Posts in Infosec Education
Page Content
More Than the Code
The two earlier posts in this series — New Myths for Old and After the Buggy Whip — argued that LLMs are not substitutes for the experienced people whose tacit knowledge keeps systems running and safe, and that the field of computing is being reshaped rather than ended. So, you may ask, if computing is not going away, and the people who do it well remain hard to replace, what is the best preparation for a career in it?
The answer is awkward considering the current direction of higher-education budgeting and state-level academic policy. The right preparation includes a substantial helping of what is being cut.
Picture an undergraduate two weeks into sophomore year, looking at her course plan. She is in computer science, a field she has come to love. She had planned to add a minor in sociology, or a second major in music or history. Now she is reconsidering. Her parents worry about the job market and think anything outside her major is a distraction. Her engineering friends tell her nothing outside the major will help her get hired, and that CS itself will soon be replaced by AI. She no longer knows what to believe. The minor goes.
That scenario will play out on many campuses next term, paralleling an argument older than computing. John Henry Newman's The Idea of a University, drawn from lectures first delivered in 1852 and developed across the following two decades, held that a university's purpose is the formation of intellectual habit — independent judgment, the capacity to weigh evidence and pursue truth — not the production of trained specialists. Half a century later, John Dewey's pragmatism placed a different emphasis: knowledge is inseparable from doing, and education should equip people to work, vote, and live as citizens. The American land-grant tradition that produced Purdue and scores of other public universities split the difference. The 1862 Morrill Act called for "the liberal and practical education of the industrial classes" — agricultural and mechanical instruction paired with broader study. These are not opposing camps. They are different facets of the same education.
Those facets have always been in tension over budget and class hours, but until recently, few seriously proposed cutting one to subsidize the other. The present is different. Amid budget shortfalls, demographic decline, and political pressure to demonstrate immediate "workforce alignment," universities are reducing breadth to fund a narrower depth. Increasingly, languages, liberal arts, and fine arts are being eliminated as majors at one regional public university after another. The justification offered is invariably economic.
Higher education also faces a non-economic pressure. It has long attracted political hostility because it encourages thought and argument that may run counter to current leadership. That hostility has intensified in recent years in the US. For example, consider state-level prohibitions on teaching specified topics, federal cuts to research on subjects deemed inappropriate, and proposed reductions to the National Endowment for the Humanities. The fields most impacted are the same fields being cut for stated economic reasons. The two pressures reinforce each other; the students lose access to the same coursework, regardless of the justification offered.
The most-cited recent case is West Virginia University, which in September 2023 eliminated 28 majors and 143 faculty positions to close a $45 million budget gap, including most of its world-language degrees. WVU was not the only one. Among others:
- Clarkson University announced in late 2023 that it would phase out the nine majors in its School of Arts & Sciences — history, sociology, political science, literature, film, and others — and refocus on STEM.
- In November 2024, Boston University suspended PhD admissions in a dozen humanities and social-science programs, including English, history, philosophy, classical studies, and sociology.
- In April 2026, Syracuse University announced the elimination or suspension of 93 academic programs, most of them in the humanities and arts: classics, fine arts, painting, music composition and performance, several foreign languages, and digital humanities. Syracuse's provost framed the decision as alignment with student demand rather than budget. The fields cut are the same.
The pattern is concentrated at regional public universities and at private institutions serving non-elite students: first-generation, rural, working adults, and others for whom a broad college education has historically been a step up in society. Wealthy private universities continue to staff full humanities and arts faculties; their students will read Rawls and Dostoyevsky, listen to Brahms and Glass, study Rembrandt and Mondrian, and learn Latin and Mandarin. The students who lose access are the ones paying for an education that no longer offers what their wealthier peers still take for granted.
Against this backdrop, one might ask, what does a computing professional actually need from outside computing? The list is shorter than the curriculum, but each item is easier to learn early, alongside the technical skills, where the habits take hold and last.
