Cybersecurity

George �鶹��Ƶ student project presents sticky situation for hackers

Teresa Donnellan — Wed, 17 Dec 2025 20:56:10 +0000

George �鶹��Ƶ student project presents sticky situation for hackers Teresa Donnellan Wed, 12/17/2025 - 15:56

When a cloud computing class at �鶹��Ƶ called for a team project, master’s student Kevin Landry saw an opportunity to share what he knew and give classmates a taste of real-world cyber defense.

A seasoned cybersecurity enthusiast, Landry introduced his team to the concept of a honeypot—a decoy system designed to lure and monitor cyber attackers. As he put it, honeypots allow you to “reach out and touch actual attackers,” bringing textbook concepts to life in a way few classroom exercises can match.

“You’ll never look at the internet the same way again after running a honeypot,” Landry said. “It’s eye-opening to see how many bots are out there scanning for vulnerabilities.”

For his teammates—many of whom had never built home labs—the project offered hands-on experience that mimicked an enterprise environment and bridged the gap between theory and practice. Honeypots aren’t just academic tools; companies maintain them to study hacker activity, identify patterns, and share intelligence that helps reveal common vulnerabilities.

Kevin Landry. Photo provided.

“It’s a low-investment, high-yield product that’s passive,” Landry explained. “You do all the coding and setup, then just let it run and watch attackers come in.”

The team deployed Cowrie, an open-source honeypot that simulates a Linux shell. But Landry didn’t settle for the default configuration.

“I changed every standard setting possible,” he said. “Fake encryption keys, fake password files, fake directories—everything to make it look like a lazy or incompetent sysadmin left the doors open.”

Those tweaks made the trap convincing enough to attract hundreds of attackers, from automated bots to human hackers.

Once customized, the honeypot started buzzing—logging intrusion attempts almost immediately. To make the experience even more interactive, the team integrated real-time alerts through Discord, receiving up to 500 notifications a day whenever an attacker engaged with the system.

At one point, the attack volume was high enough that Discord temporarily rate-limited the alerts, thinking they were automated traffic. Landry resolved the issue by rotating through multiple webhooks and fine-tuning the alert frequency to keep everything running smoothly.

Over the course of 48 days, the honeypot captured an extensive dataset. Landry even created an interactive visualization of the activity for the team’s class presentation, showing where attacks originated and how they unfolded over time.

To make the project even more aligned with industry practices, Landry’s team uploaded the attackers’ IP addresses to Gray Noise Intelligence, a company that allowed him to use its enterprise-grade platform for the project. The software analyzes IP addresses and assigns confidence levels indicating how likely each one is malicious, giving students a window into professional threat intelligence workflows.

“It makes me feel good that I’m wasting hackers’ time or bots’ time,” Landry said.

For Landry—who served ten years in the U.S. Coast Guard and earned a bachelor’s degree in computer science from the University of Mary Washington before pursuing his master’s in applied information technology at George �鶹��Ƶ—the honeypot was both an academic milestone and a career-building moment. He believes projects like this are essential for breaking into cybersecurity.

“Cybersecurity jobs—even entry-level—want three years of experience, but you can’t get experience without getting a job,” he noted. “Home labs and projects like this help build a portfolio and show employers you can do the work.”

As cyber threats grow more sophisticated, George �鶹��Ƶ’s applied approach to technology education ensures students are ready to meet them head-on. For Landry, the honeypot was not only a class assignment but also a chance to turn passion into practice—and to share that experience with others.

An image from the interactive visualization of the project. Full visualization available here: https://gemini.google.com/share/24b205428724.

Topics

applied information technology graduate programs

Cybersecurity

innovative classes

Students

Cyber security engineering student excels at his internship for the second time

Shayla Brown — Mon, 06 Oct 2025 14:15:06 +0000

Cyber security engineering student excels at his internship for the second time  Shayla Brown Mon, 10/06/2025 - 10:15

When �鶹��Ƶ cyber security engineering student Noah Hinger interned at Surefire Cyber in summer 2023, his managers were so impressed with his work that they invited him back. Thanks to his previous experience, the Honors College student was able to take on more responsibility this summer at the computer security company and contribute to more projects.

“The experience from my first summer here let me understand what was happening and contribute across the company,” said Hinger, who is a sophomore in the College of Engineering and Computing. “Surefire Cyber has an amazing internship program. They're investing in us by having professional development meetings and providing us with the opportunity to talk to experts from different fields.” said Hinger.

“I think it’s helped me a lot to be able to practice my independence and accountability,” said Hinger, who also competes in George �鶹��Ƶ’s Chess and Competitive Cyber Clubs. “I've had the chance to do projects on my own without necessarily needing to report to someone, and I've also learned so much from all the smart people at Surefire Cyber.”

Noah Hinger. Photo provided.

What made you choose Surefire Cyber for your internships? 

