Curriculum Development for Teaching Cybersecurity of Industrial Control Systems & Critical Infrastructure

It is well-established in academic and professional circles that there currently exists a knowledge/skill gap between engineers and IT/Cybersecurity professionals with respect to protecting the nation’s Industrial Control Systems (ICS) and Critical Infrastructure (CI) from cyber threats and attacks. This paper documents relevant work and outlines a roadmap for developing a curriculum for a Graduate Certificate as part of the effort to bridge this gap. Given the complex, cross-sector dependencies and interdependencies of ICS and CI, this paper adopts a multidisciplinary approach to developing the proposed Curriculum. To this end, the curriculum augments existing courses in Cybersecurity and Engineering Technology and creates new ones for meeting sector-specific learning outcomes & objectives. Overall, the paper and the proposed curriculum hold the promise of contributing to the ongoing effort to bridge the knowledge/skill gap by educating the future engineering and security workforce on protecting the ICS and CI from cybersecurity threats and attacks.

I. Introduction

Recent years have witnessed numerous “cyber” attacks against Industrial Control Systems (ICS) and Critical Infrastructure (CI). For example, Colonial Pipeline, one of the nation’s largest pipelines, was forced to shut down its pipeline after being hit by a ransomware attack in May 2021 [1]. In February 2021, a hacker tried to poison the water supply in a Florida community that serves 15,000 people [2]. These incidents underscore the dire consequences that a security breach or compromise of ICS or CI could have on the economy and public safety.