Cyber attackers aren’t passive; defenders can’t be either

But once he learned more about known cyber exploits and vulnerabilities, and started thinking like a hacker, he quickly realized that he needed to do more to protect his devices.

“It’s like in Harry Potter where they had ‘Defense Against the Dark Arts’ teachers who taught the wizarding students all the dark arts so they knew how to defend themselves against it,” said Ferguson, who works in computer network operations, or CNO, at Raytheon Intelligence & Space’s Cyber Offense and Defense Experts, or CODEX.

Raytheon Intelligence & Space, a Raytheon Technologies company, recognizes that cyber defenders need to know the techniques, tactics, and tools that hackers — be they state actors, ransomware criminals, or lone-wolfs — use, so they’ll be better able to defend against them.

There is a worldwide shortage of cybersecurity experts. Currently, there are about 436,000 vacant cyber jobs in the U.S. and 3.4 million globally, according to a report from (ISC)2, a non-profit organization specializing in cyber training and certification programs that issues an annual study on cybersecurity workforce trends.

Raytheon Technologies is addressing this shortfall through an in-house program to develop and increase these rare skillsets. Called Offensive Labs, it’s a training program that is teaching students topics such as vulnerability research, or VR, CNO, and binary reverse engineering, the process of dissecting and understanding source code when the original software code is unavailable.

“We’re approaching this from the perspective of a hacker and using our knowledge of offensive tactics to better inform how we do cyber defense,” said Tim Zentz, director of CODEX. “To help individuals adapt to this mindset, we’re working with them to determine their current capabilities and guiding them in expanding their skills and knowledge.”

In 2022, Offensive Lab’s inaugural year, 60 students completed the Offense Labs training course, exceeding the program’s organizers plan to have 50 graduates. This year, they have expanded the courses offerings to create three separate tracks of instruction and are planning to have as many as 75 students complete the course of instruction.  

“We have a couple of different paths depending on what the student’s end goal is,” said Japheth Light, Offensive Labs training director. “One of those paths is vulnerability research, where students learn to find and exploit software vulnerabilities. Another is for CNO developers, and this year we’ve added a third track for developing hardware emulation and virtualization as applied to offensive cyber. Hardware emulation provides very low-level control of a system that can be useful for reverse engineers, vulnerability researchers, or CNO developers.”

The CNO developer track is offering a new course for its students, designed to widen the applicability of the training to information technology and cybersecurity professionals.

“The CNO developer students that are now going through the program are brand new. We’re calling it DEVCORE, which is a C programming-focused curriculum,” said Mike Weldon, Offensive Labs director. “We are teaching some fundamentals, best coding practices, how to use Git and Bitbucket to store their code and all the great things involved with C programming in general. That will make them more successful on their future programs.”

They’ve also made the course available to engineers across Raytheon Technologies to provide them with the opportunity to update or improve their skills and seek new opportunities within the company.

“This shows that we’re committed to investing in our engineers, giving them opportunities to either advance or broaden their skillsets,” Weldon said. “We have quite a few junior-level engineers, but we’ve also had a handful of engineers who have been with Raytheon for 10 years or more, and they’re very good at what they do. But they were looking for a change and joined the program.”

All of the course offerings start with a general knowledge track to give every student a common background.

“There’s the opening, general knowledge module that I teach, that all of our students go through,” Light said. “It gives everybody a background in topics that are common to all the learning paths. We cover x86 assembly language, the basics of reverse engineering, and give overviews of the training paths ahead. Our students come from different backgrounds and have a wide range of experience; we want to get everybody on the same page before going on to module two.”

From there, instruction divides between the VR track and the CNO development track with each cohort receiving tailored instruction.

“For the VR students, they proceed to war games, which is a platform that has 32 different reverse engineering and VR challenges that they'll work through,” Light said. “Then we have an internal two-week class, called VR tradecraft, where we go more in depth on bug patterns and bug discovery, as well as different architectures and their protections and defeats. We conclude with a two-week capstone project, to put it all together and let students prove their mettle before they move out onto a program.”