Surefire Cyber is a digital forensics and incident response company. When an organization gets hacked, they call Surefire Cyber to conduct an investigation and restore systems so that everything's OK. As a technology intern, I am helping develop the code that our forensic analysts use to figure out what's happened and retrieve all the essential data. Surefire Cyber is really exceptional at using a lot of automation tools so that the forensic analysts can focus more on the big picture and the data they’re working with. 

What does a typical day interning at Surefire Cyber look like for you? 

I work under two groups: software development and information operations, or DevOps, and security engineering. For DevOps, I help to manage company infrastructure and work on a lot of coding assignments. 

Traditionally, there are software developers, and there are operations, which maintain it. DevOps is kind of a hybrid role, which means it entails coding, setting up servers, and being responsible for maintaining the infrastructure. 

How would you say George �鶹��Ƶ has helped prepare you for this role? 

I definitely think more critically when problem-solving this time around, and I think that's in part due to George �鶹��Ƶ, especially the Honors College research and literature classes that I’ve taken. I'm learning about a lot of new technologies in real time, so I have to be able to research and read about them and then apply that knowledge to my work. The courses have definitely helped me when it comes absorbing the information I’m reading about and then transferring it to my assignments at Surefire Cyber. 

Another thing about the Honors College is that I get to meet different people from different disciplines, and that's really helped me at Surefire Cyber when connecting and networking with colleagues. I think that's been really rewarding and something that George �鶹��Ƶ's helped prepare me for. 

I've also gotten a lot of experience in my systems engineering and digital systems engineering classes, and getting to see what goes into a lot of security minded decisions is very similar to what I’m doing in this internship. 

What’s your favorite thing about interning at Surefire Cyber? 

My favorite thing about the company is that it’s always driving innovation and new discoveries within cybersecurity and digital forensics. They're always pushing for the best and trying to help people. That's the whole point of digital forensics is to be there for and helping them out on the worst day of their life. 

Explore Internships

Topics

Internship

Cybersecurity

Honors College

�鶹��Ƶ Competitive Cyber

College of Engineering and Computing

Students

CEC students

George �鶹��Ƶ’s Chief Information Security Officer protects the keys to the kingdom

Lauren Reuscher — Thu, 04 Sep 2025 14:42:10 +0000

George �鶹��Ƶ’s Chief Information Security Officer protects the keys to the kingdom Lauren Reuscher Thu, 09/04/2025 - 10:42

Matthew Dalton joined �鶹��Ƶ as Chief Information Security Officer (CISO) in May, bringing more than 25 years of experience as a cybersecurity leader at R1 institutions. In his new role with Information Technology Services, he will provide vision and strategy for information security at Virginia’s largest public research university.

We sat down with Dalton to learn more about today’s cybersecurity environment and how students, faculty, and staff can make sure they’re staying “cyber smart.”

Matthew Dalton, chief information security officer, �鶹��Ƶ. Photo by Ron Aira/Office of University Branding

What does information security entail, particularly in a higher education setting?

One of the main responsibilities of my role is to help set the cybersecurity strategy for the university, allowing the flexibility and freedom necessary for creative, educational, and research endeavors, while preventing the negative impacts of cybersecurity events.

Information security is about managing the risk to the community, their data, and the systems they rely on, as well as the risks that are presented to the university from everyday events, malicious actors, and nation-state threats. Depending on the kind of information that a person possesses or accesses online, the threats can be very different across the university.

You have led information security at several different institutions. What drew you to a career in higher education, and specifically to �鶹��Ƶ?

You could say that higher education is in my blood. Many of my family members have worked in education. There are family stories that my great-grandparents on one side met because they taught at the same college. In my immediate family and closer generations, many of them met at the same college and went on to careers that stressed the value of education.

For me, the brightest possible future comes through education, learning about others' experiences, and using our combined experiences to find a better path forward. I think that �鶹��Ƶ is one of the best examples of that in action.

What are the biggest changes in cybersecurity in higher education since you first entered the field?

I have seen two big changes. The first is the change from believing that individual researchers or departments at a large institution should manage information security requirements on their own. These days, it takes a coordinated effort across many different parts of the university to protect the information assets effectively.

The second change is the need to bring information security closer to the individual person, rather than just the device or network that they are using. Early on, the computers were massive, and protecting the room that they were in may have been sufficient. Today, user credentials are the keys to the kingdom, and getting access to those unlocks the data that is everywhere, thanks to the cloud.

How do you work across other departments to reduce risks to the university?

With information technology embedded in everything across the university, it is essential that the security program works across the university as well. It’s more than just helping people not to click on that suspicious email; it’s about learning what they do in their role, so that the protections we put in place can complement, rather than compete with, their activities.

How does artificial intelligence (AI) factor into your role as chief information security officer?

Just like technology in general, AI is a force multiplier. You need to consider how AI can be used by people who are meaning ill intent just as effectively as it can be used by those who are trying to protect.

