Dr. Eric Chan-Tin is a professor of computer science at Loyola University Chicago, founding director of its Center for Cybersecurity, and graduate program director for the MS in Cybersecurity.
Summary of the episode
Dr. Eric Chan-Tin discusses Loyola University Chicago’s cybersecurity degree programs, hands-on learning opportunities, and the importance of student research, competitions, and internships.
He also explores how AI is shaping cybersecurity education, the benefits of the CyberRamblers Scholarship for Service program, and practical ways students can prepare for cybersecurity careers.
Listen to the episode
Read a full transcript of the episode
Steven Bowcut:
Welcome to the Cybersecurity Guide Podcast where we explore cybersecurity education and career opportunities to help you find your path into the field. I’m your host, Steven Bowcut.
Today, we are joined by Dr. Eric Chan-Tin, professor of computer science at Loyola University Chicago, founding director of Loyola’s Center for Cybersecurity and graduate program director for its Master of Science in Cybersecurity. Eric earned his PhD in computer science from the University of Minnesota and his bachelor’s degree in computer science and mathematics from McAllister College.
Before joining Loyola in 2018 to lead its cybersecurity program, he served on the computer science faculty at Oklahoma State University. His research explores network security, distributed systems, privacy, anonymity, and the intersection of cybersecurity and human behavior.
Alongside his research, he works with undergraduate and graduate students to help them develop the knowledge and practical experience needed for cybersecurity careers.
Today, we’ll discuss Loyola’s cybersecurity degrees, hands-on learning opportunities, student research, and pathways into the workforce, including its Cyber Ramblers Scholarship for Service Program. And with that, welcome Eric. Thank you for joining me today.
Eric Chan-Tin:
Thanks, Steve. Happy to be here.
Steven Bowcut:
All right, this is going to be fun and interesting. On the show, we typically like to start with a little more background about our guests.
So tell us specifically what your path into cybersecurity looked like. What attracted you to this field and when did you get started into it and what led up to being where you are today?
Eric Chan-Tin:
Yeah, when I grew up, so in high school, I wanted to create video games. I play video games. I’m sure a lot of people was like that. You want to create the games. Absolutely. And then I went to college. I got a few internships, two in software engineering internships at the companies and one IT service help desk type of position.
And they were all great. I like them, I like the people, but I could not see myself coding for 40 hours a week. I know you don’t code for 40 hours, but just the idea of it’s too much. Exactly. So I was like, oh, let me do something different.
And then I though of cybersecurity and I felt that’s always something that’s new, always changing. So it seems kind of fun because you always on your toes and have to explore new things. And that’s where I went for my PhD is to go into cybersecurity. Well, back then it was more network security and privacy, and then that led to me being at Loyola.
Steven Bowcut:
Excellent. Okay. Thank you for that. And you’re right, I think there’s lots of young people that are really interested in video games and they want to continue with that kind of thing.
And I think cybersecurity is a great option for people who have that kind of interest. So let’s talk about choosing an undergraduate degree if we can here for a minute.
So if a student is comparing a cybersecurity degree with maybe a computer science or information technology degree, so what distinguishes Loyola’s bachelor’s in cybersecurity and what type of student is most likely to thrive in a program like that? Or what are some of the reasons that you might choose a cybersecurity degree over computer science with even an emphasis in cybersecurity?
Eric Chan-Tin:
Yeah, I guess first I want to encourage any students or high school students or incoming undergraduate student to explore things. I mean, I know cybersecurity AI is hard right now, but it’s not for everyone.
You could have minors, different majors, you can explore things, getting a broad understanding of things that not necessarily technology, but outside of technology is useful.
But to answer your question more directly, our cybersecurity degree I think is still very much in high demand. If you look at all the data from BLS, Bureau of Labor Statistics, still seeing an upward trend in job high demand.
Also for Loyola in particular, we have a designation by the National Center of Academic Excellence Cyber Defense. So that means we have a strong curriculum that is reviewed and vetted by outside experts.
So our cybersecurity program, when students come in, they know that’s a strong program that giving them a well-rounded experience. So students also get to be hands-on. So cybersecurity is not a degree that you can just sit in class and listen. So you have to be hands on keyboard.
You have to do stuff. It’s not just theory. So if you like keyboard, dealing with stuff, doing stuff on a keyboard on your laptop, cybersecurity is a great field for you to go into. And then I mentioned hands-on experience. So in cybersecurity, we had competitions.