- Communication, written and spoken, technical and lay. Most consequential decisions in cybersecurity, and in computing more broadly, are made in writing — in an executive summary, an after-action report, or a board memo — and depend on readers who understand the context, why it matters, and what comes next. Policy review and design review rely on the same skill set. The NACE Job Outlook 2025 survey found problem-solving rated essential by nearly 90 percent of employers, teamwork by more than 80 percent, and written communication by close to 70 percent. Employers consistently report new graduates underperforming on those competencies. The WEF Future of Jobs 2025 report puts analytical thinking first; creative thinking, resilience, leadership, and motivation round out the top five. Those capacities are cultivated more reliably in a seminar that requires you to read a difficult text and argue about it than in any programming course.
- Ethics and the recognition of harm. The ACM Code of Ethics, which I have cited repeatedly, is explicit on the duty to anticipate and avoid harm. Anticipating harm requires moral imagination, historical perspective, and the willingness to consider who is on the other side of the system being built — none of which the Code itself can teach. Those capacities are cultivated by the disciplines under threat.
- Social and historical literacy. Computing systems are deployed into societies, not vacuums. Knowing how a labor market works, why a community distrusts the agency rolling out a new platform, what a free-speech tradition has meant in practice for two centuries, how an artistic movement broke from the one before — these are not decorations. They shape whether a system gets used, whether it is fought, and whether the decisions it automates produce the outcomes its designers intended.
- Argument and interpretation. A senior engineer reads ambiguous evidence — a half-confirmed indicator of compromise, an inconclusive postmortem, a policy proposal with consequences that depend on contested assumptions — and reaches a defensible reading. That is the same skill English majors practice on poems, art historians on paintings, and historians on archives. It is not a coincidence that people who do well in computing tend to have studied widely in other fields.
A defender of the cuts will object that AI now reproduces the humanities. LLMs can produce essays, sermons, and sonnets that read fluently. Image models generate plausible canvases in any style on demand. Audio models compose passable tunes. There is no shortage of seemingly new artistic material being produced by machines.
That output is mechanical novelty, not innovation. An LLM trained on published novels can recombine plot, voice, and image into an arrangement that has never previously existed, but the arrangement will be derivative by definition. Real innovation in any of these fields has historically meant that a person, shaped by long reading, looking, or listening, has arrived at a way of working that breaks with what came before. Atwood did not interpolate from Dickens, Mondrian from Vermeer, Coltrane from Brahms. Each had to live with the prior tradition and then go somewhere it had not been. That is not the operation an AI model performs.
The formative experience that produces such people produces the judgment that is now being hired to backstop AI. Reading complex material longer than a text message, writing under critique, arguing in a seminar, defending a reading against a serious objection — these are how the capacity to weigh and choose under uncertainty is built. The polished surface an AI tool produces is not a substitute; it is exactly the kind of plausible artifact that practitioners with that judgment are needed to evaluate. As I argued in New Myths for Old, an LLM is a statistical interpolator over a frozen corpus. It is good at recombining what has been written and poor at handling the unfamiliar. That is true for cybersecurity decisions; it is no less true for art.
The clearest signal of what AI development actually requires comes from the firms building those systems. The major AI labs have hired philosophers, anthropologists, and ethicists to work alongside their engineers on safety, policy, and societal-impact questions. Anthropic, for example, brought on the philosopher Amanda Askell to help define the values its models express, and the moral philosopher Peter Railton to work on training in ethics. Google DeepMind and OpenAI have parallel programs. The pundit class may claim that AI will replace humanists; the labs themselves are hiring humanists to constrain what their models do.
The strongest computing programs are structured along the same logic. Purdue's undergraduate BA in Artificial Intelligence is built jointly by the Departments of Philosophy and Computer Science — by design, not as an accommodation. The degree pairs twenty-four credit hours of philosophy with fifteen of CS, and Purdue also offers a CS+Philosophy dual-degree program. Stanford's Institute for Human-Centered AI places philosophers and ethicists alongside engineers as co-equal members. MIT's Schwarzman College of Computing has a mandate to integrate computing with the social sciences and humanities. Carnegie Mellon's Department of Philosophy and School of Computer Science offer joint undergraduate paths — including a longstanding Logic and Computation program — that pair the two fields by design. The institutions best positioned to define computing for the next generation are treating philosophy and the humanities as core to the work, not adjacent to it.