It is important that AI be adopted into our strategy both from a threat-modeling perspective and how to deploy better protections for the university, so that we can respond effectively and quickly against whatever attacks come our way.

How can we better protect our personal information online? What are some important things for students, faculty, and staff to do in their daily lives?

Probably the most effective way to protect yourself online is to be aware of the hectic pace of the world we live in today. Be thoughtful in your approach, especially when it comes to emails, texts, social media messages, or any other way that some entity might interact with you.

You need to stop, take time to breathe, and don't let the message dictate how frenetic a response you give. Think about whether this is a legitimate email or message, whether it's either too good to be true, or if it is trying to make you act with urgency.

Almost every scam or phishing attempt has three things in common:

The message tries to assert an authority that it may or may not have, posing as a tax collector, police, or even something like IT support.
The message offers you something of value, like winning the lottery or an unclaimed prize—or a chance to avoid pain, such as past due taxes, and threats that your account is about to be suspended.
The message holds a sense of urgency, telling you to act now, or telling you that you are actively in danger.

If it seems strange, don’t engage. Instead, report it to Information Technology Services.

Check out these other cybersecurity resources from George �鶹��Ƶ:

Security Best Practices—Information Technology Services

Strong passwords add security

Information Technology Services (ITS) News—IT Security

ITS news

Cybersecurity best practices

Topics

Faculty and Staff News

Information Technology Services

Cybersecurity

Artificial Intelligence

GCI-Grand Challenge Initiative

Cybersecurity student hopes to use his powers for good

Shayla Brown — Fri, 29 Aug 2025 15:49:25 +0000

Cybersecurity student hopes to use his powers for good Shayla Brown Fri, 08/29/2025 - 11:49

When �鶹��Ƶ cyber security engineering major Connor Wadlin learned about ransomware attacks on organizations, such as the one on the Health Service Executive in Ireland, in his CYSE 445 System Security and Resilience class, it confirmed his commitment to dedicating his educational and professional career to protecting and preserving human lives.

“There’s nothing more important than protecting and defending others. As an engineer, I’m driven to get important work done by thinking about complex problems and finding suitable solutions,” said Wadlin, who is from Leesburg, Virginia.

Since winter 2024, the Honors College student has been interning at the Commonwealth Cyber Initiative (CCI) Northern Virginia Node, George �鶹��Ƶ’s branch of the statewide network dedicated of excellence in cybersecurity research. CCI’s mission includes workforce development through training the next generation of cybersecurity experts.

CEC student and Commonwealth Cyber Initiative intern Connor Wadlin. Photo by Ron Aira/Office of University Branding.

“It’s a super exciting job because I get to work with AprilTags, which are on objects that the drone's camera then sees and scans. Instead of sharing data, the tags utilize location information for navigation, tracking objects, or pathing purposes,” he said.

Wadlin is also simulating drone flight with the Microsoft tool Air Sim, a project he presented at the CCI Symposium in April. “I created a model with a 98% accuracy, really high F1 score—higher than what we could find on the market—detecting collisions so the drones would be able to respond to anomalous factors such as objects that get too close, environmental variables, cyber-attacks, and more,” he explained.

Wadlin learned about many of the tools he’s currently using for CCI in his classes with College of Engineering and Computing professors, such as his mentor Mohamed Gebril, an associate professor in the Department of Cyber Security Engineering.

“George �鶹��Ƶ supports people where they are to get them where they want to be,” Wadlin said.

The skills Wadlin has acquired during his time at George �鶹��Ƶ and in his work with CCI have enable him to help other students in their studies.

“Connor is a very skilled student and has been able to develop different programs, as well as 12 labs for sophomore- and freshman-level students at George �鶹��Ƶ. He even assists the students during our workshops,” said Gebril.

Wadlin is participating in George �鶹��Ƶ’s Bachelor’s to Accelerated Master’s Program and will to pursuing a master’s degree also in cyber security. Gebril said he’s looking forward to having Wadlin in his classes again as a graduate student.

“It will be a smooth transition from the undergraduate to the graduate level because the curriculum aligns well with the CCI mission, which is to equip our students with the tools to conduct research activity and develop cutting-edge technology,” said Gebril.

Wadlin’s team is also working to develop a first-of-its-kind cyber drone race that incorporates cybersecurity challenges and artificial intelligence for undergraduate students.

Wadlin was diagnosed with autism at 19 and sees this diagnosis as working to his advantage by allowing him to see things from different perspectives and approach problems with his own unique ideas.

“As an engineer, you have to ask yourself ‘how is this making the world a better place?’ That's always got to be the end goal,” said Wadlin.

Explore the College of Engineering and Computing

In This Story

Mohamed Gebril

Topics

internships

College of Engineering and Computing

Honors College

Commonwealth Cyber Initiative (CCI)

Cybersecurity

Students

CEC students

Five George �鶹��Ƶ cybersecurity students hack their way to Boston

Jennifer Pocock — Thu, 31 Jul 2025 14:38:39 +0000

Five George �鶹��Ƶ cybersecurity students hack their way to Boston Jennifer Pocock Thu, 07/31/2025 - 10:38

The Country to Country (C2C) Capture the Flag (CTF) contest is an international competition that issues challenges to code, decrypt, search, hack, and reverse engineer their way through as many challenges as possible.

