I'm Mary Ann Kolbasak-McGee, executive editor at Information Security Media Group. Today I'm speaking with Steve Zuramsky, who is PP of IT and CIO at Bridgewater State University in Massachusetts. We're going to be speaking about some of the top challenges and issues facing educational institutions. So, Steve, we've seen many universities, colleges, school districts, academic medical centers, and other educational institutions hit with cyber attacks, including ransomware.
What cyber threats have you been keeping your eye on? Well, as you might imagine, ransomware continues to be an ongoing threat to a public higher education and really to all industries and sectors across the globe, but higher education in particular. In fact, there was a recent study put out by Microsoft where they claimed that higher education is actually the second most targeted sector for pre-wants and wear notifications. So, it's something that is on top of every CIO's mind, especially in higher red, and obviously that's no exception to healthcare or K-12 or really any other sector, but just given the nature of how public higher education works and higher education in general, whether it's public or private is, we're pretty open in nature and we possess a lot of sensitive information that's a target for threat actors.
So, that's something that we have to always be paying attention to. In terms of your own university, have you fallen victim to any cyber attacks or attempted attacks that you can discuss? And are there any top lessons that have emerged from any of these incidents or your misses that you think other educational entities could benefit from? Well, I can tell you this, Bridgewater is no exception.
We're always being attacked. Now, thankfully we've been able to thwart those attacks. However, it's something that we all have to pay attention to. Nobody is immune to cyber attacks.
So, the best things that we can continue to do is really just keep this top of mind, continue to invest on an annual basis and continue to increase our digital defenses and our cyber defenses, higher education across Massachusetts and really across the United States continues to be an active target for ransomware actors. And the best things that higher education can do is just really have strong cyber hygiene. The common defenses that we've been preaching about for a long time now, for decades now, continue to apply strong authentication, continuing to patch on a regular basis, having a strong cyber security training program, good backups, the concept of zero trust in least privilege. All of those really reduce the likelihood of a cyber attack.
And in some reports, I've read that it can reduce the cyber attack service up to almost 90%, just with those basic cyber hygiene controls. But unfortunately, as we all know, those don't always get applied. And that's where the threat actors get in. What kind of extra risk is thrown into the mix?
When you have a large student population, they bring their own devices, you might have maybe professors that maybe their part-time, you have maybe lecturers that come in from time to time that aren't part of the staff. What sort of challenges does that present? And what are some of the actions you're taking in that sort of area? Sure, that's a great question, Marianne.
And really, it is a threat. When you have, when, like I said, where higher education tends to be open in nature, we have even a small university could have 5,000, 10,000 user accounts. All of those need to be protected and secured. We have students bringing in their own devices, BYOD that those have to be protected.
We have faculty and staff. So it's a threat and it's a challenge. We have to, like we've been saying for a long time, it all comes down to defense and depth. So you have to have multiple compensated controls to help protect against all these different vulnerabilities and threats here.
And so we implement the concept of least privilege here at Bridgewater State. We have multiple security controls that we put in place to try to help reduce the attack service on any BYOD device, but it really comes down to education. And I think that's something that a lot of organizations really need to start to share a different kind of message. It's not just about rolling out a security awareness training program.
It's really about educating folks that what you learn on how to protect yourself doesn't just apply at your institution or at your work. It also applies to your digital life. And when we start to understand that this impacts all of our digital identities, that's when I think people start to understand the point that we have to start paying attention here and we really need to be careful. So now Steve, I also understand that your university is developing a cybersecurity program with financial support from the Commonwealth of Massachusetts and also the federal government to train future cybersecurity professionals.
What can you tell us about the program? How much funding did BSU receive? And how might this program address the cyber skills storage that we hear so much about? Yeah, this is a really exciting program.
We have at Bridgewater State. We're really proud of it. It actually started a couple of years ago when we started to pursue a couple of different grants both from the state and at the federal level. Our focus was on investing what's called a cyber range and a cyber range we look at as a virtual cybersecurity simulator.
