Unlocking the Future: Hands-On Learning and AI's Role in Cybersecurity Education with Philip Huff

Aaron Crow (0:1.262): Awesome. Thank you for joining me, Philip. Why don't you introduce yourself? Tell us who you are and what it is that you do.

Philip Huff (0:7.334): My name is Philip Huff. I'm a professor at UA Little Rock in cybersecurity, also a researcher. And my background is in the electric sector. So I spent 15 years at a generation transmission cooperative, worked a lot on the NERC CIP standards and really that transitioned me over into academia. So now I'm working on new programs, new educational programs that help benefit resilience and...

Philip Huff (0:37.222): national security.

Aaron Crow (0:39.214): That's awesome. It's funny because similar background, right? I spent a lot of my career working in a power utility, doing a lot of stuff in NERC SIP. I, I also volunteer with an organization called ICS village where they're spending a lot of time doing the same thing from a different perspective of all about education. It's another reason why I do this podcast. Cause I know that there's a vast amount of, a knowledge that we need people to be able to come in and start taking the reins and, and we need our, the next generation of.

Philip Huff (0:52.322): yeah, yeah, great.

Aaron Crow (1:7.214): of cyber enthusiasts to come behind us to take the, take the baton as, as many of the older generation is going to start retiring and moving into different roles. And, and there's a big gap there. So I love to dive into that. It's exciting to hear. before we started recording, we talked a little bit about, cyber informed engineering. And I told you that I'll be going to I and L today. so I'm actually on the way to Idaho today. So yeah, let's, let's dig in and kind of what is it that you guys work on and what are you trying to get the message out and build programs around?

Philip Huff (1:19.270): All right.

Philip Huff (1:37.542): Yeah, sure. So I moved over to academia after, you know, working with people that are coming out with a degree, hitting the workforce, transitioning right, right out of school. And really just there's a lot of work to be done in higher ed to align what we need in the profession with with the education they're receiving. I mean, it's not all bad. It's not it's not a disaster. But there are a lot of things that.

Philip Huff (2:5.350): Students can be learning along the way that they're just not getting. A lot of times in cybersecurity and certainly in operational technology, it's kind of a hodgepodge. You end up chasing the workforce. The higher ed will chase the workforce. And the programs are kind of half -baked. You take some of your existing coursework, throw it together, and throw it at the student and say, okay, you're done. You have a certificate. Go forth and...

Philip Huff (2:34.246): and do good things. And unfortunately, it doesn't work that way. There's so many things that you find yourself in front of early in your profession that a lot of times other people are like, if you're coming out as a programmer, you may be assigned this task and it may take you a few years to get up to the point where, hey, I'm developing at the cusp of innovation and my company.

Philip Huff (3:2.150): But you have this time to grow and make mistakes. And in OT, in cybersecurity, you're faced with a lot of real world situations that are high risk, high stakes. And the education you're coming out of school with is not preparing you for what you're being thrust into. The changes you make, the things that you do, you do,

Philip Huff (3:31.782): that you don't have a lot of time to learn and make mistakes because the stakes are so high. So that's what brought me into looking at, okay, how can we truly transform our educational programs to align with what the students need coming into the workforce?

Aaron Crow (3:40.814): What you -

Aaron Crow (3:51.918): Well, you even see it in job requirements. Like when you see a job posting, you know, a lot of the and it's almost a meme on LinkedIn, you know, entry level job, but it needs 10 years of experience to see ISSP and like those are not entry level jobs. Those are those are mid level jobs. Like you can't you can't have experience without getting experience. And I get obviously with the podcast and all the posts that I do, I get a lot of folks reaching out to me. Hey, I'm interested in getting an OT cyber, but I have no experience. Like where can I get started? And.

Aaron Crow (4:20.142): And it's really hard because obviously getting that first job is difficult. And obviously a degree is supposed to be that replacing some of that experience. I don't have the experience, but I have the knowledge, right? That degree is supposed to get you, yes, this is the things that this person has and this is the skills that they're gonna have. And then they can get the experience once they're there, but you can't have both. Like you can't have these entry level jobs where you're requiring a master's degree, 10 years experience for an entry level role.

Aaron Crow (4:50.222): those people don't exist and the pay is entry level pay. Like the things just aren't aligning in that way, right?

Philip Huff (4:54.918): Right. Exactly. And both sides really, both the workforce and higher ed need to come closer together. And I get it on the workforce side. When you're hiring, you get your position approved after spending months and months or years of justifying that this is why we need this position. And so you're not thinking about the global workforce needs and your part in the global workforce. You're thinking about your position.

Philip Huff (5:24.678): Even if it's entry level, you want the best person in the world. So, everybody's writing their own individual job posting and they want the best. And it's like, you know, I get it. Like you're not thinking, well, we have 300 million shortage and workforce, you know, then you're thinking, not 300 million, but three million. And so you're thinking, I want the best out there. And that's what everybody's doing. They're hiring for one position. They're not hiring.

Aaron Crow (5:28.558): Yeah.

Philip Huff (5:54.182): for the global workforce. So there needs to be some thought given to that. That's a hard conversation. You got to get with HR and align those job postings to what's really needed. And at the same time, let's help. Higher Ed, we need to meet. If you're going to change those job postings, we need to meet you with candidates that we're teaching the skills and abilities and knowledge that you're looking for.

Philip Huff (6:24.102): certificates that are meaningful for your workforce. And I think we can get there. Cyber -informed engineering is one of those approaches.

Aaron Crow (6:36.046): So I've talked about this, obviously I'm going to a training this week, but why don't you just take a minute and explain what cyber informed engineering is and why it is so important to really incorporate into everything that we're doing in a cyber and an OT specifically in critical infrastructure, but it really for everything and why, what's the value in it?

Philip Huff (6:53.862): Yeah. Yeah. So in higher ed, we have courses in engineering and we have a full slate of courses that have many decades long syllabi that have been written and almost sacrosanct. And then you have, you know, you also have computer science, you have cybersecurity programs, same thing. Like these programs are developed and there's no...