(C2C) CTF contestants gathered from across the globe to solve pernicious problems. Photo provided.

�鶹��Ƶ 500 students from nearly 100 countries, ranging from inexperienced freshmen to PhD candidates in cybersecurity, competed individually in the qualifying rounds. Only the top 100—including five from �鶹��Ƶ—were accepted into the finals. Four went to Boston for the competition, held this year at Northeastern University.

The College of Engineering and Computing students Gael Abboud, Sanjay Kumar Samala, Nhat Le, and Jonah Wilbur represented the green and gold, but were all placed on different teams. (Amaan Abbas also made the cut but could not attend.)

“The organizers were amazing,” said Abboud, who is a graduate student pursuing her master's in systems engineering through the Accelerated Master's Program. She explained that they try to make it a truly international and cooperative competition. Ideally, each team would contain people from different countries.

“Somehow, I ended up on a team with two other people from Virginia,” Abboud said with a laugh. “They came from Virginia Commonwealth University and William and Mary.”

Her Virginia-strong team did the state proud. Over a day of competition, they sometimes worked together and sometimes apart to solve as many problems as possible from across various skill sets.

It’s not just coding. Abboud described one of the challenges. “It was open-source intelligence, which is really just fancy Googling. They set a scene where we had to find a very certain scooter repair shop in Boston. They told us that it was near a metro stop and in sight of an Indian restaurant. Seems like it should be easy, but it wasn’t!”

They also had to track down things like the price of the building and the vice president of the company that sold it more than 60 years ago. “No one solved that one.”

In the end, Abboud’s team landed in fourth place: an admirable showing when the contestants represent some of the best from around the globe. “I was so disappointed,” she sighed. “There was less than one point separating us from the third-place team.”

Abboud said that she loved every minute and would tell anyone curious about hack-a-thons to try qualifying for this Capture the Flag event.

“It may seem intimidating, but there are challenges for any skill level,” she said. “You don’t know what it will be like if you don’t try. Don’t stress if you don’t know something. People are happy to walk you through how they solved it.”

Learn more about the College of Engineering and Computing

Topics

College of Engineering and Computing

Safeguarding George �鶹��Ƶ’s research and researchers

Katarina Benson — Wed, 18 Jun 2025 18:45:55 +0000

Safeguarding George �鶹��Ƶ’s research and researchers Katarina Benson Wed, 06/18/2025 - 14:45

Earlier this year, Melissa Perez was named assistant vice president for research security in the Office of Research Integrity and Assurance at �鶹��Ƶ. In this role, she oversees university-wide policies and processes to ensure compliance with research security laws and regulations (including export control), international collaborations, travel, and cybersecurity. As George �鶹��Ƶ’s designated research security officer, she also leads institutional responses to threats affecting the university’s research compliance and standing.

Perez has more than 20 years of research compliance experience, including the past decade leading George �鶹��Ƶ’s export compliance and secure research programs—most recently as director for export compliance and secure research. She recently shared her insights on the university’s Research Security Program, regulatory challenges, and the impact on researchers.

Melissa Perez. Photo by Office of University Branding

What inspired you to take on this new role?

I majored in international relations at St. Joseph’s University and law at American University. I enjoy analyzing the geopolitical aspects of research security and how the federal government uses regulations to advance its foreign policy goals. I began actively advocating for a research security program at George �鶹��Ƶ in 2023 because the U.S. government has been messaging to universities how critical it is to protect U.S. research and the role universities have in safeguarding the research.

I am committed to supporting our researchers and knew that I wanted to have an even greater role in ensuring that they can pursue their international research safely and responsibly. I have created and expanded other compliance programs at George �鶹��Ƶ that support our faculty and researchers, and I am excited for the opportunity to create a new program that will be a resource for the George �鶹��Ƶ community.

Why is a research security program vital for George �鶹��Ƶ, and how does it align with the requirements of National Security Presidential Memorandum 33 (NSPM-33)?

Under NSPM-33, the U.S. government mandates that R1 universities like George �鶹��Ƶ establish robust research security programs to protect U.S. technology against foreign government misappropriation. The Research Security Program enables us to meet this requirement and continue receiving federal funding, and it also demonstrates to government sponsors George �鶹��Ƶ’s commitment to protecting our research and researchers when they engage with international colleagues.

What are the key security challenges universities face?

One key challenge is raising awareness of threats and risks, and helping researchers recognize international activities that may compromise their research, their funding, or their careers. When people hear “research security,” they often think that the U.S. government is only interested in protecting classified or sensitive research, but, in fact, the threat of misappropriation goes beyond that and includes fundamental or basic research.

