new patches and you’ve got to update those. There’s new things coming out every day that you’ve got to make sure re installed on your systems.”

Besides defense, there’s also attack, which Steiner called cyber operations.

“In defense, you typically have a class like network security, which is setting up firewalls on in the system, setting up routing tables, stuff like that. In the cyber operations world, you have classes like reverse software engineering or reverse hardware engineering. You’re literally ripping hardware apart to find the vulnerabilities in it. You’re taking a piece of software that you didn’t write the code for and going through it and finding the vulnerabilities.”

The CAE-CO designation is a rare one. EWU is only the 22nd school in the nation to earn it, and the only one in the Pacific Northwest. According to the NSA’s website, it’s the only CAE-CO designated institution in 10 states: Washington, Oregon, Idaho, Montana, Wyoming, Utah, Nevada, Alaska, Hawaii and North Dakota. In fact, the only other CAE-CO-designated schools within 1,000 miles are both military institutes: the Air Force Academy in Colorado Springs, Colorado and the Naval Postgraduate School at Monterey, California.

This makes the program at Eastern very desirable to prospective students, Steiner said.

“In the last three years, we’ve gone from 24 (students) to 58 to 84 to 100,” he said. “We have grown significantly every year.”