Philip Huff (7:22.982): There's no real interdisciplinary learning that goes on. Those are in separate departments and you have your curriculum that are built in different stovepipes and outcomes that segregation that we move right into the workforce. What cyber informed engineering does is take a set of principles that exist outside of cybersecurity. So it's not just about things you need to know with.

Philip Huff (7:51.846): with cybersecurity from a risk -based thinking adversarial thinking, CIA principles, things like that. But looking at if I'm working on an engineering problem in an engineering life cycle, what are the things that can apply to make the system more resilient? Very system centric. It's not even security centric, but looking at if the goal being a resilient system.

Philip Huff (8:21.542): and the process being improved security. So that's cyber informed engineering. One of the near term goals that we have is we as in our institute kind of a region and more so the nation working with IML is looking at the community colleges. And so let's say we don't have

Philip Huff (8:51.142): get full coverage into the engineering programs, very difficult to do. But if you look at all of the degree programs and certificate programs coming out of community colleges that deal with operational technology and industrial automation, there's a huge workforce that can be up skilled into understanding the cyber informed engineering principles and not necessarily the full life cycle, but.

Aaron Crow (9:12.398): Mm -hmm.

Philip Huff (9:21.126): If you're working in operations and maintenance on a system, there's a lot that you have responsibility for in cybersecurity. And a lot of times the cybersecurity, real cybersecurity, where the rubber meets the road occurs in the operations and maintenance phase. And that occurs in the mind of the technician, not the engineer. And so...

Philip Huff (9:50.182): meeting that need at the community college level, that's almost a better launching point than trying to ramrod this into an engineering program, which doesn't have any additional credits anyway. So we're trying to make some major shifts and get it to where it is just a part of any type of societal educational program that you have these principles that have, you know, what...

Philip Huff (10:19.494): How does this impact the systems that I work on? But starting with community college, I think that's something that is certainly doable and an interesting place to start.

Aaron Crow (10:32.110): Yeah, absolutely. I mean, I think back, I went to a small, small engineering school and it was different than most of them in that even though so electrical engineering, right? I didn't, it wasn't electrical engineering degree. It was an engineering degree with an emphasis in electrical. And the difference was is in my electrical engineering path, I had to take mechanical classes and welding classes and all of these different engineering.

Aaron Crow (11:1.326): classes that had nothing to do. Like if I'd have went to University of Texas in Austin, I would have only taken electrical classes, right? And maybe I took an elect elective because I chose to, but it wasn't part of it. And the reason that the school that I went to is called Latino. It's a small school in Longview, Texas. It's a private school. And they, the reason they did that is in the beginning, our engineering professors said, we want like, we don't want you to design a system that works electrically on paper.

Philip Huff (11:6.086): Yeah. Right.

Philip Huff (11:17.762): yeah.

Aaron Crow (11:29.582): but won't work mechanically in the field when it's actually built, right? So we need you to understand enough about all of the other disciplines of engineering so that you're not designing something that looks great on paper, but doesn't actually work in the real world. And I think that's a lot of a lot of our engineering has done over the years, trying to bolt on cybersecurity into these systems after the fact. Yes, some of our systems are 40 years old and you having to do that.

Aaron Crow (11:55.918): But as we're designing these new systems, we need, we have to start putting that as part of the discipline that is part of designing the overall system, not because we're worried, and that's only because we're worried about nation states attacking us, but because it impacts the, the overall operation of the system, which is the most important part of it anyways.

Philip Huff (12:16.262): Right, right. And there's a few glitches in there. Is it on my end or yours? You know, some of the... Okay, okay. No, yeah, I appreciate that the innovative process from your school, that sounds like the way to do it. And unfortunately, there is this built on mentality with security. If you even look at the textbooks, if they talk about security as a constraint,

Aaron Crow (12:23.566): No, you're good. It's probably just buffering the audio.

Philip Huff (12:46.374): in engineering, it's usually the last chapter of the book, or it's a special topics that we may get to on the very last week of the course. And so that's where you kind of view security that this is the last thing to think about, right? Like if you have time, it's the last, and we teach that way in school. And it's...

Aaron Crow (13:7.054): Mm -hmm.

Philip Huff (13:13.830): It is a constraint. You're dealing with all sorts of constraints in engineering, real world constraints. And certainly cybersecurity needs to be part of it. The challenge is you have an intelligent constraint that is adversarially working against you. That's not as simple to address. There are not mathematical models that can overcome this problem. But still, it's a constraint.

Philip Huff (13:43.686): that needs to be considered as part of the engineering development lifecycle.

Aaron Crow (13:51.854): Yeah, and even back all the way down to, you know, back in the day, we had all of these apprenticeships and you had all these opportunities to grow and learn a trade and a craft and an area. And we've really in the past 20 plus years, I know, you know, my previous generation, my parents, you know, it was all about getting a degree and degrees are great, but that was the way out of the, you know, the lower class.

Aaron Crow (14:19.822): to get into the middle class, right? As you get a degree and that's the answer. Unfortunately, I think that too many people now, and I'm not talking about engineering, obviously this is a general overall education thing is, is there's a lot of people that just get degrees because they think that's going to get them to the next level. But the degree matters. Like what you get it in matters. Like getting a degree, just a piece of paper used to be enough to open those doors. It's not anymore. on the flip side,

Aaron Crow (14:44.942): people that go out and get a two year degree or they get a certificate in a trade, an electrician, a plumber, a welder, all these skills, these crafts are highly sought after right now. And it's part of the reason why everything's so expensive because we don't have enough of them either, right? So like for instance, my kids, I'm putting them into a private school that's Socratic based and focused. It's a school called Acton. And they make them, they have...

Aaron Crow (15:13.870): Socratic conversations every day and they don't have teachers. They have guides and the kids are more they're setting their own rules and structure, but they also have apprenticeships part of this thing when you're in high school half of the year, they're spent pursuing and winning and working in apprenticeships getting paid to work and jobs and obviously it's a 1315 year old kid. They don't necessarily know what they want to do with their life.