NSPM-33 introduces specific guidelines for safeguarding research. How you plan to ensure compliance without stifling academic freedom?

While there is an inherent tension between limiting what faculty can do, from a regulatory perspective, and academic freedom, the goal of George �鶹��Ƶ’s Research Security Program is to help researchers identify international activities that are safe, secure, and that protect them, their research teams, and their careers. I don’t want to stop collaborations; I want to make sure that our researchers can engage in these activities with confidence that the collaborations will benefit them, the university, and the scientific community.

What are your top priorities for the first year of implementation?

The priorities for the first year are communications and outreach as they are key to raising awareness and establishing buy-in and a culture of compliance. Research security applies to all federally funded research and will impact anyone involved in federally funded research, especially researchers collaborating internationally. That’s why outreach is so important. I want to ensure that faculty, staff, and students understand the new requirements and how the evolving policy landscape impacts them. In terms of workflow changes, by working with offices across campus to refine our processes around foreign travel security and cybersecurity, my intent is to embed elements of research security into existing processes rather than create new workflows for people to follow. My goal is to make research security easy and unobtrusive for the researchers.

Universities thrive on collaboration. How does the program ensure that partnerships with external entities remain productive and secure?

A strong research security program will allow us to maintain and grow the level of international engagements at George �鶹��Ƶ. Without this program and the processes and tools that will be a part of it, it is much harder from a risk perspective to evaluate which activities may involve a high level of risk that could jeopardize our research or researchers.

Can you provide an example of a security threat that could potentially compromise research at a university, and how the program will prepare to address it?

One example is the U.S. government’s policy regarding Malign Foreign Talent Recruitment Programs (MFTRP). In the past, being selected to participate in a program such as China’s Thousand Talents Program was considered an achievement. Today, participation in a foreign talent program that the U.S. government considers “malign” could jeopardize a researcher’s ability to receive federal funding.

To ensure that our researchers remain eligible to bid on federal projects, we have a pre-approval process in RAMP where we review foreign appointments and affiliations to determine whether they would be a MFTRP. If the researcher is contemplating an activity that would be considered a MFTRP, I work with the researcher to mitigate risk by removing terms that make the activity “malign,” and I provide guidance so that they can weigh the risks associated with such foreign appointments.

Cybersecurity is one of the pillars of NSPM-33, and my office will partner with many across campus who manage cybersecurity threats, including the Office of Research Computing, ITS, and the IT units in the colleges, to make sure that all research security policies addressing cybersecurity are coordinated and reflect industry best practices.

How do you envision adapting the program over time?

In my role as research security officer, it will be my responsibility to be aware of regulatory changes in this space and to have a pulse on how other universities are responding to these changes. As the regulatory landscape evolves, I will work with leadership to communicate those changes to our researchers. Our program will need to be agile to reflect changes implemented by the U.S. government. Policies and guidance are shifting rapidly, and a big challenge will be keeping our community up-to-date.

Learn more about Research at George �鶹��Ƶ

Topics

Research

Cybersecurity

Faculty and Staff News

Office of Research Innovation and Economic Impact

Sit! Stay! Buzz?

Jennifer Pocock — Thu, 29 May 2025 14:56:51 +0000

Sit! Stay! Buzz? Jennifer Pocock Thu, 05/29/2025 - 10:56

These �鶹��Ƶ students are short-circuiting voice commands, dog whistles, and clickers.

Covert Dog Comms Team Leader Paul J. Wyche displays their finished prototype at the Office of Student Creative Activities and Research (OSCAR) Celebration. Photo by John Boal

If you’ve had a puppy, you probably know the patience it takes to train them in basic commands, and it can be a noisy affair involving begging, pleading, and some yelling. Working dogs like those in police and military K9 units need to learn so much more.

Sometimes, they need to obey without hearing a word.

Rescue situations can be chaotic, with so much going on that a command gets lost in the noise. Sometimes, a team of dogs need to hear many different commands, and competing voices are confusing. Other times, operation teams need to go radio silent and any noise at all will give their positions away.

Enter Team Covert Dog Comms. This pack of cybersecurity seniors at George �鶹��Ƶ, all of whom graduated in May, sniffed out a way to direct dogs without barking commands.

Together, they became the dream team that was the envy of anyone who has ever worked on a bad group project—and proof that great leadership combined with a passionate team yields amazing results.

“Working with this team has been a very positive experience. One key factor that made it successful was the balance of specialized skill sets,” said team leader Paul J. Wyche, who also recently spoke at his College of Engineering and Computing graduation. “While some of our backgrounds overlapped, each team member had a distinct area of expertise, allowing us to overcome any obstacle and collaborate effectively.”

Those members were Maxime Bonnaud, who specialized in the vest’s wireless and cryptographic security; Jonathan Perry, who designed the hardware; and AJ Hoepfner, who set up testing standards and regulations, along with assisting Wyche with project management.