I know in computer science there’s also programming competitions, but they’re not the same as a cybersecurity one. So I think cybersecurity is a bit more fun, more team oriented. So depending on the competition, some would be a bit smaller so you solve a certain challenge.
Some would be like you hacking into a system, which doing it as part of a classroom experience is kind of unique because you don’t want to do it in real life because there’d be repetition if you hug into a system, but doing it as a classroom when it’s kind of safe and learn how to do that.
Also, I think cybersecurity right now, there’s a lot more scholarship opportunities than computer science or IT. And scholarship is, I mean, free money is always nice to have.
Steven Bowcut:
Okay. Well, there’s some very good reasons to choose cybersecurity and I appreciate that. But most especially, I think I appreciate the advice there for undergraduate students. Undergraduate students, as we all know, oftentimes experience a lot of pressure and anxiety to pick that major and get started. But I think it’s important to understand that there’s real value in checking a few things out and try this and then try that.
If nothing else, you’ll learn, yeah, cybersecurity is exactly where I want it to be, if that was your initial choice. If it wasn’t your initial choice, you may discover it as being something that’s very interesting.
So I think that’s very valuable advice, so thank you for that. And you mentioned the National Center for Academic Excellence and Cyber Defense Designation that I believe it’s your cybersecurity bachelor’s degree is the validated program for that.
So talk to us a little bit more if you could about why that’s important. If I’m looking for a school to go to and I’m looking at Loyola University of Chicago and I notice that it’s got this Center for Academic Excellence, why would that be important for me to know?
Eric Chan-Tin:
Yeah, So a bit of background on that. So we first got designated in 2020 and it’s for five years, so up to 2025. And then 2025, we got re-designated for another five years until 2030. And I mentioned this earlier, so the Center of Excellence in Cyber Defense, you have a team of outside experts look at your curriculum and not just a program, but not just the classes, but a whole program that you offer.
So this includes that you have the correct faculty experts teaching the courses and obviously looking at the courses themselves that they are in cybersecurity and then looking at what we do outside the classroom. So this includes competitions, research, outreach.
So they’re also looking that the program is doing outreach to K to 12. For us, we give talks at public libraries, so that’s part of that. And then yeah, so I say competitions research and then where the students are going afterwards and then look
Steven Bowcut:
At the – At a minimum, I guess it would tell the student that the curriculum has been vetted by industry experts and because it’s a cyber defense designation, a lot of the, if I understand it correctly, and please correct me if I’m wrong here, but a lot of these are defense industry experts, so maybe military or contractors.
So these are the people who know who we want to hire. And so they can look at the curriculum and say, no, you need to teach a little more of this. We don’t need so much of that kind of input that they have into the curriculum so that when you graduate with that degree, you know you’ve got the education that they are looking for, they being the defense industry. Is that a good summation?
Eric Chan-Tin:
That’s a good summation. So we go for multiple reviews. The first review usually is by other faculty members from other institutions. So again, outside the university, then finally goes through NSA experts. And again, defense industry experts that will look at it. But it’s a long process to get it.
Steven Bowcut:
So it actually means something.
Eric Chan-Tin:
Right. It means something. And we also have to show continuous improvement, so meaning that we assess our program every year or two, see where things are going right, where things are not going that well, and then show how do we improve it for the next time.
Steven Bowcut:
And keeping it current, I assume, because things change quickly in cybersecurity, so it would be valuable to have that input from the industry saying, “Well, we did that two years ago. That’s the way we do it, but now we do it a little differently.” That kind of input that would keep your curriculum current. Right. Excellent.
All right, so we’ve talked about choosing an undergraduate degree. Let’s compare graduate pathways. So you introduced a dedicated MS in cybersecurity in 2025, if I understand that correctly.
So what needs does that degree address and how should students choose between that degree and cybersecurity options within your computer science or information technology master’s program? Why would you choose cybersecurity masters over a CS or information technology?
Eric Chan-Tin:
Yeah, I think the same reason as a bachelor degree, why you do cybersecurity versus IT or computer science is the strong job demand. Our master’s program in cybersecurity also taught by industry, well, taught by people like me who are full-time faculty, but also by industry professionals.
So these are people who are working in industry full-time. They have years of experience or decades of experience even, and then they’re teaching. So for example, we have somebody who’s a forensics expert, so that pretty much what he does every day is do forensics incident response, and he comes teach our forensics course.
So that means students are learning what the real professional will be using, the tools they’re using, what the latest is. So I think that’s very useful, obviously, because you get to hear from somebody who’s in the field working that job. Also, our cybersecurity program is hybrid, so our computer science program is in person only.