Aaron Crow (15:42.542): But I think part of the problem is, is it not enough people know and they haven't gotten to try it, right? You know, cyber sounds really cool, but you may get into it and hate it, but you may be really good at project management or electrical engineering. There's a lot of things, but all these things bolt together in this education system of how do we make it better for the end product to help us get more reliable systems, get cyber informed engineering, you know, have all of these things. As you said, it's really hard to change the engineering credits that are there today. The engineering 401 class.

Aaron Crow (16:12.462): But how do we have these other things that bolt on that don't take away from that, but do the other? So a community colleges and trade schools and all these other things that we can start training these people to have these disciplines that we're needing in the workforce.

Philip Huff (16:26.854): Right, right. Well, and I want to touch on apprenticeships, but I want to go back to something you said about, you know, the number of degree earners, the value of a degree is diminishing. And we are in higher ed, we're about to hit the cliff where we have the enrollment cliff is coming. And so it is evident that the number of degree earners are decreasing across the United States.

Aaron Crow (16:43.982): Great.

Philip Huff (16:54.598): However, you know, some of the hope is that you start to see a lot more innovation and education. Certificate earners are increasing actually. And from lower income parts of society where the workforce is highly underrepresented. So the social mobility with some of these community college and stackable certificates into degree programs, I think is a very, very intriguing and offers a lot of hope.

Philip Huff (17:24.422): for the future. The other nice thing about the community colleges is that they move faster. I mean, if you try to take in your, you know, from yours and my former state of Texas, try to take in the University of Texas and push through curriculum changes, same with my program, it takes an unbelievable, we don't have time on this podcast to go through the process.

Aaron Crow (17:24.846): Mm -hmm.

Aaron Crow (17:32.462): Mm -hmm.

Aaron Crow (17:51.278): Right.

Philip Huff (17:51.366): both inside the institution and the state level processes to just change that curriculum. But community colleges work at a much faster level. That's why you see like green energy jobs, solar jobs, they hit the program, the degree programs, their offerings very quickly to meet the workforce needs. So they're a great place to start with this gap.

Aaron Crow (18:5.934): Mm -hmm.

Philip Huff (18:19.526): of knowledge that exists in the profession and that is soon to exist even more with all the people retiring is that we have, let's work with our community college partnerships. They're all over the Nation Unbelievable Network and start embedding that curriculum there. And what first got me thinking about this is that, you know, I've worked in the operational environment and I know you have as well. And...

Aaron Crow (18:33.870): Mm -hmm.

Aaron Crow (18:47.214): Mm -hmm.

Philip Huff (18:48.454): What pains me is the fear associated with cybersecurity. You have incredibly brilliant technicians who have, I mean, they have spent their life with that environment. They know the system better than anyone else. But then cybersecurity comes along and throws a lot of, you know, NERC SIP acronyms.

Philip Huff (19:15.238): at them a lot of regulatory, a lot of new computing terms, and it just kind of confuses the whole, you know, confuses that whole environment, that whole system, and not really working with the operators and technicians to understand, okay, here's what the consequences are if you do that. And that's where I think the future...

Philip Huff (19:43.622): workforce. My fear is not the senior level engineers that are retiring. It's the people that are working at the plant that have been there for 30 plus years that are retiring. That knowledge gap is what affects resilience more than anything. And if we can start bringing in like an impression model, bring in people that can learn from, learn what the system does and how it impacts society.

Aaron Crow (19:54.318): Mm -hmm.

Philip Huff (20:12.902): and everything and then work in knowledge of cybersecurity. That's a pretty powerful knowledge to go into the workforce. What I hated was just fear to move. If you're working in that plant and somebody's throwing all of these things at you, it's very confusing. NERC SIP by itself is very confusing. And you just feel like you can't do anything with that system.

Aaron Crow (20:36.494): Yep. Yeah, absolutely.

Philip Huff (20:42.438): anymore because you're going to get your hand slapped. And you don't know, like you may know the network paths in, but then there's these other connections. Maybe we buy a new solution. It's a multi -million dollar solution. We drop it into your plant and then we leave. There you go. There's your security. And never mind the fact that I can't print.

Aaron Crow (21:5.230): Mm -hmm.

Philip Huff (21:10.534): the reports that are required to be printed on this line printer, I can no longer work. I have to get to these devices in the sixth floor. I've got to do my job. And so I have to re -engineer that somewhere because you're not coming back. And so they are responsible for these decisions on a day -to -day basis. And if we can inject more knowledge and understanding of the operational...

Aaron Crow (21:27.630): Right.

Philip Huff (21:40.326): what operational changes, how those affect the system security. That's not a PhD level thing to do. I mean, that's something that is feasible. That's something that education we can do better at.

Aaron Crow (21:48.654): Right.

Aaron Crow (21:55.534): Yeah, absolutely. I mean, I think back at all of the things that, you know, my team has done and one of the reasons I've been so successful in my career is because I've had enough understanding of the operational side working in power plants and, you know, wearing those hard hats and steel toe boots. I understand their concerns, right? Because when my team left, because, you know, I worked in Dallas, my office is in Dallas, but the power plants were never in Dallas. They're always in the middle of nowhere in Texas, right? They're four hours away or six hours away, depending on where it is.

Aaron Crow (22:25.582): And it's three o 'clock in the morning on a Saturday. When it breaks, my team's at home, right? They're sleeping in their bed and they're four hours at minimum away. These guys are the ones responsible. They're also the ones that their bonuses have tied to it. Like all there's a lot of factors that make them hesitant to accept these changes specifically because they've probably been burned a hundred times from, you know, I actually had a, I was going to have a t -shirt made that says I'm from, I'm from corporate and I'm here to help. And then on the back, on the back, it said, see you see on Monday, right?

Philip Huff (22:52.070): Bye!

Aaron Crow (22:55.438): Because that I'm right there. That was that again, one of the reasons I was so successful. Yeah. Right. That's right. But that's one of the reasons my team was so successful because we worked in outages. Like we worked the same schedule that the teams did. So we were working, you know, three month, 16 hour day outage schedules right next to those people. So we built that camaraderie in that trust because they knew we would be there at the same time as them. We weren't just going to drop something in on Monday.

Philip Huff (22:55.462): Alright. Unless Monday's a holiday. Then I'll see you on Tuesday.

