EDITOR'S NOTE: This story was originally published as the "5-on-5" feature in GCU Magazine. You can access current or past issues of the magazine digitally here.
His students may be working with white, red, gray or black hats – the categories of hackers – when they dig into cybersecurity vulnerabilities, but for Dr. Dwight Farris, faculty lead for information technology and cyber in the College of Engineering and Technology, it’s just another day in the sandbox. That’s the play space where he sets up the battles between the black hats, or malicious hackers, and white hats, or ethical hackers, and the red, blue and gray hats in between. Farris, who has gone from working as a systems engineer at FedEx, to a network security engineer at Target, to higher education at various institutions, came off the battlefield to answer a few questions.
1. You were a radar and navigation maintenance technician aboard combat ships in the Navy with combat experience in Kuwait. The rumor is you were also a Navy SEAL. What’s the story?
That is correct, but I can’t say which team. I was a little older than most when I went in. I was already in my 30s, and I was in there with all the 18-, 19-, and 20-year-olds. Most of the physical activities weren’t that bad. I love swimming, and I do it all the time. I proved I could overcome all the challenges they gave me.
2. We heard you’re a trumpet player. What called you into the technology field?
My undergrad degree is in electrical engineering. There’s an interesting story here, because I was initially in fine arts, and I was going to be a music major. But then a professor and a high school teacher said, “Dwight, don’t go into music, you’ll spend your whole life and not make anything. You should be either a scientist or an engineer.” I had scholarships at both Arizona State University and the University of Arizona. I ended up going to the U of A. I was a tinkerer, and this was before PCs, when if you were interested in tinkering, you’d buy and put together those RadioShack circuit boards.
3. Was it a natural transition from electrical engineering into technology, cybersecurity and teaching?
When I was in the Navy, I did a lot of security, cryptography and all that. It piqued my interest because it was actually much better than the engineering job that I had – a desk job. This is one of the reasons I joined the military: to do something different. With the technology part of it, you actually get your hands dirty, you get to do all the things that a tinkerer would want to do.
4. How do you teach offensive hacking to protect against attacks?
We have what we call ethical hacking … and go through all of the possible attack vectors. We discuss the nation-states, which are essentially countries with professional hacking environments. We go through it with our tools. You have to remember, we use both (tools) on the defensive and the offensive sides. All of these malicious individuals are aware of all the tools we have. And they’re using the same tools. So we have to be proactive. We’ll have a new class, Red Hat Blue Hat, bringing together attackers and defenders in the same class, where they try to compromise each other.
5. Cybersecurity is a battle between good- and bad-intentioned hackers. Exploits are happening all the time, with large companies constantly preparing for threats. How do you teach students to prepare for that?
That’s the primary purpose of my teaching: Students learn to put on defensive hats. It involves predicting what the malicious individual will likely do, which is particularly significant now due to AI. It is truly a battle, even internally. You want to create these internal battles so that you can prepare yourself against threats. … And you need to believe that is purposeful.”