So that means for cybersecurity, you could complete it completely online or mix of in-person or online courses or completely in-person if you really like that in-person interactions. And we also try to have evening courses as well, so you could take it if you’re working, you could take in the evening.
Steven Bowcut:
And that is so valuable because a lot of people, where they’re at in their life, they just can’t dedicate all day every day to being in a classroom and they have some more flexibility in gaining their education, so that’s awesome.
So from what you said, maybe it’s fair to summarize that as if you choose the MS in cybersecurity, I guess students just need to understand, and I’m sure that they would understand this because that’s why it’s structured this way, that you’re going to be very specialized. Cybersecurity is what you’re going to be focused on.
If you were to choose a computer science master’s degree, then you’ll be aware of cybersecurity, and I’m sure you’ll have courses that cover cybersecurity, but you’ll have a broader scope. You’ll be seeing a broader vision of computer science with some knowledge of cybersecurity.
But if cybersecurity is what you really want to do and where you want to work and you want to be the best in that field, then you’re probably better off going after a cybersecurity degree specifically.
And then the flexibility of having in-person or online, I think that would probably be a determining factor for a lot of people if they’re maybe returning to school after working for a while and realizing they need more education.
And that’s very common, as I’m sure you would attest, that’s very common for master’s programs. People get their bachelor’s degree, they go to work, and they realize for me to move to where I want to be in this industry, I need to have a master’s degree. And so they go back to school and that’s where those flexible hours become so important. Is that fair to say?
Eric Chan-Tin:
Yeah, we have a few students who are basically doing just what you describe why they want to work, they come back. But in general, I think there’s been some data on this about the benefits of a master’s program that your salary is on average higher than you with a bachelor degree. So there’s that also.
Steven Bowcut:
Excellent. Okay, so earlier you touched on hands-on experience that comes with an education in cybersecurity. Maybe you could walk us through a hands-on assignment or project that shows how Loyola students move from understanding a security concept, so you learn the theory, and then you’re going to learn how to apply that to a realistic problem. Step us through maybe an example of that.
Eric Chan-Tin:
Sure. Yeah, it’s a good question. So one of my favorite assignment that I have, and my students in my class this semester have to do it at the end of class, so this is a bit of a preview if they’re going to listen to this, is I give them… So I’m trying to simulate a red team, so that means offensive security or some sort of penetration testing, so find flaws in a system.
So what I do is I have a fully patched system that has one vulnerable program in it. And then what I do is I give the students the IP address. So given just one IP address, they have to figure out how to get – Start with the IP address. So this is what you would do in real life, right? Yeah, exactly.
In the system, you don’t know how anything works. So from the IP address, they need to scan, find out that there’s a website, it’s a web server, there’s also SSH in it so they can securely connect to it remotely.
And then they had to find a password, so they learn how to do password cracking. Obviously, I’m using a weaker password because if there’s a strong password, nobody will get in. But they had to figure out how to do a password cracking attempt.
They get in, then they have to find a vulnerable program that can be exploited, escalated their privilege so they become administrator or root in the next term. So once they are there, then it’s basically game over. So they completed the assignment. So it’s a multiple step.
They have to think outside the box, think like an adversary, like what do I need to do to get in to find that vulnerable program? Because I do tell them it’s fully patched. It’s going to be fully patched as of probably end of October or so. And so there’s probably not going to be any vulnerability outside of that program that I created that’s going to be in that system.
Excellent.
Steven Bowcut:
Well, that gives some real world hands-on experience because that’s exactly what an attacker is going to have to do. So excellent. And we all know that defending, it’s important. If you’re a defender, it’s important to understand what it is that the adversary is going to be doing and be able to think like they think.
So one of the things that in my research before the interview I came across was some of the clubs and competitions that students can be involved in if they come to Loyola University Chicago. So you’ve got, I think, a club that’s called 7968, and there’s also Women in Cybersecurity.
How would a beginner, someone that is just beginning their cybersecurity education, get involved in those kinds of things? And what kind of experiences would they be involved with if they were in part of these clubs or competitions?
Eric Chan-Tin:
Yeah, so just a bit of background. So 7968 is our cybersecurity competitions club, and you might wonder, are these four random numbers?
Steven Bowcut:
I admit, I did wonder, so I had to look it up.
Eric Chan-Tin:
7968 is Loyola’s autonomous system number. The students found that number and they said, “Well, the club should be named after that.” So a little bit on the maybe nerdy side. And then Women’s Cybersecurity is our student chapter of the National Women’s Cybersecurity Organization.