Aaron Crow (23:24.782): or Friday at four o 'clock in the afternoon and then go home for beers and then we'll see you like you said either Monday unless it's a holiday and then we'll be back on Tuesday like they worked on weekends. I worked on Christmas. You want your electricity to work every day of the week, especially Christmas and so somebody's got to be there working right?

Philip Huff (23:41.798): Right, and the people that are working in these environments are very proud of what they do. And it's not just that it's not a job to them, they are providing value to society. Very similar to like a healthcare worker. And so tapping into that sense of duty and pride, I think is just an incredible opportunity.

Aaron Crow (23:47.950): Absolutely.

Aaron Crow (23:57.454): Yeah, absolutely.

Aaron Crow (24:6.734): And roughly so these are some of the smartest people I've ever worked with in my life. Like these, these are, this is not a knowledge or an intellect problem. It's, it's a problem of they know how, what it takes to work. And they, they know that you met, you probably don't know what it takes to work. Yes. You're really good at the cyber. You I'm pointing at myself, you know, I'm good at the cyber stuff, but do you really understand what it takes to run this plant? Because when you're gone, I have to support it. And if I don't believe that you understand it, then I'm not going to let you plug your thing onto my network because it can cause problems. And I'm going to be the one left hold in the bag when you're.

Philip Huff (24:9.990): Exactly.

Aaron Crow (24:36.462): at home drinking a margarita and I'm the one sitting here at the plant having to make this thing work and my boss and everybody else is screaming at me.

Philip Huff (24:43.878): Yeah, exactly. And that's what we want the workforce coming in to have that empowerment, to have that upscaling of knowledge that not only this, you know, if this new device or this new security solutions coming in, that you can ask thoughtful questions, but you can guide them in the process of integrating that technology appropriately. And you understand the truth risk.

Philip Huff (25:11.526): and can't really be duped by the theatrics.

Aaron Crow (25:18.798): Well, you know, so my dad worked in the power industry for 40 years. It's why I did it, right? He supported power plants and, you know, it paid for my college. It put food on my table and all the things. He joined the company. He was 18. He graduated high school, I think on Friday, he says, and Monday morning he was working at the company. So he did a co -op program. So basically he would do six months working at the company.

Philip Huff (25:23.622): Awesome.

Aaron Crow (25:45.358): And then he would go to a semester of college and then he'd go back and work for six months. And then he'd do a semester of college. So he was full time. So it was almost like an internship. They were paying for his college. They were paying for the degree that he was going to, but he was also getting on the job training at the same time. So it was kind of a best of both worlds because they were training him to be a good employee and business processes and all the things that you don't necessarily learn it in the books. Right. And then the school was teaching him the ins and outs, the ones and zeros and.

Aaron Crow (26:14.414): you know, electrical theory and all that kind of stuff, the book side of things. So he was able to do both things. And also he was extremely poor and he was able to go to college without having debt. Again, this was, you know, he, he was born in 48. So this would have been way back in the sixties, but still he was able to get a degree without being able to afford it. Like he wasn't the smartest. He didn't have, you know, athletic scholarships or anything else, but he was able to get a job.

Philip Huff (26:30.022): All right. Yeah.

Aaron Crow (26:41.966): and both the company and he were able to get out of it what they needed by doing this co -op program. Now it took him longer to get a degree, but he didn't care. Like it doesn't matter how long it takes you. If I've got a job and the company's working with me and it's both benefiting if it takes us four years or eight, as long as I'm employed during this time, I don't care. Like the company doesn't care as long as they're growing and they're getting this different product at the end. That's going to uplift that person, the people resource as well as the company overall.

Aaron Crow (27:10.926): by having a really capable person that we've grown into this next level, man, that's just a win -win. And I just don't see that out there in the marketplace, both either from corporations or even as colleges pushing this, like, hey, why don't you try apprenticeships and co -ops and these other alternative ways that we can do this and start getting these people that we're missing and getting skilled labor or people resources.

Philip Huff (27:36.422): Yeah, that's a great example. So I mean, there's two areas, I think, if we take your dad's experience and look at, okay, how could we in education learn from that and the profession? I mean, that, and this goes back to apprenticeships. Like you can't replace that experience of being on the job and having real impacts take place. That's not something that...

Philip Huff (28:5.158): we can reproduce in the classroom. So we have to find a way to get closer to that environment. I think apprenticeships is a great model. I think one of the things we're doing with cyber -informed engineering is a competency -based credit, but competency -based education, looking at everything. Because we build our programs looking at student learning outcomes, but there's no guarantee that those

Philip Huff (28:34.598): learning outcomes are going to help them at all. And so to better align with what's really going to help them in their career and their profession and their life, we have to look at those learning outcomes from the perspective of what is the competency that they're going to be able to demonstrate and it's going to help them in their career. So we really need to transform.

Philip Huff (29:3.974): not just take the cyber informed engineering and apply those principles to the community college, but look at how can we transform those and not just here's your learning objectives in the syllabus, but like here are the competencies that we're certifying that this individual has. Then that, I think that from your dad's experience, like that was the intent. Like the organization finds value in that certification.

Philip Huff (29:33.638): we have to do the same thing. I think a lot of the problem is there's not a perceived value in the certificate, in the education. And that needs to change. For all that we invest in education in this country, we have to look at getting that closer to the value proposition for the careers that these people are going into.

Philip Huff (30:2.758): So, I mean, and that's one way. The other is to give them credit for what they know and what they learn on the job. I imagine your dad probably had a lot of education that he already knew. He had a lot of lectures that he probably could have given. And so really our role in higher ed is to certify from a workforce perspective is to certify that this person.

Aaron Crow (30:7.502): Right?

Philip Huff (30:30.726): has the knowledge, skills and abilities that you're expecting. And if they already have those, they don't need to come to drive to campus at 6 p and sit through my three -hour lecture on Monday evening. If they already know that isn't that's not helping anybody that doesn't help me. It doesn't help them. Let them we if we can come to an understanding of what the competencies are.

Aaron Crow (30:48.782): Right. Yeah.

