The Center for Education and Research in Information Assurance and Security (CERIAS)

The Center for Education and Research in
Information Assurance and Security (CERIAS)

Centers of ... Adequacy, Revisited


Almost two years ago I wrote in this blog about how CERIAS (and Purdue) was not going to resubmit for the NSA/DHS Centers of Academic Excellence program.

Some of you may notice that Purdue is listed among this year's (2010) group of educational institutions receiving designation as one of the CAEs in that program. Specifically, we have received designation as a CAE-R (Center of Academic Excellence in Research).

"What changed?" you may ask, and "Why did you submit?"

The simple answers are "Not that much," and "Because it was the least-effort solution to a problem." A little more elaborate answers follow. (It would help if you read the previous post on this topic to put what follows in context.)

Basically, the first three reasons I listed in the previous post still hold:

  1. The CAE program is still not a good indicator of real excellence. The program now has 125 designated institutions, ranging from top research universities in IA (e.g., Purdue, CMU, Georgia Tech) to 2-year community colleges. To call all of those programs "excellent" and to suggest they are equivalent in a meaningful way is unfair to students who wish to enter the field, and unfair to the people who work at all of those institutions. I have no objection to labeling the evaluation as a high-level evaluation of competence, but "excellence" is still not appropriate.   
  2. The CNSS standards are still used for the CAE and are not really appropriate for the field as it currently stands. Furthermore, the IACE program used to certify CNSS compliance explicitly notes "The certification process does not address the quality of the presentation of the material within the courseware; it simply ensures that all the elements of a specific standard are included.." How the heck can a program be certified as "excellent" when the quality is not addressed? By that measure, a glass of water is insufficient, but drowning someone under 30ft of water is "excellent."
  3. There still are no dedicated resources for CAE schools. There are several grant programs and scholarships via NSF, DHS, and DOD for which CAE programs are eligible, but most of those don't actually require CAE status, nor does CAE status provide special consideration.

What has changed is the level of effort to apply or renew at least the CAE-R stamp. The designation is now good for 5 academic years, and that is progress. Also, the requirements for the CAE-R designation were easily satisfied by a few people in a matter of several hours mining existing literature and research reports. Both of those were huge pluses for us in submitting the application and reducing the overhead to a more acceptable level given the return on investment.

The real value in this, and the reason we entered into the process is that a few funding opportunities have indicated that applicants' institutions must be certified as a CAE member or else the applicant must document a long list of items to show "equivalence." As our faculty and staff compete for some of these grants, the cost-benefit tradeoff suggested that a small group to go through the process once, for the CAE-R. Of course, this raises the question of why the funding agencies suggest that XX Community College is automatically qualified to submit a grant, while a major university that is not CAE certified (MIT is an example) has to prove that it is qualified!

So, for us, it came down to a matter of deciding whether to stay out of the program as a matter of principle or submit an application to make life a little simpler for all of our faculty and staff when submitting proposals. In the end, several of our faculty & the staff decided to do it over an afternoon because they wanted to make their own proposals simpler to produce. And, our attempt to galvanize some movement away from the CAE program produced huge waves of ...apathy... by other schools; they appear to have no qualms about standing in line for government cheese. Thus, with somewhat mixed feelings by some of us, we got our own block of curd, with an expiration date of 2015.

Let me make very clear -- we are very supportive of any faculty willing to put in the time to develop a program and working to educate students to enter this field. We are also very glad that there are people in government who are committed to supporting that academic effort. We are in no way trying to denigrate any institution or individual involved in the CAE program. But the concept of giving a gold star to make everyone feel good about doing what should be the minimum isn't how we should be teaching, or about how we should be promoting good cybersecurity education.

(And I should also add that not every faculty member here holds the opinions expressed above.)


Posted by Melissa Dark
on Wednesday, June 23, 2010 at 03:46 PM

I am one of the faculty members at Purdue who does not share Spaf’s view.  Actually, let me be more precise.  I know Spaf’s position on this topic, understand his reasoning, and see the merits in his argument.

Where I differ from Spaf is in my views of the CAE program.  I see the CAE program as first and foremost an attempt to create a community of institutions dedicated to IA.  And this is an endeavor that I think is commendable.  Are there is challenges in getting a program like this up and running?  Yes.  Are there challenges to keeping a program like this thriving?  Absolutely.  Is finding a name that attracts new institutions to the program one of those challenges - probably.  Calling them Centers of Academic Adequacy does not seem “like a dog that will hunt”, if you know what I mean.  Is finding one name that applies and is, at a minimum, acceptable, and better yet desirable to all different types of institutions to all these institutions?  Obviously. 

My hope for the program then is that, as it grows, it will find ways to continuously revisit the community building purpose of the program, which is bound to evolve, as well as to assess the community that is emerging in response and attempt to do this in a meaningful way (on what is probably a limited budget) to derive apt descriptors for both the community that we hope to build, as well as the one that exists.  Do I hope CAEs get more resources - sure.  Do I also hope the CAE program itself gets more resources so that it can grow and thrive in response to the needs of building a vibrant and robust community?  Absolutely. 

Melissa Dark


I agree that we need to find ways to build the community.  However, I’d like to see it done under some more candid means.  After all, this isn’t Lake Woebegon, where “...all the women are strong, all the men are good looking, and all the children are above average.”


Leave a comment

Commenting is not available in this section entry.