“Mostly, what made this team great was good execution on the fundamentals,” said Bonnaud. “Everyone showed up, communicated well, and looked for areas they could work on instead of having to be assigned work.”

The end result was a securely encrypted working prototype of a vest that can be programmed with three different vibrating pattern commands that a dog can be trained to obey. While they were unable to find a working dog to test on, the team tested the vest on themselves and found it to work as intended.

When asked whether the team planned to patent or commercialize the vest, Wyche said that they wouldn’t rule it out. “We haven’t formally discussed commercializing the project. However, if the opportunity arises and we receive the necessary support, we may explore those possibilities.”

Until then, they achieved their goal of making “a fully operational haptic vest that could be refined for real-world use in special operations.”

And that is something to howl about.

Topics

Senior Capstone Project

Cybersecurity

Military

Police and Public Safety

George �鶹��Ƶ and CodeLock work on securing the software supply chain

Nathan Kahl — Thu, 15 May 2025 11:27:25 +0000

George �鶹��Ƶ and CodeLock work on securing the software supply chain Nathan Kahl Thu, 05/15/2025 - 07:27

�鶹��Ƶ Department of Information Sciences and Technology Professor Kun Sun received a grant from the Commonwealth Cyber Initiative (CCI) of Northern Virginia to collaborate with CodeLock, Inc., a Virginia-based technology company specializing in software security. The grant totals $75,000 for one year and is part of CCI’s Academic Support for Cybersecurity Entrepreneurship and Next-Gen Development (ASCEND) Fund. 

“The idea for this funding is to partner a startup company with university subject matter experts,” said Sun. “The focus of this grant is to build a platform that connects startups with academic experts to solve technical industry challenges.”  

The project will integrate Sun’s previous research on automated security patching with CodeLock’s technology for secure software supply chain using dynamically generated digital signatures to develop solutions that address vulnerabilities in source code. 

The CCI is Virginia’s main access point for cybersecurity research, innovation, workforce development. Image courtesy CCI.

CodeLock offers a cybersecurity platform designed to secure software development processes by providing real-time monitoring, compliance automation, and protection against insider threats and supply chain attacks. It creates a forensic chain of custody by linking every code change to its developer, ensuring transparency and integrity throughout the software development lifecycle.  
 
“So for software supply chain security we install outside software applications on our smartphones and computers, for example,” said Sun. “That software may rely on  other software and we have this term, SBOM, which means software bill of material. It says that we need to know what other dependent software is used and can we trust that software? If you install software, you need to verify it has not been manipulated or modified by an attacker.” Sun will apply his 10+ years of research on automatic software vulnerability detection and automated program repair. 

“The vast majority of software supply chain attacks begin with compromised credentials—something traditional security tools are ill-equipped to prevent,” said CodeLock CEO Brian Gallagher. “By enforcing zero-trust authentication at the developer level and linking that identity to a tamper-proof chain of custody, CodeLock is fundamentally reshaping the threat landscape. Partnering with George �鶹��Ƶ allows us to build on that foundation by automating vulnerability patching, which not only strengthens security but also delivers measurable cost savings for our customers. This collaboration accelerates our mission to bring transparency, accountability, and efficiency to software development across both government and commercial sectors.”

The project team will get feedback from CodeLock’s existing customers and collaborate with CCI and the Northern Virginia Technology Council to refine the solution for broader commercial adoption. Additional funding will be provided by CodeLock and supplemented through grant opportunities. 

In This Story

Kun Sun

Topics

Cybersecurity

software

Commonwealth Cyber Initiative (CCI)

Research

Cyber sweep: George �鶹��Ƶ students take top three spots in national transportation cybersecurity competition

Teresa Donnellan — Thu, 27 Mar 2025 14:42:35 +0000

Cyber sweep: George �鶹��Ƶ students take top three spots in national transportation cybersecurity competition Teresa Donnellan Thu, 03/27/2025 - 10:42

"I'm going to teach you how to hack a modern car," said �鶹��Ƶ professor Tanvir Arafin to the fall 2024 cohort of CYSE 465 Transportation Systems Design. Arafin not only introduced his students to such exciting concepts in transportation security, but he also incorporated the opportunity to participate in a nationwide cybersecurity competition into his course.

The entire class of 12 from the Department of Cyber Security Engineering chose to participate in the optional assignment and several won first, second, and third place at the National Transportation Cybersecurity Competition (NTCC) in November 2024. George �鶹��Ƶ’s Finn Schaefer won first place; the team of Noor Mohammed, Sonia Shaukat, Caleb Hughston, and Kayleigh Batchos won second place; and Navraj Singh Gill won third place.

Adobe Stock

The national competition was open to all university students, both undergraduate and graduate, who could participate individually or in teams of up to four, guided by a faculty advisor. This year’s competition was titled “CYBER-CARE Challenge 2024: Securing the Future of Transportation.”