Philip Huff (30:56.198): and find a way to assess and certify that, then we're doing our job much better in higher ed, getting closer to the value that the organization understands.

Aaron Crow (31:7.502): 100 % agree. And that triggers me on the next side of this that I see is we have a lot of skill. We talk about AI, we talk about the next technical revolution and how it's going to change the workforce and how we're going to have people that are unemployed, they're going to lose their jobs because the things they're doing is no longer required. You think back to the horse and buggy, you think back to the assembly line, like all those things, right?

Aaron Crow (31:31.758): But we have a lot of people that are really skilled and they have a lot of knowledge in different areas. So how do we use this same process? It's one thing for a, for a, you know, high school kid coming into college to go through this process, but how do we retool somebody that's maybe 20 years in their career and they're really good at what they're doing, but they want to do something different to your point. Like they need to be able to get some credit for the things that they know how to do. They don't need to take, you know, all X number of hours, like they're a college freshmen because they're not.

Aaron Crow (32:1.326): They spent all of this, this time in their career and they have all these experiences. So let's give them that. So that way they're not overwhelmed with, well, I don't want to go to school for four years to retool. I can't, it's too long for me to show value. I can't, it's too much of an investment, both time wise and financially. And you know, then I'm going to take a step down in my career. Cause then I'm a newbie like all of those things. But you know, I get people all the time that are reaching out that are, that are programmers that are, you know, technical, really good technical people. And they want to get into cyber, but.

Aaron Crow (32:30.766): they same thing, they can't get an entry level cyber job because they don't have any cyber experience. So they're looking for certifications and things like that. They can check that box and say, yes, this person has this skillset, you know, let him in the front door. Right. And so there's another, you know, kind of avenue to consider with this as we're going out in this workforce development, we don't just need to focus on 18 year old kids. We also need to have some mid -level folks that are changing careers that, that we want to also be able to give them the certification to say, Hey, these people are also good for.

Aaron Crow (32:58.990): more than just an entry level type role.

Philip Huff (33:1.734): Yeah, yeah, there may be one or two courses that they see that I'd really like to, I'd really like to take those. And then if we come back and say, I'm sorry, we have two years of prerequisites you need to, to take your butt needs to be in a seat for this many hours before you can, that doesn't, that doesn't make sense. So, so yeah, I mean, we, we need to move a lot faster, be a lot more nimble to.

Aaron Crow (33:14.862): Right.

Aaron Crow (33:20.782): Right. Right, right.

Philip Huff (33:30.630): to come up with new programs of study that allow people to return and find the up skill in the ways that they want. I think cyber informed engineering is a great way to allow that, that they have been in the field for this long. And there may be two or three courses that, hey, we'll cover these and you don't have to be graduate level. You don't have to have your bachelor's.

Philip Huff (34:0.102): And you can just come in and get the knowledge that you need. I think that's the, in most programs, that's kind of the ground that we need to hit. That's our target zone.

Aaron Crow (34:16.654): That's perfect. Cause I mean, ultimately the end goal for us all should be to train people to be able to do the roles that we need them to do. Right. It's not about, like you said, it's not about sitting in the seat for two years to make sure that you sit here. Cause just sitting in a seat, as you know, like it's one thing to be busy. It's another thing to be productive, right? Sitting, sitting in a seat for two years does not mean that you're actually going to come out the other end with the right knowledge. The same thing on you can sit in a seat for 30 minutes and be extremely capable.

Philip Huff (34:35.206): Yeah, yeah.

Aaron Crow (34:46.750): and come out and be valuable. So it's all about the value add and adding the, the skill sets to people to know, but both give them the confidence that they are ready to do to take that next step, as well as give the employers that something to say, you know, to, to judge it, you know, what, what is it agree? It's something to say, Hey, if they have this, then I know that they should at least have these capabilities so I can plug them into these types of roles and they should have some, at least this level of understanding of those types of topics. I should be able to.

Aaron Crow (35:15.502): have a conversation and, you know, drafted communication and be able to, you know, have a dialogue with somebody. And from like an engineering perspective, they should under understand electrical engineering, you know, principles, at least at some level, because they got a degree in it, and they pass their math class and calculus and, and all that type of stuff. They can do those things, even if they're using a calculator, I don't care, they understand the concepts. That's the important piece. So then I can bolt on our, how we do it. This is the theory, and this is how we do it.

Aaron Crow (35:43.342): We need to do that same thing from both entry level folks as well as the mid level. And man, that that that's exciting. I know I see us villages doing some work, work force development stuff with with the DOE. I know you guys in I and L. So I see a lot of really good work being done in this area, which is why I'm very appreciative of you coming on here to talk about it, because it's very near and dear to my heart. You know, I've got three kids, so I want my kids to have something that whether it be an engineering or cyber or whatever it is.

Aaron Crow (36:12.782): that they're not just going in, you know, for the first time I hear so many people, adults, people with kids, you know, that are like, I just don't know if I want my kids to pursue a degree because they see how expensive it is. And they see all of these kids that have master's level degrees and they're working at Starbucks. And again, I'm not trying to throw any shade on anybody that works at Starbucks, but you don't need a degree to work there. You don't need a degree to be a real estate agent. You don't need a degree to open a business. And I...

Aaron Crow (36:39.950): So it's not to take away value from a degree. It's to say, we need to put value back in and make sure that when you're going after degree, you're doing something that at the end of it, when you have that piece of paper, it's going to be valuable to you to open the doors that you want it to open.

Philip Huff (36:54.406): Yeah. Yeah. It's a confusing time in the work workforce. And it's hard entering the workforce. I was talking, I have four kids, some close to you. And I was talking with one of them and they're just watching how, I forget which large language model we were using at the time, but just watching how what they've been learning is just fully automated. And it's telling them that very likely your teacher is also using.

