Back to school: Meet NIST's leader for national cybersecurity education

Even though you may not have read much about him, Ernest McDuffie is central to the government’s overall bid to improve cybersecurity nationwide.

McDuffie leads the National Initiative for Cybersecurity Education (NICE) that’s being coordinated by the National Institute of Standards and Technology (NIST). The Obama administration said it started NICE earlier this year to expand from a federal to a national focus the cybersecurity education programs started under the Comprehensive National Cybersecurity Initiative (CNCI). That program began during the George W. Bush administration.

A need for improved education is chief among the challenges that experts cite for U.S. computer security efforts. The administration said the decision to expand the government’s computer security education program and make NIST its overall coordinator is in response to the White House’s review of cyberspace policy, released in May 2009.

NICE consists of four programs led by different departments and agencies with NIST playing coordinator. Together the programs, if successful, could lay the foundation for the government’s future computer security abilities.

Under NICE the Homeland Security Department is in charge of the part of the effort to boost national cybersecurity awareness, while the job of bolstering formal cybersecurity education programs falls to the Education Department and the White House’s Office of Science and Technology Policy. Meanwhile, the Office of Personnel Management is tasked with ensuring that federal agencies can attract, recruit and retain cybersecurity employees. Professional development programs for the existing federal cybersecurity workforce are left to the Defense Department, the Office of the Director of National Intelligence and DHS.

McDuffie’s job is to get these different agencies – with otherwise different agendas – to work together to make the country’s computer networks more secure. Previously, McDuffie worked at the National Coordination Office for Networking, and Information Technology Research and Development. McDuffie said that agency is responsible for coordinating $4 billion worth of budgets for unclassified research and development programs related to networking and information technology for 17 agencies governmentwide.

Although the different agencies have been working on parts of NICE for sometime, the coordinated program was just announced in April and is still in its early stages. NIST held a workshop for feds, industry and academia to learn about NICE on Aug. 11 and 12 in Gaithersburg, Md. McDuffie said there were about 160 people at the workshop.

McDuffie spoke with Federal Computer Week today about that recent conference and goals for NICE. Here are some excerpts from that conversation edited for length and clarity.

FCW: How much funding does NICE have?

Ernest McDuffie: It’s really kind of up in the air in terms of what the funding levels are going to be … it’s not really clear as we’re going through this transition period how much funding from the previous level is going to carry over into the new regime. We’re currently working on [fiscal 2012] budget build exercises.

But, I guess in general, the safe number is probably $18 million a year is about what the funding level is for [fiscal 2010] for the unclassified portion of NICE.

FCW: How is that $18 million used?

McDuffie: There are a lot of programs that are ongoing. There’s training that’s already out there. ... DHS, for example, [Defense] are already engaged in various programs that are up and running. ...[The funding] is spread over a number of areas ... each agency has its own lines right now, but it’s all kind of still legacy programs from the previous CNCI effort. We’re in the process of changing that over into a unified NIST initiative and it’s really not clear at this time whether the funding lines will remain as they were or whether there will be a new single funding line that’ll just come through NIST and then out to the other agencies or some combination of the two. Those discussions are ongoing right now.

FCW: How do you think funding for the program will change?

McDuffie: In the federal government we’re always a couple of years ahead. The [fiscal 2011] issues were already in the books before I came on board so there wasn’t an opportunity to ask for new funding in FY2011. ...Our real first opportunity to get new funding is going to be in the FY 2012 [budget].

FCW: Do you have any idea of how much that might be?

McDuffie: We certainly feel like we could spend – if you’re going to have a national program – you could put a lot of resources behind that. But, under the current budget picture of the federal government that’s not going to happen, we’re not going to get $100 million, you know, to jump up and start doing things all over the place. So we’re looking for pretty modest kind of increases over the $18 million baseline.

The good news though is that we are receiving major support from the White House. [White House Cybersecurity Coordinator] Howard Schmidt’s office has identified this initiative and there’s one other initiative dealing with identity management as his priority areas for cybersecurity, so there’s a strong likelihood that we will get additional funding. We just don’t have a good clue as to what the level is going to be.

FCW: What does NIST bring to the table as a coordinator and why do you think it was chosen?

McDuffie: NIST has got vast experience and a footprint already with the private sector because of the work NIST does in standards both nationally and internationally. We’ve been engaged for years with activities happening at private industry and international standards organizations around the world. NIST has already been heavily involved in cybersecurity.

Those agencies currently have budget lines that are coming directly to them to support these efforts. So it’s not like NIST has taken control over parts of these other agencies' budgets and can say ‘thou shalt do what we say because we control the purse strings.’ We have to find a way to be a value-added and convince them that the way we want to do it is going to best for them and for the consolidated effort. ... It’s kind of our job as the coordinating group ... to look across the tracks to see where the areas of overlap are, and where there are gaps that aren’t being addressed at all and bring those to the table and everybody’s attention so that they can be addressed in a systematic way that makes sense for everybody.

FCW: What are your goals for the program?

McDuffie: Six months out I think I’d like to see all of our tracks up and running and fully integrated with well-established timelines and milestones for what we’re going to achieve in the one-year, two-year, five-year time range. We’re going to be pretty much focused, I think, in the near-term on the tactical issues, the day-to-day operation of what we’re doing and thinking about and planning for the strategic long-term view of where we’re going.

FCW: How will you determine if NICE is a success six months, one, two and five years from now?

McDuffie: That’s kind of the biggest challenge in all cybersecurity issues: How do you measure secure? Is your system 80 percent secure? Ninety percent secure? Nothing is 100 percent secure. ...One of the things we’re going to be developing is some kind of meaningful metrics for people to apply to their systems.

I think a long-term goal is we want to improve the security posture of the entire country. We want to improve the awareness of the entire country. We want to have measures in place that people will recognize as real measurable [items]. ...We’re in the process [of] coming up with actual measurable, definable things that say if this number goes up then we are moving in the right direction. Certainly, an easy kind of metric is just the number of people that we generate [in terms] of new students, new professionals coming in the federal service.

FCW: What did you get out of the recent conference?

McDuffie: The biggest highlight for me was the level of enthusiasm and passion, not only from my people here, but that we were getting from the group that came together. We had a really good mix of demographics of who attended the conference. ... About a third of the people were federal government types, about a third were from the academic world, and another third were from industry. So that was exactly what we were shooting for ... I didn’t hear one negative comment ... everybody agreed that this was a needed mission and were very anxious to engage and assist us in the process.

If there’s any big highlight it was that the community at-large seems to be on the same page, that we need this kind of asserted, concerted, coordinated effort where the federal government can be an enabler, if you will.

The real theme of the whole workshop is that we can’t do it by ourselves. No one agency within the federal government can do it alone, in fact, the whole federal government can’t do it by itself. It has to be partnerships between ... academia, industry, government, working together toward the same goal for us to really have a positive impact across the country. I think that message resonated very well with all the groups