Boise State University master’s student Madilyn Bosselmann knew she was in the right field when an overwhelmed manufacturing company in Idaho needed her help completing a complicated U.S. Defense Department cybersecurity certification.

The small company had become overburdened trying to comply with the program’s strict cyber rules, and momentum on the effort slowed before Bosselmann arrived.

“I was able to step in to reassess where they were, outline what standards still needed to be met, describe how to meet these standards and then assist in remediating and mitigating some of these risks,” Bosselmann told Recorded Future News.

Bosselmann is one of several students that took part in the Cyberdome initiative — a competency development program from Boise State’s Institute for Pervasive Cybersecurity. The program, which began in 2021, has been a massive success for dozens of cybersecurity students and thousands of people across Idaho.

The school partnered with cybersecurity company Stellar Cyber to help provide hands-on work experience to students by providing cybersecurity services to rural Idaho districts, counties and cities, said Edward Vasko, the director of the institute. Students have helped secure rural K-12 schools, county election systems, and critical water and electric systems for cities.

The program comes at a time when there is a desperate need for cybersecurity talent across the U.S. but especially in rural areas where public and private organizations can rarely afford the kind of cybersecurity tools or protections needed to address the emerging array of threats.

Marty Gang, chief technology office for Lewis-Clark State College, said his school would not have been able to afford the kind of resources they got as clients of the Cyberdome program.

“We have not been able to access a lot of expensive equipment and software, and Cyberdome has provided access to a large number of good resources. Being provided insight into activities on our network that we didn’t have visibility into before has been very useful,” Gang said.

Dan Smith, technology director for Kendrick Joint School District 283, said the coverage he obtained from Cyberdome was “a critically needed service, especially for the K-12 space.”

“We absolutely need this, especially for smaller districts,” he said. “We now have this overarching product and support system in place that is actually looking out for us.”

‘In the seat’

From January to July 2023, Cyberdome students monitored over 5,000 assets, analyzed over 53,000 possible incidents, and notified clients of 350 potential real-time attacks. Cyberdome staff and student workers are able to monitor systems for clients, ensuring that communities in Idaho and school districts have the information they need to stay secure.

In addition to the services it provides to organizations in need, the program has become a pivotal resource for students at Boise State University eager to enter the cybersecurity field.

Vasko told Recorded Future News that since the program started in July of 2021, they have had more than 70 students participate — with their goal being about 35 to 40 students each calendar year.

Every 90 days they hire a fresh group of students, allowing them to tackle client problems in waves to ensure there is no drop in the quality of their work.

“The six-month internship the students have with us starts with a short six-week baselining of knowledge and skills, followed by four and a half months of live, ‘in-the-seat’ work as either a cybersecurity defense analyst or cybersecurity engineer,” he explained.

“Once they move into the role, they are actively involved in examining and determining whether alerted traffic is a false (or real) positive. If an alert warrants client notification, our students are writing up the details of the alert for multiple audiences to consume.”

Vasko said the response from students has been positive, noting that many have said the internship — provided by grants from the Idaho Global Entrepreneurship Mission’s Higher Education Research Council (IGEM-HERC) and Idaho’s Workforce Development Council — is unlike any other they have participated in. The students are conducting real work, in a live environment, in roles they are looking to take part in once they graduate, he added.

Cyberdome is not a degree or certificate program and they are not holding any classes. Instead, the goal is to provide students with an “experiential environment” that provides them with real-world experience.

“My best metaphor would be that we’re not a student newspaper where students get credit but the audience is limited. Instead, we are a regional paper that gives journalism students experience before they graduate with a degree in journalism,” he said.

Vasko and several students told Recorded Future News that the program provided them with valuable, on-the-ground experience that not only excited them about the field but taught them necessary lessons they can use moving forward.

Sean O'Toole, a computer science student graduating in the spring, said after several days of training, he and other new analysts became concerned about reports of a series of incidents.

“We were confident that we were seeing a malware infection of surprising scale, and at the very least we knew that there was a consistent pattern of alerts to be addressed. But while we turned out to have caught bad actors, we eventually realized that we were probably actually seeing students using a VPN to skate around the filters on their network — not some massive ransomware infection spreading across multiple networks,” O'Toole said.

“It was a funny (if a touch embarrassing) moment that brought us back to earth and gave us a much better understanding of what to look for and how to study the networks and traffic we want to protect.”

Cameron Reid, who graduated in December, said one of the things that stood out most was the ability to create monthly reports for clients that allowed Reid to gain a deeper understanding of their network.

“[It] really makes me feel like I am helping and making a difference,” Reid said. “I really enjoyed being able to sit in on the client meeting, I feel like I was able to see how the client was helped directly from us and how we could help them more in the future. Having hands-on experience with clients and documentation has been very beneficial for me.”

Bosselmann, who also graduated in December 2023, joined the program in May 2022, the same day she started her master’s degree.

She had almost no exposure to the world of cybersecurity when she started. But through the program, she was able to conduct onsite risk assessments, co-author analysis reports and help clients remediate or mitigate identified vulnerabilities.

In the summer of 2023, she was able to lead a project where students created a virtual city that could be used for red and blue team activities. She told Recorded Future News that she gained a wealth of knowledge about NIST requirements and other key tools used widely across organizations.

Broader appeal

The program is a partnership between Boise State University and Stellar Cyber, which provides students with the software and tools they use. The students provide Sellar Cyber with feedback about their products and their work with the platform gives them first-hand knowledge of the technology provider market.

Another cybersecurity company, Sophos, announced that it will also provide its endpoint security products to the Cyberdome program.

The program, a partnership between Boise State University and Stellar Cyber, has attracted the interest of other cybersecurity companies. Joe Levy, president and chief technology officer at Sophos, said his company will provide its endpoint security products to the program to help students “learn critical skills and protect organizations from attacks.”

Vasko said he is hoping the program can double the number of students involved and offer additional roles for advanced students — such as threat hunting, digital forensics, and other needed cybersecurity workforce areas.

“There’s a huge shortage of cybersecurity analysts worldwide, and through our partnership in Boise State University’s Cyberdome program, we’re helping address that issue,” said Jim O’Hara, Chief Revenue Officer at Stellar Cyber. “We knew this program would be a hit, and it’s a model that can be applied to any geography.”