Philip Huff (37:23.462): this to assess and he was like sitting there and he's like, so if that's producing the work product and the AI is assessing the work product, what's my role in all of this? What's my role in education if this is just a dance between the AI and so it's sad to see this transform so

Philip Huff (37:52.454): quickly and our institutions of higher ed are really meant to help people and to provide a space where we can think together and think about some of society's grand challenges. And to do that, I think we need to come up with a way to get people into these institutes in a way that values their experience, values their skills. I think, for instance, with cyber -informed engineering,

Philip Huff (38:22.790): having somebody that's a 30 year, 40 year professional that knows this inside and out coming into the classroom. I mean, that is a huge benefit to the students and a huge benefit to that person. It provides them an avenue to teach. Like at your community college, your local, we have a great infrastructure of institutions of higher ed where this learning can take place. And if we open that up,

Philip Huff (38:50.246): where these veterans can get into the classroom and we provide a conduit for their vast amounts of knowledge that some really beautiful things can take place in that environment where students come out with something really valuable, really important to their career and to their life.

Aaron Crow (39:14.574): Yeah, and again, going back to my kids and one of the reasons we chose, we pulled our kids out of public school and you know, we were in a good public school. It's not that the public school is bad. It's just I believe the public school system in general lost its way, right? And you know, the kids are they hated school every day. They dreaded it. They didn't want to be there. Most of the day they were sitting around not being productive. You know, there was a lot of punishment. There was a lot of, you know, follow this rule. It doesn't make sense. There was no dialogue like.

Aaron Crow (39:41.550): There was no questioning. This is the answer. There's no dialogue of why none of that, right? And none of the critical thinking things that makes us valuable in the workforce, honestly, in my perspective. So we pulled them out and put them into something else. And part of that is because if nothing else, learning should be fun. They should be excited to go learn. Like when I'm working a problem and, and, and, you know, I've been doing this a long time. I've been doing technology since, you know, the mid early to mid nineties, right?

Aaron Crow (40:11.278): When I'm having the biggest problem and struggling the most, that's I love that. Like my mind is just I'm in. I'm in the I get in this zone and everything else just goes away and I just start. It's like that's all I'm focused on in this thing. And when I solve that thing, it feels amazing. I love it. Like it's high fives and you know, break open a beer, but you have to get to a place where you enjoy the learning. You enjoy the process of struggle and difficulty and all those things. But you know,

Aaron Crow (40:39.406): I have conversations with my wife and she had such bad experiences with math, for instance. And at some point in her career or her educational career, like she got out of whack and they didn't teach her a step. And as we know, if you miss this step in math, none of the others are ever going to make sense because you don't understand this foundational thing. If you don't understand multiplication, you're never going to be able to do calculus, right? If you don't understand algebra,

Aaron Crow (41:5.550): You're never going to be able to do calculus. Like it doesn't matter if you can grasp the concept. You missed a piece and it's a, it's a dependent. It's dependent upon that being able to be there, making learning fun from kids all the way up through, through high school, college, you know, even as we get older, like just because I graduated does not mean that there's a reason to have all these books on my shelf back here. I'm a, I still read, I read more now than I ever did as a kid ever did in college, right?

Aaron Crow (41:31.854): I'm continual learning. I'm going to a class this week for cyber informed engineering. I've been a CTO. I've done all these things. Learning is never over. Like I have to continue to be better and learn new because I enjoy it, but we have to make it that much fun for kids and in adults and people in education. It shouldn't just be, God, I gotta go take this class and be like, I get to go hang out with Philip and here's his lecture tonight. Cause I'm excited. Like it's always amazing. And I learned cool stuff every time I'm there. Right.

Philip Huff (42:0.774): Maybe not me, but yeah, somebody else that has come into our institution. But yeah, you're absolutely right. Like a lot of education, we've had a sequential path to success and a well -defined path to success. I think it's very scary now as a student, even in education, like the things that we thought were bedrock.

Aaron Crow (42:1.998): Hahaha!

Aaron Crow (42:6.446): Right.

Philip Huff (42:29.446): that are being automated. We spend so much of our education on grammar. We spend so much, there's probably two or three years of multiplication facts in our math. And they don't align with that love of learning, with the real experience of learning, the trauma of learning, something that's exciting that you have to, that rigor and just the passion.

Aaron Crow (42:42.606): Right.

Philip Huff (42:59.110): So there's a lot that I think needs to transform in education. We're often very slow. But the world, the workforce is changing at such a pace that the questions of value and the questions all over that people are asking, why am I doing this? We're really not able to answer those very well sometimes. And so I think we...

Philip Huff (43:28.006): I love your passion for learning and for your kids. That is where we need to help them see, find meaning and find value in what they're doing and find excitement in pushing the boundaries and being able to excel in something.

Aaron Crow (43:53.966): Well, and it's funny cause like building teams along the way, you know, I took people from it that had never been to an OT side or been to a plant and I took operators that had never done any technology stuff whatsoever. And I built teams with these people. And the cool thing was, is the technology people could teach the operational people all these things on the technology side that they were missing in their knowledge space. And the operational people could teach them decades of.

Aaron Crow (44:22.926): plant experience and understanding of why things are done this way. And it was amazing how well those teams worked. And it was because each of them, they were on the same team working towards the same goal. And this person had different skills and experiences than this person, but they worked together and together one plus one didn't equal to it equaled like 12. Like I could send those two people together to a room. The operational person got immediate, acceptance at all the other plants because he'd been there for.

Aaron Crow (44:52.174): you know, 20 years and he'd been working in power plants for that entire time. And he brought this technology person with him that completely credentialized on the, on the technology side. And again, they, it was an unstoppable force and it was around, they knew what they knew it and they knew what they didn't know. And if they, if it was a technology thing, he'd be like, yeah, that's why I brought him. And I talked the operational stuff and he talks to technical stuff, right? And together they were, it was an unstoppable combo. And how do, how do we,

Aaron Crow (45:21.230): bring that into the workforce today, right? And making sure that we're including the right people and admitting when we don't know the answer, that doesn't mean you're less than. You're gonna make mistakes. You're gonna not know the answer to something, but it's just like anything, like know where to look it up, know who to talk to. Like that's the most important piece. It doesn't matter. You know, in calculus, I remember my freshman year of college, I took an engineering calculus class, like university physics and had calculus, all this different stuff. And the professor was like, I had a TI -92 calculator. It's one of those.

Philip Huff (45:50.470): Yes.