The fine arts have made a less-discussed contribution to computing, one that no AI tool yet produces on its own: the difference between the merely usable and the joy to use. Susan Kare, an artist with a BA in art from Mount Holyoke and a Ph.D. in fine art from NYU, drew the original, beloved Macintosh icons. Jim Reekes, an audio designer, composed the Mac startup chord on a Korg Wavestation in his living room, with "A Day in the Life" on his mind. Jony Ive, trained in industrial design and now chancellor of the Royal College of Art, shaped the look of every Apple product from the iMac through the iPhone. Musician Brian Eno composed the Windows 95 startup sound, which was added to the Library of Congress's National Recording Registry in 2025. Engineers built the machines; artists made them into objects people wanted to use.
My own undergraduate degree was a double major in math and computer science with a minor in philosophy. The faculty designed our program to emphasize interdisciplinary study and extensive research and writing, even though both majors were technical. My graduate work was in computing throughout, with psychology as a minor area. Some of what I learned in those non-technical courses I did not fully appreciate at the time. I have drawn on it in every decade since, and I believe they have contributed to my success.
The INSC graduate program in information security at Purdue — the world's first cybersecurity graduate degree program, which I founded in 2000 and directed for twenty-five years — requires coursework in ethics and technology policy. Not as enrichment, but because a security graduate who cannot reason about consequences and policy is not prepared. One reason our graduates have been highly valued in industry, government, and academia is that they arrive with that range. A narrowly trained graduate is at a disadvantage in the rooms where decisions are made.
If you are a student reading this and weighing what to take next, choose your electives deliberately. Take writing-intensive courses in which the writing is critiqued. Take a course that requires you to argue and be argued with. Consider a second major or minor in humanities, social science, or fine arts — not as decoration, but because the half-life of any particular framework or tool is shorter than a career, while the half-life of literacy, judgment, and the capacity to read a room is the rest of your working life. The capacities that make you human are the capacities that will not become obsolete with the next model release.
And there is a part of this argument that the career framing misses. Liberal-arts and fine-arts studies are not only a hedge against technical obsolescence. They are the foundation for the rest of life: for understanding what you read, watch, and listen to, for participating as a citizen, for making sense of grief and joy, for sustaining good conversation across a long life with people who matter. They are, eventually, what fills your time after your career ends. A person trained only for technical work reaches retirement with little left to draw on. The same person trained to read history, hear music, and follow an argument carries this training into a wider life.
The tasks that will still need people twenty years from now are the ones that require people to be people: to judge under uncertainty, to argue with care, to understand who is on the other side of the system. The life that will still be worth living when that work is done is the life one was prepared for outside the office. A university that strips its humanities and fine-arts programs to fund another technical certificate is preparing graduates who will be obsolete in their work and impoverished outside it — and thus failing to deliver on the promises on which higher education was founded.
(A few portions of this text were drafted and structured with the assistance of Anthropic Claude Opus 4.7; the ideas, arguments, and final editorial decisions are the author's.)
Ph.D.s in Cybersecurity
Introduction
Purdue University has a history of “firsts” in computing. The computer science department was founded in 1962, making it the oldest degree-granting CS program in the world. Purdue also has a history of research and education in cybersecurity, including the first multidisciplinary research center in the field (1998, CERIAS), and the first regular graduate degree in cybersecurity (2000).
Dorothy Denning completed her Ph.D. in CS at Purdue in 1975. Her dissertation was entitled Secure Information Flow in Computer Systems. After graduation, she joined the computer science faculty. She began offering a regular course in data security, starting in 1981. Matt Bishop was the TA for that course and completed his Ph.D. in security in 1984 with Dorothy as his advisor. Both Dorothy and Matt are well-known in cybersecurity for their many fundamental contributions.