So it allows students and other cybersecurity professionals to experience real live fire attacks, but in a safe virtual environment so that they can learn how to defend protected and recover. And so Bridgewater has received $4.5 million both from the federal and the state level to build out our brand new cyber range which is scheduled to open up in January of 2024. So this will be a physical facility though we can allow people to come obviously in person and participate remotely, but it allows students, municipalities, non-profits, private, public sector, military, anyone really to come in and experience and learn and train as a team or individually to improve their overall cyber skills. And so Bridgewater has academic programs in cyber plus we have our new cyber range and what's really innovative for us is that we're partnering with Commonwealth to open up a security operations center or SOC at our main campus here in Bridgewater.
That SOC is going to be used to monitor municipalities in the area and our students are going to be working in the SOC alongside seasoned cybersecurity professionals. So this is pretty innovative for Bridgewater and we think it's pretty innovative for the industry where you have an academic program, then you have hands-on experience in the cyber range and then you have the hands-on experience working in the SOC and that equals job. So it really helps fuel the talent pipeline in Massachusetts. So what sorts of organizations will the SOC be lending cyber security support for?
You mentioned municipalities. I know also obviously the Boston area at large is a big healthcare and medical community. What sort of organizations will be depending on some of your services? Certainly and I should repeat that this is in partnership with a great organization called Cyber Trust Massachusetts which is a nonprofit recently formed in the last year and a half within the Commonwealth.
Bridgewater stays a proud member of Cyber Trust Massachusetts and so in partnership with them we will be operating the SOC here at Bridgewater. Our main focus at this point as we launch is municipalities and nonprofits. We will then as we start to grow and mature expand to include small businesses and other businesses. We're not operating yet.
We're in the design phase right now. We're going through all the planning phases but our hope is to have the cyber range fully operational by the end of the calendar year 2024. And as you talk to employers and prospective employers for the students that are attending your institution and perhaps participating in the cyber security program what sort of skills are you hearing most about that or need? What sorts of talent are the employers seeking or hoping that you can train for them to be able to tap into?
What we're hearing from employers is they're starving for talent. That's really when it comes down to lots of data out there that shows according to CyberSeek there's almost 600,000 cybersecurity positions open nationally across the US and in Massachusetts alone it's about 18,000 open cybersecurity positions. So that just shows the demand for the cyber talent across all different industries. What we've heard from employers is that our graduates need hands-on experience.
They're not higher education alone just going through and getting a degree without the hands-on experience is not sufficient for employers. They want that hands-on, which is why Bridgewater developed our model here with the academic programs, the hands-on experience and the cyber range, and then the actual real hands-on experience working in the SOC. So they want hands-on experience, they want talent. It doesn't really come down to a specific area of focus in my opinion because it really is people are trainable as long as people are thirsty for knowledge and they have a strong background and they're willing to learn.
That's the most important thing. And finally, Steve, what's next for the program? What else are you looking to do when it comes to the cyber space area? Well, we're going to continue to expand our academic programs here at Bridgewater so we have a bachelor's degree, a brand new bachelor's degree that's going to be launched later this year.
Bridgewater is actually going to be the first public higher education institution in Massachusetts to have a fully accredited degree in cyber security. So we're pretty proud of that. We're also working on launching a full master's degree in cyber security. That's going through the governance process right now and will be come out within the next year.
And we also have certificate programs in cyber. So we want to make sure that we're serving all everybody from whether it's a traditional age student to adult learners. So our focus will be on cyber security certificate programs, industry certifications, and we're also going to be offering, actually, we are offering right now, just our second cohort programs specifically designed for municipalities so that we can upskill those folks and have them better prepared to protect their themselves. Well, thank you so much, Steve.
I've been speaking to Steve Zuranski. I'm Mary and Colbus at McGee of Information Security Media Group. Thanks for joining us.