Aaron Crow (45:51.022): big ones, you know, had the Korty keyboard on it and everything. And he's like, you can use your calculator on absolutely every test. And I'll even give you the calculus, you know, all of the, the, the formulas, the calculus formulas, but you still have to show your work. So it doesn't matter that you can get the right answer because if you can't show your work, it doesn't matter. So I knew I could put in the question, I could pop it into my calculator and know what the answer was, but I still had to spend three pages to show the work to get from the question to the answer. Otherwise I got a zero, right?

Philip Huff (46:19.238): Right. Yeah, we have we really need to to transform the way we we bring realism into the classroom because what you're talking about exactly that's the learning environment we desire where people value these these shared experiences or this this error that they're not aware of and they're learning from each other and learning how to listen. Unfortunately.

Philip Huff (46:46.054): A lot of our programs are a lot of the, the, what you see in business takes place very early on, maybe even in K -12 where students are learning in an isolated environment and they're being rewarded and punished in isolation. And so of course, when they get into the workforce, you create your silos of excellence. If you will. I'm not going to, I'm not going to work with those stupid IT people. I'm not going to work with those stupid engineering people.

Aaron Crow (47:11.950): Right.

Philip Huff (47:14.566): and you create these divisions and adversarial relationships that are a detriment to everyone. Nobody likes that. One of the challenges we have in higher ed is, or in any education, education from K -12 through higher ed is creating team environments that are meaningful. Because you've been on teams and you've been through courses and, okay, we're assigning you a team to work on this toy problem. And what happens is,

Philip Huff (47:44.358): you learn all of the worst parts of humanity because well, so -and -so doesn't, they're not doing their work. And then I'm going to pay this person to do my work for me. I'm going to beat you up if you don't, if you give me a bad ass, you know, like all of the, I think students come out, we've focused so much on working in teams that they come out of education with these like manufactured teams, like, well, that's not the way to do it. And.

Aaron Crow (47:56.494): Right.

Philip Huff (48:12.166): And I think bringing us closer to through apprenticeships through one of the things I want to talk about a lot. I know we're kind of toward the end, but like clinics like cybersecurity clinics, I think that's a great place that let's take our learning environments, tie them with real problems in society that are not are not being solved by the market. You know, there are a lot of people that are suffering from ransomware attacks and and understanding risk assessments and understanding what what is that risk in their organization.

Philip Huff (48:41.350): tie the learning environment through apprenticeships, through programs that create a sense of realism where teams are working on real things and not on our manufacturer toy problems. That gets to that environment where you're like, yeah, this is invigorating. This is the greater human experience that we're able to share and become, you know, have this multiplicative effect of being better together.

Aaron Crow (49:9.230): Well, and for me, so I've also in my career, I've built labs. and when I say lab, I built physical environments. So at the power utility, I took actual control systems and the same exact hardware and configuration, and I put them in a lab. And the reason I did that was because we could, we could try things in a safe environment because they'd never let me play in production for obvious reasons. So I've built the first one I built was about a million dollar lab, which

Philip Huff (49:15.878): Yeah, awesome. Yeah.

Aaron Crow (49:37.870): sounds like a big number, but you know, and, and OT and these control systems, that's really not that big. and the second one was like three. And then, you know, I built these very, very large. So I had balance of plant and Emerson and Foxboro and GE Turbic Mark six, turbo control systems and a full blown, you know, transmission substation with all the SEL equipment and all the routers and all the things. What that, the thing that they're not even grasping is they have these environments sitting there idle most of the time.

Philip Huff (49:40.454): Yeah, it's like a rack. Yeah.

Aaron Crow (50:7.982): So if they come very large power utility in North Carolina, let's just say that. And if that comp, if that company were to partner with the local education and say, allow, you know, it to be used for an education purposes and use these labs, they may get work out of it. They may be able to do, you know, bring, you know, people workforce into their environment and have an understanding of how they do things already. So that co -op program.

Aaron Crow (50:38.062): type thing, but also they could get them to solve real problems, right? You're working with real equipment and, and not only that, but from a learning perspective, it's really cool and it's fun because you're playing with real stuff. It's not just, you know, reading a, you know, a word problem and having a dialogue in a, in a hypothetical situation in a classroom. I'm actually looking at real equipment. I'm going to a substation. I'm seeing this stuff in the real world and that makes it different, right? It also helps for me. I'm very much a hands -on learner.

Aaron Crow (51:7.854): I could read something in a book 50 times and not grasp it. I can do it one time and I'll never forget it. I remember IP addresses from, from servers from 20 years ago. I don't know why my mind works that way, but it's just the way that it is. It kind of is, but, but the, the, the flip side of that is, is that when I'm in that space, man, I can learn anything. If I'm, if I just figure it out, right. And it's the same thing I do with my kids. Like,

Philip Huff (51:19.494): Sorry, sounds like a curse.

Aaron Crow (51:34.862): when they ask me how to do something, I make them go try it themselves first, right? It goes back to that Socratic learning method, right? It's one thing to just read something and regurgitate it for a test that maybe you don't remember the next day after the test, but it's another thing to remember something because you figured it out. Like it clicks something else in you when you figure out how to change your oil, how to change a tire, you know, how to troubleshoot something, not because you just...

Aaron Crow (52:2.670): because you read instructions on YouTube and you just followed ABCD, but because you had to tinker and figure out because nothing worked and then, all of a sudden you figured out how it worked, right? It's a different thing that you're learning. And that troubleshooting skill from an employer perspective, I can take a mechanic that can troubleshoot things and I can teach him technologies and he'll be one of the best technologists, you know, operators or technologists that you'll ever have because that skillset of troubleshooting and figuring things out, dealing with ambiguity,

Aaron Crow (52:31.982): A lot of those skills are not, you can't teach that in a book as you know, right? It's not something you can teach. You have to experience it to learn how to troubleshoot, how to figure something out when you don't, when you ask people and like, I don't know, go figure it out, right?

Philip Huff (52:46.406): Yeah, that's why that partnership with industry is so important because that's not something that we can manufacture in the classroom. Even our top performers, those students are looking to do meaningful things. Regurgitating content is... Nobody wants that. As the university, we don't want to create assessments that are regurgitating facts, and the students don't like that.