And then just to make sure, conflict of interest, I am the advisor for both clubs, so I do encourage anyone who’s listening, who’s at Loyola, thinking of going Loyola to be active and participate in it.
Steven Bowcut:
So I assume there’s capture the flag competitions and that kind of thing, which in my mind is invaluable because it gives you, earlier you talked about the team environment and that gives you an opportunity to work as a team, right?
Eric Chan-Tin:
Yeah. So they get work in a team. So we have a capture the flag, as you mentioned, later this semester where students form a team get to solve the problems. So last year’s capture the flag that the club created was about a baby kidnapping.
So there was a video that they had to do facial recognition to try to figure out who it was. Obviously it was all fake, but then find it, link it to a social media profile. So they created fake social media profiles so people can see it.
And then so based from there, they keep going and answer the questions. They also tried to have fake fingerprints and things like that as well. So try to simulate if you were an investigator, all the crumbs you had to follow to find who the person was.
Steven Bowcut:
What a great experience. That is awesome. All right, so moving on here a little bit, it seems like every conversation about cybersecurity these days has to mention AI. So let’s talk about student research and the impact of AI.
So as we mentioned at the top of the show, your research includes network security, privacy, and anonymity. And the students that you’ve mentored, they explore deep fake generation and detection, and we’ve just talked about that a little bit. So how do students become involved in research and how is AI changing what they need to learn?
Eric Chan-Tin:
Yeah, so I always encourage students to start early. So at least for my lab, doing any research project requires at least one year of commitment because it’s not something you can do in one month because you cannot collect data, analyze it, all that in one or two months. So one thing I get to have students in there now, they say, “Oh, I’m graduating in May.
I need to be involved in research.” I was like, “Well, it’s October.” That’s probably a little bit late for that because there’s only so much you’ll be able to do. But in general, want to learn because that’s what research is, is doing something that nobody has done before in a way. So we’re not inventing the wheel or anything, but there’s no… In a homework assignment, I have step one, step two, step three, how you solve it.
For research, I have some vague steps or high level steps, but I cannot tell you exactly what you’re going to do and what you’re going to find because if I already knew that, it’s not research anymore.
So wanting to learn, try new things, learn new things. And also, I think research helps in job search. So I’ve had students who go on job interviews and they’re like, “Oh, all they talk about is what research I did. They didn’t even talk about what classes I took or other thoughts of questions. Yeah, that’s what future employers want.
They know that research is state-of-the-art and you’re doing something that usually cool project and they want to learn what it is. And students being involved also say that GPA is not always a predictor of how good a researcher you are.
So if there’s any students who want to do research at their university, even your GPA is not the best, but you have that interest in learning, you want to learn more, you can work independently, you could be great researcher. So it’s not like you had to have a good GPA to be a great researcher.
I can see
Steven Bowcut:
How that would be true. Interesting.
Eric Chan-Tin:
Yeah. So to answer your point about AI, AI is obviously changing some things, but I see AI as a tool. It’s very helpful. I mean, I use it just yesterday I was like, I had a piece of code. I was like, “I don’t know why it’s not working.” And I could of course Google it, go to Stack Overflow, all those things and find out what it is. Or I just put it into ChatGPT and it just tell me, “Oh, this is what you’re supposed to do.
It took two seconds, copy, paste.” So it’s great, but I also feel AI is in a way maybe a bit like social media removing that face-to-face interaction. So I don’t have as many students come stop by because they’re using AI for help, which is good, but I think that we are losing that interaction, which I don’t know, is good or bad, anybody can decide.
But yeah, I tell my students AI is great, use it, but you see how to do the work, so you have to get the idea. And I have an analogy that I read online, so it’s not coming from me, but it’s like going to the gym. So if you ask AI to go to the gym for you, you don’t get any benefit from it.
But if you actually had to put in the work, if you want to say lose weight or build strength and stuff. And then research also involve publication, so you get to travel. Some conferences are back in person now, so you get to travel, present your work. I know most students love traveling.
The furthest place I’ve sent a student to present her work was in Australia. So you can go to other countries as well, and it’s all paid for, so it’s all covered.
Steven Bowcut:
Oh, there’s some motivation. That would be fun. I think students would enjoy that. All right, so another thing that piqued my interest when I was doing the pre-show research was this CyberRamblers Scholarship for Service Program.
So if we can get you to talk about that a little bit, what is it and what’s the service commitment involved in something like that?