Participants faced a series of cybersecurity challenges, including password cracking, traffic management system exploitation, Vigenère cipher decryption, SQL injection vulnerability identification, cross-site scripting (XSS) attacks, and vehicle trajectory anomaly detection. They had a few weeks to complete the challenges remotely.

Arafin developed CYSE 465 by integrating real-world scenarios and cutting-edge research findings from his lab. He has been working in hardware and cyber-physical systems security with a key focus on cybersecurity issues of autonomous and transportation systems. CYSE 465 covers understanding data, communication, operating systems, control, and security primitives used in today's vehicles for safe and intelligent control and navigation.

“The course offers a unique perspective on the cyber vulnerabilities that emerge from the security-oblivious modernization of transportation systems,” said Arafin.

While he has taught the course since 2022, this was the first time he incorporated the competition into the course. Arafin noted that such competition participation can greatly enhance students’ resumes, and first-place winner Schaefer, a busy student, greatly appreciated the chance to participate.

“This was actually the first competition that I've competed in,” he said, explaining that it’s hard to find time for such activity outside of school and work. Schaefer’s favorite challenge at the NTCC involved assessing vehicle datasets to detect problems or attacks. He drew from his personal interest in machine learning to solve the challenge.

“I've worked with machine learning models a lot in my own personal projects, but I've never had an applicable use for it,” said Schaefer. “So, it was interesting to actually see my work have real meaning to it for once. I was able to do something pretty cool.”

Through courses like CYSE 465, which bridge the gap between theoretical knowledge and practical application, the Department of Cyber Security Engineering is fostering a new generation of cybersecurity professionals who are well-equipped to secure the future of transportation systems.

"The students’ competition performance is a very compelling argument on the benefits of bringing the results and lessons learned in the research lab directly to the classroom, something many CYSE faculty are doing," said Paulo Costa, the department's faculty chair.

The achievements of George �鶹��Ƶ students at the NTCC highlight the importance of this approach. By bringing state-of-the-art research directly to the classroom, the Department of Cyber Security Engineering is preparing students to become leaders in the field. As the cybersecurity landscape continues to evolve, the department's innovative educational strategies will ensure that its graduates are ready to meet the challenges of tomorrow.

In This Story

Tanvir Arafin

Paulo Costa

Learn more about Cybersecurity at George �鶹��Ƶ

Topics

Cybersecurity

transportation engineering

Student Success

Department of Cyber Security Engineering

Students

innovative classes

Strategic Direction

Nearly 500 high schoolers get expert advice at Virginia CyberSlam 2025

Teresa Donnellan — Mon, 17 Mar 2025 16:20:56 +0000

Nearly 500 high schoolers get expert advice at Virginia CyberSlam 2025 Teresa Donnellan Mon, 03/17/2025 - 12:20

Nearly 500 high school students from across the commonwealth gathered at �鶹��Ƶ for Virginia CyberSlam 2025, where cybersecurity experts from both the public and private sectors shared industry insights during a day of activities aimed at inspiring the next generation of cybersecurity professionals.

Dolores Garza addresses CyberSlam 2025 attendees. Photo by Teresa Donnellan/CEC

“What an event it was March 10, with 475 students representing 22 schools and six school districts from around the commonwealth enjoying hands-on workshops and activities led by cyber experts from industry, government, and higher education,” said CyberSlam founder Chris Starke, a teacher for Loudoun County Public Schools who co-directed the event with the University of Alabama in Huntsville’s Jennifer Marden. “In all, 28 presenters combined to run 12 workshops—6 for each of our novice and advanced students. It was truly rewarding to see students enjoy learning about cybersecurity.”

Students heard from keynote speaker Dolores Garza, Branch Chief of the Technical Operations Group at the United States Marshals Service, among others. Garza oversaw the creation of a cyber investigation unit at the U.S. Marshals and described the evolution of cybersecurity as a professional field. She encouraged attendees to stay open to new technological developments and emphasized the need for a hybrid set of skills that combines criminal investigatory techniques with technical expertise.

“Diversity in technology is not just an asset; it is a necessity,” said Garza. “The more perspectives we bring to problem-solving, the stronger and more effective our solutions become.”

Student navigates drone during CyberSlam 2025. Photo by Ron Aira/Office of University Branding.

Throughout the day, professionals led hands-on workshops in various aspects of cybersecurity.

David Raymond from Virginia Cyber Range led a session on advanced Capture the Flag challenges, focusing on Wireshark.

Greg Crabb from 10-8, LLC, conducted a tabletop exercise on incident response and deep fake technology, and Randy Benn from Claroty introduced students to the Internet of Things.

Other experts leading workshops represented Vertex11, OpusType Advisors, the Idaho National Laboratory, the Drug Enforcement Administration, CYBER.ORG, George �鶹��Ƶ, and Shenandoah University, leading workshops on drones, deep fakes, digital forensics, and more.

