Breaking the System

Within a self-contained room at Reynolds Hall, 10 workstations, five servers and a smart TV – all connected to a secure, isolated network of its own - power the next generation of cybersecurity warriors. 

Students learn, in real-time, how to thwart malicious cyber attacks by “doing” – not by listening to lectures or reading textbooks.

It’s the sort of experiential learning space needed for aspiring cybersecurity specialists to get a leg up on the everchanging landscape of software, systems and network threats.

The sort of a space that Karen S. Evans, a cybersecurity guru who’s served under two presidential administrations, believes will not only benefit West Virginia University Chambers College students but will fill voids in the cybersecurity fields.

“I’m an applied learner myself,” said Evans, a three-time presidential appointee and U.S. Senate-confirmed executive with more than 30 years of experience in cybersecurity. “The No. 1 issue with grads coming out of college is that they’re equipped theoretically but they have zero hands-on experience. They don’t know how to do the work. It’s one thing to know the work, but it’s a different thing to do the work. Having this lab will address those workforce issues.”

Now managing director of the Cyber Readiness Institute, which empowers small and medium-sized organizations with free resources to enhance cybersecurity, Evans, along with her late husband, is the namesake for this game-changing space – the Dr. Randy and Karen S. Evans Cybersecurity Lab.

Chris Ramezan, assistant professor of cybersecurity, oversees the lab and is putting it to great use. Ramezan and fellow faculty bring students into battle with what they call “Red Team vs. Blue Team exercises.” In the cybersecurity world, red teams are on offense and attempt to attack and break into systems. Blue teams play defense, guarding the network against cyber attacks and threats.

These scenarios give students a glimpse into the real world of cybersecurity.

“The best way to understand how to secure a system is to first learn how to break a system,” Ramezan said.

Live Fire Leadership

Since 2006, WVU has held the National Security Agency and the Department of Homeland Security’s designation as a National Center of Academic Excellence in both cyber defense education and cyber defense research.

The Evans Cybersecurity Lab serves as WVU’s lead training ground for preparing students for Operation Locked Shields, an international exercise run by NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, Estonia. In this live-fire exercise championed by WVU Vice President for Economic Innovation General James Hoyer, students enhance their skills in defending national IT systems and critical infrastructure. During these events, students also get to work with some of the nation’s top cybersecurity experts.

Ramezan’s work led him to being named the academic lead of the 2024 NATO Locked Shields exercise by the chief of staff of the Joint Force Headquarters. Ramezan also helped the U.S. national team earn a 4th place ranking in the 2020 NATO Locked Shields exercise, one of the highest rankings the team has ever received in the competition.

Beyond competitions, students tap into the Evans Lab to develop and evaluate machine-learning algorithms to assist with providing insights on cybersecurity problem sets, conduct security assessments on converged information technology and operational technology environments, and evaluate the security of industrial control systems. 

“In fact, we are probably one of the only business schools in the world that has a class on industrial control system security and operational technology security,” Ramezan said. “It’s one of the many things that makes our program unique, and another example of how WVU is going first, and leading the nation with its innovative cybersecurity programs and research.”

Securing the State

In addition to serving as a premier training ground for building the next-generation cybersecurity workforce, some of the workstations are also devoted to conducting cutting edge basic and applied research on machine learning and artificial intelligence applications in cybersecurity.

“Looking ahead, we are excited about the potential of our lab as we work towards building a cluster that will integrate both cybersecurity and AI research,” said MJ Ahmad, teaching assistant professor of cybersecurity. “This goal is to create a dynamic space where cutting-edge technologies can open new avenues for innovative research and discovery. Our lab’s potential is immense, promising a future where it stands at the forefront of cybersecurity and AI advancements.”

And the benefits reach beyond the student. Frank Hatten, a cybersecurity analyst and adjunct professor at the Chambers College, said one of the lab’s missions is to serve West Virginia and small businesses.

“We do a lot of outreach initiatives within the state,” Hatten said. “We’ve partnered with small businesses to help them solve real-world business cybersecurity and technology problems that they have.”

An art shop, Bloom, in Thomas, West Virginia for example, had troubles with its network and wifi coverage due its building’s thick brick walls. Chambers College MIS and Business Cybersecurity students went there to assess, measure and map out the building before developing a whole new network architecture that’s now up-and-running and accessible at the business.

“Students used software to insert building blueprints and measurements to map out where wireless access points should be for optimal wireless coverage,” Hatten said. 

Another small business received simple tips and tricks from students in keeping its network secure.

“One business stored all the passwords underneath a keyboard at the front register,” Hatten said. “That’s a big no-no, right? But we find that happens a lot. 

“We’ve helped other businesses with their firewalls, analyzing potential security breaches and malware, and better understanding the traffic that flows through their networks.”

The Human Equation

While a focus of the Chambers College Business Cybersecurity program and the Evans Cyber Lab centers on assisting communities and businesses statewide, students have even had the opportunity to work with national entities including the U.S. Department of Defense, the MITRE Corporation and Leidos.

Kennedy Hawkins is just one of many students who’s already benefited from the lab. A native of West Grove, Pennsylvania, Hawkins earned his undergraduate degree in Management Information Systems in May 2024 and is now a Business Cybersecurity Management master’s student.

He credits the lab for equipping him with the skills to build upon his future endeavors. While attending grad school, Hawkins is also working as an IT/cybersecurity intern at the Civil-Military Innovation Institute (CMI2), a nonprofit that bridges gaps in defense innovation to support military units and service members.

“I work in a lab very similar to the Evans Lab at Chambers,” Hawkins said. “We work with real world tools to provide training, innovation and research to the Army National Guard and other government entities.

“The cybersecurity programs in the Chambers College at WVU has prepared me for the future by integrating practical, real-world examples into our training. The specialized hardware and hands-on experience we gain in the lab significantly increases our understanding of cybersecurity.”

So far, the lab is hitting the targets that Evans envisioned.

All throughout her career, Evans witnessed the evolution of technology in the business world. That is why she shares Ramezan's belief that cybersecurity is a business issue, not just a technology one. And that is the core vision of the program.

“Businesses can fall to ransomware and other external factors,” Evans said. “What a better place to have a space and program that addresses those issues than the business school. There’s not one company out there today that isn’t using tech, and you’ve got to know the risk associated. And if you’re a business owner, you have to hire people who know the tech.”

Evans also views the cyber world through a human lens. Despite ever-changing technologies, people need to be part of the equation.

“It doesn’t matter how good the tech is,” Evans said. “You’ve got to have the human factor.