Eric Chan-Tin:
Yeah, so that’s for students get a two-year scholarship. It can be up to three years, so it could be extended by third year. Usually they will be in their last two years of their bachelor degree.
They can also be transfer students. So if somebody gets an associate’s degree coming in as a junior, they’re also eligible. We have one student who did that route, or they can be a sophomore lawyer line and apply for their junior year. And it covers the tuition, so all the tuition fees, everything is covered.
They also get a stipend, so $27,000 for undergrad students, and that stipend is cash. So basically it’s for you to leave, eat, pay your rent. If you have students living at home, so they don’t have rent, and they just take the cash, put it into savings account or whatever they want, and then watch it grow.
So you can do what you want with it. It’s supposed to help you so that you don’t have to work, you don’t have to get a part-time job or anything. And then they also get a professional development fund that can be used to buy laptops, travel to conferences, get certifications.
Some students have been buying the home lab, so they would have IOT devices, things like that that they want to experiment with just so they can learn more. And then at the end, after you graduate, students, scholars have to do a public service in the US government, and the length of the service has to be equal to the length for the scholarship.
So if it’s two years of government, at least two years for that scholarship. So I think it’s a great experience. All our students so far have, so we’re 100% placement rate. So all the students have been getting full-time jobs or getting internships during summer.
And usually internships are paid, so some internships are getting paid and then full-time jobs obviously that meets the requirement. And I know there might be – Opportunities. Yeah, it’s a good opportunity.
Steven Bowcut:
If people wanted to go to work in the government sector anyway, an opportunity scholarship, that would be such a great opportunity.
Eric Chan-Tin:
Right. And government jobs are coming back. I just looked this morning, I saw, I don’t know, maybe 10, 15 new job postings. So it seems like, I mean, there were some layoffs in 2025, or 2026, early 2026, and then now it seems like it’s coming back for jobs.
Steven Bowcut:
Okay. All right. So we’re about out of time. So let’s end with some advice from you to… And so let’s pick a student that’s just beginning their cybersecurity education. And so what would you encourage that person to do over the next six months? Let’s say they haven’t even started yet.
They’re just maybe getting out of high school, they want to be in cybersecurity. What kinds of things should they be doing over the next six months that would prepare them to work or to be educated to get an education in cybersecurity?
Eric Chan-Tin:
So start getting involved in competitions. Even in high school, there are competitions that are for high school students, and then same for research. So I’ve had high school students do research with me over summer. I mean, I know summers in the past, so that’s not the next six months. But yeah, you can do research.
Obviously, summer is a bit tighter schedule, but we can find project for you to work on. Look at our student clubs, so be active, attend seminars, networking events you can attend. You never know who you might meet. You might meet your future employer there, you might be like that. And then in Chicago, there’s a lot of events. You can attend.
So we have conferences like Blue Team Con, Bsides. You can attend those events, see what people are working on, meet people. And there’s also meetups. There’s, I don’t know, probably a meetup at least once a month in the Chicagoland area that you can go to.
But yeah, pay attention. So the thing, if you’re going to college, four years goes by very quickly. And the thing I don’t like hearing from students that I don’t like, but they should have started earlier. I said earlier, the senior year they’re like, “Oh, I’m graduating. I don’t have any internships.
I don’t have any experience with competitions.” And I was like, “Yeah, it had to start getting active.” But it was never too late though. You can always get into competitions, do things, volunteer. Those are all good. So what I tell students is their resume, all the students who are graduating with degree, they all have a degree.
So if you’re an employer, everybody look the same. But if you have internship, research, competitions, certifications, those look, oh, that’s something different. Maybe I should look at Eric and talk to him. Yeah, set you apart. That’s always useful to have.
Steven Bowcut:
Yeah. All right. Eric, thank you so much. We really appreciate you giving some of your time to our audience. And the information that you provided is very valuable. And so thank you. I’m confident that much of our audience will benefit from the things that we’ve talked about here today.
Eric Chan-Tin:
Thanks for having me, Steve.
Steven Bowcut:
You bet. And listeners can learn more about Loyola’s program at luc.edu by visiting the Department of Computer Science and the Center for Cybersecurity Pages. Is that the best place for them to start?
Eric Chan-Tin:
Yeah, I think that’d be a good start or they can contact me if they have questions.
Steven Bowcut:
Excellent. Very good. Thank you. And for more information about cybersecurity degrees, more generally training or career paths, you can visit cybersecurityguide.org. I’m Steven Bocutt, and thank you for listening to the Cybersecurity Guide podcast.