Students participate in a CyberSlam workshop. Photo by Ron Aira/Office of University Branding

“I would like to thank our co-hosts, George �鶹��Ƶ’s Department of Cyber Security Engineering and Loudoun County Public Schools, as well as the Commonwealth Cyber Initiative Northern Virginia Node (CCI NoVA Node), Virginia Cyber Range, Vertex11, CACI International Inc., Claroty, CodeHS, Widelity, Inc., and GT Edge AI for sponsoring this wonderful event that in four years has impacted more than 1,600 students,” said Starke. “And, thank you to our exhibitors the Cybersecurity and Infrastructure Security Agency, �鶹��Ƶ Competitive Cyber (MCC), George �鶹��Ƶ’s College of Engineering and Computing, GT Edge AI, and the Virginia National Guard 91^st Cyber Brigade.”

CyberSlam attendees navigate drones in a workshop. Photo by Jennifer Marden

One event highlight was a panel featuring George �鶹��Ƶ students from the MCC club—Dylan Charnick, Dylan Knoff, and Danyaal Shaozab. MCC is known for its inclusivity, welcoming George �鶹��Ƶ students from all majors and levels of experience. The club meets twice weekly, hosting impressive speakers, running workshops on cybersecurity skills, and forming teams to participate successfully in various CTF events throughout the year.

During the panel, the MCC students fielded questions from the audience about degree programs at George �鶹��Ƶ, the benefits of technical certifications, and how to best prepare for a career in cybersecurity. “Most cyber jobs are here in the D.C. area,” noted Knoff, pointing out one benefit of pursuing cybersecurity at George �鶹��Ƶ.

CyberSlam fosters the cultivation of cybersecurity talent in Northern Virginia, where the industry is booming. This year’s event particularly underscored the opportunities in both public and private sectors that are preparing the next generation of cybersecurity professionals, ensuring they are equipped with the skills and knowledge needed to thrive in this rapidly growing field.

“I would like to thank CCI NoVA Node, specifically Liza Durant and Jordan �鶹��Ƶ for sponsoring the amazing raffle prizes and their support for the Virginia CyberSlam, and also George �鶹��Ƶ’s Elizabeth Dean for making this event possible,” said Marden. “We could not have done this with the support of George �鶹��Ƶ, CCI, our presenters, sponsors, and of course our wonderful Virginia cybersecurity educators and students.”

Explore Cybersecurity at George �鶹��Ƶ

Topics

Cybersecurity

Department of Cyber Security Engineering

Commonwealth Cyber Initiative (CCI)

Students

Cybersecurity

George �鶹��Ƶ student project presents sticky situation for hackers

Topics

Cyber security engineering student excels at his internship for the second time

What made you choose Surefire Cyber for your internships?

What does a typical day interning at Surefire Cyber look like for you?

How would you say George �鶹��Ƶ has helped prepare you for this role?

What’s your favorite thing about interning at Surefire Cyber?

Related Stories

Topics

George �鶹��Ƶ’s Chief Information Security Officer protects the keys to the kingdom

What does information security entail, particularly in a higher education setting?

You have led information security at several different institutions. What drew you to a career in higher education, and specifically to �鶹��Ƶ?

What are the biggest changes in cybersecurity in higher education since you first entered the field?

How do you work across other departments to reduce risks to the university?

How does artificial intelligence (AI) factor into your role as chief information security officer?

How can we better protect our personal information online? What are some important things for students, faculty, and staff to do in their daily lives?

Check out these other cybersecurity resources from George �鶹��Ƶ:

Read more like this

Topics

Cybersecurity student hopes to use his powers for good

In This Story

Related News

Topics

Five George �鶹��Ƶ cybersecurity students hack their way to Boston

Related Stories

Topics

Safeguarding George �鶹��Ƶ’s research and researchers

What inspired you to take on this new role?

Why is a research security program vital for George �鶹��Ƶ, and how does it align with the requirements of National Security Presidential Memorandum 33 (NSPM-33)?

What are the key security challenges universities face?

NSPM-33 introduces specific guidelines for safeguarding research. How you plan to ensure compliance without stifling academic freedom?

What are your top priorities for the first year of implementation?

Universities thrive on collaboration. How does the program ensure that partnerships with external entities remain productive and secure?

Can you provide an example of a security threat that could potentially compromise research at a university, and how the program will prepare to address it?

How do you envision adapting the program over time?

Related Stories

Topics

Sit! Stay! Buzz?

Topics

George �鶹��Ƶ and CodeLock work on securing the software supply chain

In This Story

Related News

Topics

Cyber sweep: George �鶹��Ƶ students take top three spots in national transportation cybersecurity competition

In This Story

Related Stories

Topics

Nearly 500 high schoolers get expert advice at Virginia CyberSlam 2025

Related Stories

Topics

What made you choose Surefire Cyber for your internships? 

What does a typical day interning at Surefire Cyber look like for you? 

How would you say George �鶹��Ƶ has helped prepare you for this role? 

What’s your favorite thing about interning at Surefire Cyber? 