An increasing number of government entities across the United States is looking for ways to improve cyberdefenses. The Florida Center for Cybersecurity at the University of South Florida, or Cyber Florida, is partnering with SimSpace to train the Sunshine State’s 1 million state and local employees in cyberdefense tactics, using military-grade cyber ranges.
"One of the important things that the military focuses on is conducting mission rehearsals. Practice it before you do it," said SimSpace CEO and former Air Force Col. William "Hutch" Hutchinson. "In the real circumstance, that obviously is something that the private sector or the commercial sector could use as well."
Hutchinson served as an F-15 fighter pilot and trained in Red Flag exercises. The drills were created after the Vietnam War to improve combat readiness.
CYBERSECURITY EXPERTS SOUND ALARM OVER US POWER GRID VULNERABILITIES
"One of the lessons learned was if you survived your first 10 combat missions as a fighter pilot, your chances of success dramatically increase," Hutchinson said. "So, they created an exercise to duplicate those first 10 combat missions."
Hutchinson took that training to the U.S. Cyber Command to lead similar exercises called Cyber Flag.
"The idea was to provide insights to commanders on how we would fare in a future cyberconflict," Hutchinson said.
Now as CEO of SimSpace, Hutchinson helps train civilians across the public and private sector using military-style training.
"It’s the public-private partnership," said Rep. Mike Waltz, R-Fla. "The military is having a hard time, as is some of these organizations like Cyber Florida, attracting people who sit up all night and drink Red Bull and are hacking. I think the middle ground is often the reserves, where you're learning those civilian skill sets, which are often way outpacing government in terms of the new technologies and the type of people they recruit."
In recent years, dozens of state legislatures, in addition to Florida, have passed laws to boost cyberdefenses. Michigan first launched the concept of a volunteer cybersecurity reserve force in 2013. Wisconsin, Ohio, Texas, California and Maryland have all created similar reserve programs. Other states like Oklahoma and Arizona have state cyber commands that protect state information systems and data.
"The threat is significant. If you're thinking about the future and major combat between near pure adversaries, probably the next first strike in anything like that, it's not going to be like Pearl Harbor. It'll be a cyberattack," said Sen. Mark Kelly, D-Ariz. "Our adversaries out there, whether it's China, Iran, Russia, now North Korea has invested heavily in this. We've got to do a better job producing the workforce that's going to defend this nation."
SimSpace CFO James Gerber said Cyber Florida has expanded beyond what many other states are doing by offering individual training in academically supported practice environments.
"They can focus really on configuring for the latest types of severe events that the governor and mayors want to know that they're ready for. And it's providing those answers with confidence," Gerber said.
The cyber ranges are interactive, simulated platforms. They replicate scenarios for different parts of the government like health care or energy, based on the threats those sectors may face.
"Ten years ago, there were some viable options, but nothing like what we see today," said Cyber Florida's Cyber Range Director Bruce Caulkins. "That really helps the users to understand what's going on with their systems and their networks and how to react properly."
State and federal governments have experienced worker shortages when it comes to cyberdefenses. Lawmakers also say both the public and private sector have faced hurdles in recruiting talent.
"There's a lot of openings. The challenge is getting people into those what are often thought of as STEM programs," Kelly said. "We worked on this bipartisan with the Chips and Science Act. We need to do more of that specifically for cyber and also Arizona."
The federal government is working to boost its cyberdefenses, too. The fiscal 2024 National Defense Authorization Act includes an effort to establish a civilian cybersecurity reserve to help agencies respond to cyberattacks.
"We just in the last defense bill just stood up a civilian cybersecurity core that will be that bridge between [the] civilian tech world and military national security, Homeland Security world, and bring those two together," Waltz said.
Waltz said increasing partnerships with the private sector is crucial in defending against adversaries like China.
"We can't play perfect defense," Waltz said. "We are trying to bat 1,000 and not let anything through. I think for China especially, we need to take a mutually-assured-destruction approach like we did with nuclear weapons years ago in that we can shut down your economy, too, and your critical infrastructure. So, you better not shut ours down."