Sam Wagstaff arrived in 1983 and assumed responsibility for teaching the data security course. Gene Spafford joined the faculty in 1997, although he did not teach a core cybersecurity course in his first few years at Purdue; he primarily taught software engineering and distributed systems.
In 1992, Spafford started the COAST Laboratory in the CS department, with initial support from Wagstaff. In 1998, CERIAS was established as a university institute, led by Spafford and supported by faculty in five other university departments. (As of January 2026, there are over 150 affiliated faculty in 20 academic departments. We'll have a more detailed history of CERIAS in a future post.) The first Ph.D. graduate from COAST, advised by Spafford, was Sandeep Kumar in 1995.
In 1997, immediately prior to the founding of CERIAS, Professor Spafford provided testimony before the House Science Committee of the 105th Congress. In that, he described the then-current national production of Ph.D.s in cybersecurity as only 2-3 per year. This was clearly not sufficient for the growing demand. His testimony inspired formation of both the NSF Scholarship for Service and the NSA/DHS Academic Centers of Excellence to encourage more students to pursue degrees. CERIAS leadership also considered it an initial priority to encourage more such degrees.
In the years since then, a number of universities around the world have developed cybersecurity research and education programs. A few thousand Ph.D.s have been graduated since the mid-1990s.
Ph.D. Production from mid 1990s
Rob Morton, a 2024 Ph.D. advised by Spafford, conducted research on degrees produced, augmented by Deep Search in Google Gemini. What follows are results from his research.
1988 was used as a starting point for "modern" academic cybersecurity. Following the Morris Worm (November 1988), the field formalized rapidly: Carnegie Mellon formed the CERT/CC, Purdue formed the COAST Laboratory (precursor to CERIAS), and UC Davis began its dedicated security architecture work.
Since that year, Purdue University and Carnegie Mellon University (CMU) have been the undisputed volume leaders in producing doctoral graduates with security-specific dissertations.
The Historical "Leaderboard" (Covering 1988–2024)
These counts exclude Master's degrees. They represent Doctoral candidates whose dissertations were primarily focused on Information Security, Privacy, or Cryptography. (The CERIAS/COAST numbers have been updated using local Purdue records.)
Detailed Breakdown by Era
- Total US Production: Extremely low (~5–10 per year nationwide).
- Dominant School: Purdue University (COAST Lab).
- Context: In this decade, if you met a PhD in security, they likely came from Purdue or UC Davis.There were almost no dedicated “Security” tracks elsewhere; students had to beg CS advisors to let them study viruses or intrusion detection.
- Notable Alumni: Many of the early leaders of security research graduated in this narrow window from these two schools.
- Total US Production: Growing (~30–50 per year).
- Dominant School: Carnegie Mellon (CMU) and Purdue.
- Context: The NSA started the “Centers of Academic Excellence” (CAE) program in 1999. Funding exploded. CMU’s CyLab began to industrialize the PhD process, adding policy and economics to the mix. Georgia Tech began ramping up network research. Also notable, although smaller, were programs at James Madison University, George Mason University, Idaho State University, Iowa State University, and the University of Idaho.
- Total US Production: High (~100–150+ per year).
- Dominant School: Georgia Tech and Northeastern.
- Context: Security became a standard sub-field of Computer Science.
- Purdue remains the steady "interdisciplinary" leader (averaging ~15–20 PhDs/year recently), mostly in CS.
- Georgia Tech and Northeastern aggressively hired faculty to scale their output.
- Top-Tier Shift: Schools like MIT and Stanford began producing PhDs focused on “Adversarial AI,” blurring the line between Security and Artificial Intelligence.
- Purdue (CERIAS): Their public alum rosters list approximately 360+ PhD graduates associated with the institute since its inception (counting the COAST era). However, the total count across the whole university is known to be higher as affiliation with CERIAS is optional and graduates originate in many disciplines.