Aaron Crow (53:15.246): Sure. Yeah.

Philip Huff (53:16.518): We do that because we don't have those connections in place. And it's a profound waste of human intellect to manufacture assessments that regurgitate facts. And so if we can tie our assessment to a competency that's valuable to them, then that's where we need to be. Find ways to, you know, ICS Village, how do you make an ICS Village and, you know, the...

Philip Huff (53:43.622): 9 ,000 community colleges across the nation. Yeah.

Aaron Crow (53:46.318): Right? Absolutely. And that hands -on piece is, is, is so impactful. You know, I got into this industry, you know, I told you, I was doing electrical engineering and, and I started doing computers because I just tinkered in and I was good at it and I started working in it. And it's really what took me down this path of doing networking and IT and technology and then onto OT and cybersecurity and, and all the things that I did, it had nothing to do with what I learned in a book. It was all things that I learned. You know, I was sitting in a job and, and.

Aaron Crow (54:15.374): they needed some work done and nobody was staying around and said, you do it. And I'm like, I don't know how. And they're like, nobody else does either. Figure it out. Right. And almost every, every part of my career, I can point back to any major jump from here to there in my career was because of something like that, because I just stepped up and had to do something because nobody else could do it either. Right. And I, and I just took the opportunity and because of that, it, I learned something new and it became a valuable skillset. And

Aaron Crow (54:41.422): We're sitting there with AI, with cyber security, with cyber informed engineering, like all of these spaces, it's a great opportunity for people that are interested. Now is a great time because there's this large gap, this void of, of, of spots and people that we need to fill them. so it's a cyber's not going anywhere. engineering is not going anywhere. It's a great space to be and to, and to pivot into whether you're, you're an 18 year old kid, you know, or 20 something or whatever, you know, in the beginning of your career.

Aaron Crow (55:11.342): or your mid level, or maybe you're even at the end of the career or towards the end of your career and you still want to pivot. Like it's still a great, we need all of those levels and people, diversity and differences of thoughts and experiences are just all going to help us all around.

Philip Huff (55:25.062): Yeah, AI is not removing the human vice. I think we're injecting our human vice into AI and because of that cyber security is going to.

Aaron Crow (55:36.206): Exactly. Exactly. Well, awesome. Hey, so kind of my wrap up question here is the next and we've talked about a lot of this, so it may just align with the conversation we've already had, but the next five to 10 years, what's something that you're excited about coming up over the horizon and maybe something that's a little concerning that that we need to take action or make a pivot if if we don't make a change.

Philip Huff (55:57.638): I love the things that are accessible to us now through AI. I think the shift in AI is exciting to me to see reading, writing more levelized and accessible to everyone. I see a lot of changes in education that could really improve just to improve that knowledge you have improved us being able to give access to.

Philip Huff (56:27.302): to some interesting and to be able to explore some interesting things that we just haven't been able to before. I'm excited about robotics. I'm excited about where we're going with automation. And the same, all that scares me as well. I think, you know, it scares me from the educational perspective because if everything is so accessible and there's no rigor,

Philip Huff (56:57.222): then are we cheating our young people, our students out of an education without kind of guiding them through? Because we have, I'll be honest, we don't have really great ideas of how to navigate AI right now in education. And so that's fearful to me. If you've ever played an instrument, ever done anything that just you...

Philip Huff (57:23.493): It's painful and you have to go through that terrible process of education. Do we cheat ourselves out of it so much that we're not pushing ourselves, we're not driving to the next level. So we...

Aaron Crow (57:39.854): Yeah. Yeah. It, it reminds me of the, was it Sheldon or whatever, where, you know, he, he tried to learn to swim by reading the book. you, you, you can read a lot. You can read and learn a lot of things in books, but it's really hard to take, you know, something like swimming or riding a bike and read a book about it and then go actually do it in the real world.

Philip Huff (57:49.062): You

Philip Huff (58:0.390): Yeah, there's a level of rigor that you have to be deep, deep into the problem to see the innovation. And if we're teaching our students to stay surface level, let the AI do the hard work, then are we getting deep enough to really see the innovation?

Aaron Crow (58:22.094): Yeah. And what are we going to miss because of that? Cause we don't have anybody diving in and doing those deep level conversations. So now that's awesome, man. I appreciate you guys and the work y 'all are doing. I think it's super important. the next generations, are, are, are pivotal, depending upon, you know, us figuring this out and finding a way to make it, you know, approachable and valuable for not only the, the, the educator, but also the educator as well as, you know, the industry, right. And, and,

Aaron Crow (58:49.422): and people hiring and being able to fill these voids that we have and that we will have and continue to have in the marketplace. So awesome. So how do people find out? How do they learn more? Like what is the call to action for you?

Philip Huff (59:2.374): Yeah, so you're going out to Idaho National Labs. They run a cyber informed engineering, a few groups, but the cyber informed engineering education working group, that's where I'm spending most of my time working on standards of, because we don't have this developed out yet. This is something we need help with. What competencies do we want to see in the next generation? So get engaged with.

Philip Huff (59:29.510): With that initiative, let's push these programs. Let's look at what certificates, how can we associate our learning with how we hire, what we want out of our education system you have to put into your job postings. And let's get those aligned. But yeah, take a look at that Idaho National Lab, their Cyber -Informed Engineering Education Working Group. They also have a industry working group.

Aaron Crow (59:46.382): Yeah, exactly.

Philip Huff (59:59.046): and let's try to implement some of these changes.

Aaron Crow (60:3.438): Awesome. Hey, well, thank you so much for your time. Everybody. All the, all the links we'll put in, in the show notes here. definitely reach out to me or Phillip for, for any questions that you have on that. Definitely check out I N L. Thank you for the time. Phillip. I really appreciate your time today and, look forward to helping in a new way I can and, help them push the push this forward for you guys.

Philip Huff (60:21.510): Likewise, thank you, Aaron.

Aaron Crow (60:22.830): All right.

Transcript lightly edited for readability.