Academic Security Operation Center meets growing cybersecurity needs

As Africa becomes a more digital continent and cybercrime grows, the need for cybersecurity and a cybersecurity workforce also continues to grow. The Upanzi Network, led by Carnegie Mellon University Africa (CMU-Africa), is meeting the challenge both in Rwanda and beyond through the network’s African Academic Security Operation Center (SOC).

“The ASOC operates on multiple levels,” said Sabine Gisagara (MSIT ’24), research engineer at the Upanzi Network at CMU-Africa. “We monitor, detect, and respond to cybersecurity threats. At the same time, we focus on preparing CMU-Africa students for cybersecurity careers, and we provide the CMU-Africa cybersecurity program to other universities.”

The Upanzi Network is an Africa-based collaboration of engineering research labs that is working toward a secure and resilient digital transformation across the continent.

Providing cybersecurity for the Upanzi Lab includes monitoring digital public goods and digital public infrastructure systems, validating threats, and responding to security incidents. Gisagara said that the team built the ASOC using open-source cybersecurity tools, allowing the center to operate without relying on expensive commercial solutions. By leveraging freely available technologies, the model can be adopted and replicated by universities and organizations with limited resources, making cybersecurity capabilities more accessible across Africa.

The system monitors more than 20 servers for the Upanzi Network and can receive 30,000 alerts in a day, with the majority of those as false positives, meaning they are not real threats. False positives are common for any system, Gisagara said, and noted that of the alerts, a few need to be reviewed.

Among the alerts reviewed by the team are indicators of common cyber threats, such as repeated failed login attempts that may signal an SSH brute-force attack, suspicious network scanning activity, or unusual attempts to access sensitive systems and services. (An SSH brute-force attack is an automated method where attackers flood a Secure Shell server with continuous login attempts, guessing usernames and passwords until they find a valid combination.) To streamline the alert process, the team is building a new model using machine learning, which will make it easier and faster to identify real threats.

Once the team built the ASOC system for the Upanzi Network, they built a curriculum around their model called SecOps.

“One of the largest initiatives of the ASOC is to train and educate students to prepare them for a career in cybersecurity, both at CMU-Africa and across the continent,” said Gisagara.

The curriculum, which can be found every semester through the MSIT program, combines operations with hands-on education, including giving students the opportunity to conduct vulnerability assessment and penetration testing–meaning students are given permission to attempt to identify and exploit vulnerabilities in a digital replica of a real-world system hosted within an isolated and controlled environment.

Gisagara appreciates the access students have to cybersecurity education. She was curious about cybersecurity before she attended secondary school, where she experienced computer science for the first time. She went on to earn her bachelor’s degree in information technology from the University of Rwanda.

"When I got to CMU-Africa, I decided to major in cybersecurity even though I did not have any background in it,” she said. To catch up with other students, she said she sat at the front of the class, asked questions, and spent her free time practicing.

After graduation, she started working as a research associate at the Upanzi Network, and eventually was promoted to research engineer, overseeing the ASOC with a team of five people. Her curiosity is now leading her to learn more about AI and cybersecurity, saying she wants to learn “how to bridge AI and cybersecurity correctly.”

Her hope is that the ASOC reaches as many students as possible, adding, “Through the cutting-edge cyberoperations course, we and our partner universities can offer valuable internships and practicums for students–empowering the next generation of cybersecurity professionals in Africa.”