- UC Davis: Their Security Lab alum page lists approximately 85+ PhDs specifically from the Computer Security Lab. However, the total count across the whole university is likely higher.
Ch-ch-ch-changes
Tomorrow, July 1, 2025, ushers in two significant changes.
For the first time in over 25 years, our fantastic administrative assistant, Lori Floyd, will not be present to greet us as she has retired. Lori joined the staff of CERIAS in October of 1999 and has done a fantastic job of helping us keep moving forward. Lori was the first person people would meet when visiting us in our original offices in the Recitation Building, and often the first to open the door at our new offices in Convergence. At our symposia, workshops, and events of all kinds, Lori helped ensure we had a proper room, handouts, and (when appropriate) refreshments. She also helped keep all the paperwork and scheduling straight for our visitors and speakers, handled some of our purchasing, and acted as building deputy. We know she quietly and competently did many other things behind the scenes, and we'll undoubtedly learn about them as things begin to fall apart!
We all wish Lori well in her retirement. She plans to spend time with her partner, kids, and grandkids, travel, and garden. She will be missed at CERIAS, but definitely not forgotten.
The second change is in the related INSC Interdisciplinary Information Security graduate program, a spin-off of CERIAS. In 2000, Melissa Dark, Victor Raskin, and Spaf founded the INSC program as the first graduate degree in information/cyber security in the world. The program was explicitly interdisciplinary from the start and supported by faculty across the university. Students were (and still are) required to take technology ethics and policy courses in addition to cybersecurity courses. Starting with MS students supported by one of the very first NSF CyberCorp awards, the program quickly grew and was approved to offer the Ph.D. degree.
INSC was never formally a part of CERIAS, but students and faculty often saw them as related. All INSC students were automatically included in CERIAS events, and they were frequently recruited by CERIAS partners (and still are!). CERIAS faculty volunteer to serve on INSC committees and to advise the students. It is a "win–win" situation that has resulted in some great graduates, many now in some notable positions in industry and government.
The change coming to INSC is in leadership. After 25 years as program head, Spaf is stepping into the role of associate head for a while. Taking on the role of program head is Professor Christopher Yeomans. Chris has been a long-time supporter of the program with experience as the chair of the Philosophy Department.
(If you're interested in a graduate degree through INSC visit the website describing the program and how to apply.)
An Anniversary of Continuing Excellence
In February of 1997, I provided testimony to a Congressional committee about the state of cyber security education. I noted that there were only four major academic programs, with limited resources, in information security at that time. I outlined some steps that could be taken to improve our national posture in the field. Subsequently, I was involved in discussions with staffers of some Congressional committees, with staff at NSF, with National Security Council staff (notably, Richard Clarke), and people at the Department of Defense. These discussions eventually helped produce1 the Scholarship for Service program at NSF, the NSF CyberTrust program (now known as Secure and Trustworthy Cyberspace, SaTC), and the Centers of Academic Excellence program.
On 11 May 1999, 20 years ago, Purdue University 2 was recognized by the NSA as one of the initial Centers of Academic Excellence (CAE).3 There were some notable advocates of enhanced cyber security at each institution, and they had taken steps to institute courses and research to improve the field—notably including Corey Schou (recently inducted into the Cybersecurity Hall of Fame), Matt Bishop, Deborah Frincke, and Doug Jacobson, to name a few.4 As I recall, Dick Clarke was one of the prime movers to get the CAE program established under PDD-63; Dr, Vic Maconachy (then) at NSA became the director of the CAE program.
Over the years, the CAE program has continued to expand, to now encompass several hundred institutions around the US. DHS has become involved as a co-sponsor with the NSA. The main certification has bifurcated into a designation for cyber defense research (CAE-R) and a designation for cyber defense education (CAE-CDE). There ia also a designation for Centers of Academic Excellence in Cyber Operations. The NSA, as a member of the US intelligence community (IC) also helps support a program for IC Centers of Academic Excellence. In addition to the formal external evaluation process to be designated as a CAE, the program has resulted in creation of curricular guidelines and recommended best practices for educational programs. A number of leaders in education in the field have also grown out of this process, creating various resources for the community (some of which are hosted at the CLARK website for public use).
