Cyber Security and Critical Infrastructure Ignorance

It's been a crazy week.  It started with Skills Ontario provincial finals in Toronto where we won gold in IT & Networking for the second time in three years, then I attended my first ever Ontario Council of Technology Educators conference on the Friday.  I write this the next Monday evening from a hotel room in beautiful Fredericton, New Brunswick where we're set to compete in the CyberTitan cyber-security National Championships.

With all these powerful events pulling me out of the classroom, I'm enjoying a strategic perspective that I'm usually too busy teaching to consider.  These events are also forcing me to explain to people what information technology, networking and cyber-security are, which is odd, because they all live their lives every day within this information  infrastructure.  How can people be so unaware of something that affects their lives every day?

Canadian Nuclear Labs are
one of the most advanced
research facilities on the
planet - these are their main
priorities...

A strange thing happened at the OCTE tech teacher conference I attended last Friday.  I finally got to meet other computer technology teachers in the province only to learn that many of them appear to be looking to hand off their classrooms to pre-set curriculum like First Robotics.  I can't speak to the effectiveness of First Robotics myself, but the evangelism of the people in it makes me suspicious.  That evangelism was set to such a high volume in this meeting that one teacher declared that IT & Networking is, "a waste of time now...it's so simple that an idiot can do it..."  If that's the case, why is our information technology infrastructure so fragile, and intermittent?  The general public is oblivious to this infrastructure and many teachers of computer technology appear to be grossly ignorant of its complexities and importance.  We're ignoring vital technology infrastructure in the classes we're supposed to be teaching it in!  It has taken me a few days during this wacky week to formulate a response to his comments, but here it is:

There is a lot more to computer technology than plugging your students into a robotics competition, no matter how well intentioned it might be.  What should be at the core of computer technology education (IMHO) is an understanding of how technology empowers and influences our society in the Twenty-First Century.  Nowhere is our ignorance of critical information technology infrastructure more pronounced than it is in cyber-security.

Last year I read WIRED's shocking article on Russia's attack on the Ukraine.  Like much else in cyber-security, most people are oblivious to the fact that nation states are currently attacking each other through information technology infrastructure.  Russia and China both have sizable military organizations dedicated to attacking IT infrastructure.  The Israeli and US cyber militaries have remotely dismantled Iranian nuclear research through digital attacks.  We're living in a brave new world most people have no idea about.

You might think that all this tech is just for entertainment such as social media, but you'd be wrong.  IT has worked its way into everything from our utilities and financial systems to food production and healthcare.  How we secure our information technology isn't just about looking after your personal information while you're wasting time on your phone.  IT is now a vital and targetable infrastructure asset.  Other stories on how social media became weaponized in order to influence elections also highlights our ignorance around how fragile our IT infrastructure is.  I was talking to an elderly relative about our upcoming cyber-security competition on Mother's Day and described it this way:

Ten critical infrastructures that people depend on daily.  See
robots on there anywhere?  CompTech should be about
showing students the vital roles technology plays in our
lives, not just a singular focus on robotics or anything else.

If you want to build a house you would have to go through many safety regulations to build it.  All subsystems in your house would have to conform to standards designed to make them as safe and resilient as possible.  We put these rules in place because we recognize how potentially dangerous just slapping things together in the cheapest way possible by people not professionally qualified to do the work would be.  Having your house plumbed by your cousin's kid who likes playing with water or getting the wiring done by your brother-in-law because he likes wires seems insane, but that's the relationship too many people have with our information technology infrastructure.

Even where professional standards exist, they are often ignored and undervalued (evidently by Ontario computer technology teachers as well as everyone else).  This happens because we don't recognize the dangers of an under-engineered, cobbled together information technology infrastructure.  We're then amazed to learn that Russia can turn off the lights in another country prior to annexing parts of it, or that social media can be engineered to break a democracy.  These things are already happening all around us.

So here I am at the first Canadian Cyber-Security National finals trying to overturn decades of willful ignorance.  New Brunswick seems aware of the urgency of this situation in a way that Ontario does not.  In spite of being a fraction of the size of Ontario's education system, many more NB schools participated in the CyberTitan contest this year, and awareness of the problem seems much stronger here.  

CyberNB does not appear to have an equivalent agency in Ontario that recognizes the urgency and fragility of the situation we've made for ourselves.  Our apathy has resulted in frail information infrastructures that are not up to the task of maintaining our critical social systems, let alone defending us from cyber-attacks by malicious states and individuals.

If I can help ICTC and the other organizers of CyberTitan and the CyberSmarts 2018 conference shed light on this neglected yet increasingly important Twenty-First Century fluency, then this process will have all been worth it; we need to build our ICT house to withstand the storms that are coming.  When we're done here we'll head out to Edmonton in a couple of weeks and go for a National Skills Canada medal in IT & Networking.  Perhaps in the process we can talk about how security should be implicit in that effort.  If this starts to gain traction, could we see a cyber-security Skills Canada competition sooner than later?

Team Falcontech from Centre Wellington District High School at the first annual Canadian Cyber-security national finals in Fredericton.  Two of them hadn't been out of the province or flown before!

Related Links:

https://www.itworldcanada.com/article/ictc-to-spend-3-m-of-cancode-funding-to-bring-business-challenges-into-the-classroom/401092
"Saric is confident that students from a range of backgrounds and of different ages will be able to rise to the challenge of tackling real-world business problems. She points to ICTC’s CyberTitan competitions as proof. These six-hour competitions that take place online, scoring students in real time as they work to secure systems. “They have so many of the tools and many of the skills in their repertoire,” she says. “I’d never underestimate the skills and brilliance of youth.”

https://twitter.com/ICTC_CTIC/status/995007883329921025

https://innotechtoday.com/developing-cyber-future-workforce/

http://www.cbc.ca/news/canada/new-brunswick/cybertitans-nb-1.3934224

Ontario's neglected computer technology curriculum continues to miss the mark:  http://temkblog.blogspot.ca/2018/04/ontario-educations-neglected-computer.html
All we need to do to resolve this is address it!

TWITTER NOTES FROM #CYBERSMART2018:

https://www.nist.gov/itl/applied-cybersecurity/nice