I have been critical of the overall CAE program in the past (cf. here and here). I believe most of the criticisms I made are still valid, particularly the ones concerning the designation of "excellence" and the burden of the application process. Nonetheless, there is no denying that the listed insitutitions have made strides to improve and standardize their programs towards much-needed common goals. There is also continuing (and growing) synergy with efforts such as the NIST National Initiative for Cybersecurity Education (NICE) program and the National Colloquium on Information Systems Security Education (NISSE). Additionally, there has been real progress towards establishing standardized undergraduate curricula in the field, which now includes the potential for ABET accreditation.
Those of us at Purdue recently received notice that Purdue has been recertified as a CAE-R through 2024. This is a result—in large part—of efforts by Dr. James Lerums , one of our recent Ph.D. grads. He volunteered his time to sift through all the documentsation, gathered the necessary information, and completed the application process. It was a significant effort and kudos to Jim for taking it on soon after completing a Ph.D. dissertation!
Despite some of my "grumpy old dude" criticisms, I am glad to see Purdue continue to be recognized for the continued excellence of its programs. CERIAS continues to be a focal point for the "R" aspect of the CAE-R as Purdue's designated research institute in the field: that's the "R" in CERIAS. However, it has also been Purdue's center for education for most of its existence: the "E" in CERIAS is for Education. That history includes the establishment of the first designated degree in information security in 2000, still offered as an interdisciplinary MS and PhD (which is the program Jim Lerums completed, btw).
As for the CAE program itself, and for the 5 (out of 6) other programs receiving that initial CAE designation that are still listed as CAEs, congratulations: we've come a long way, but there is still a long way to go!
Footnotes
- I always note that I cannot claim sole or primary credit for these initiatives; nonetheless, I was the first to publicly advocate for programs such as these, and was involved in the many of the discussions. Dick Clarke deserves a good deal of credit for his active advocacy for the area at the time, as does Lt. General (ret.) Ken Minihan (also a recent CSHOF inductee) for his support.
- Via CERIAS, one year old at the time.
- Also in that group were James Madison University, George Mason University, Idaho State University, Iowa State University, the University of California at Davis, and the University of Idaho.
- My apologies to others whose names I omitted.
Spaf videos, blasts from the past, future thoughts
I created a YouTube channel a while back, and began uploading my videos and linking in videos of me that were online. Yes, it’s a dedicated Spaf channel! However, I’m not on camera eating Tide pods, or doing odd skateboard stunts. This is a set of videos with my research and views over the years on information (cyber) security, research, education, and policies.
There are two playlists under the channel — one for interviews that people have conducted with me over the years, and the other being various conference and seminar talks.
One of the seminar talks was one I did at Bellcore on the Internet Worm — about 6 weeks after it occurred (yes, that’s 1988)! Many of my observations and recommendations in that talk seem remarkably current — which I don’t think is necessarily a good observation about how current practice has (not) evolved.
My most recent talk/video is a redo of my keynote address at the 2017 CISSE conference held in June, 2017 in Las Vegas. The talk specifically addresses what I see as the needs in current information security education. CISSE was unable to record it at the time, so I redid it for posterity based on the speaker notes. It only runs about 35 minutes long (there were no introductions or Q&A to field) so it is a quicker watch than being at the conference!
I think there are some other goodies in all of those videos, including views of my bow ties over the years, plus some of my predictions (most of which seem to have been pretty good). However, I am putting these out without having carefully reviewed them — there may be some embarrassing goofs among the (few) pearls of wisdom. It is almost certain that many things changed away from the operational environment that existed at the time I gave some of these talks, so I’m sure some comments will appear “quaint” in retrospect. However, I decided that I would share what I could because someone, somewhere, might find these of value.
If you know of a recording I don’t have linked in to one of the lists, please let me know.
Comments appreciated. Give it a look!


