As the co-founder and President of Youth Cyber Defender, my passion for cybersecurity has grown over the past several years. Two years ago, during one of the cybersecurity education events, a local small business owner approached us, seeking guidance and technical support for their low budget network. His business relied solely on an online system to exchange sensitive documents with clients. He was deeply concerned about the potential consequences of a cyber data breach, which may cause significant data loss. Given the limited budget, hiring professionals was out of reach. He was seeking someone who could assess and fortify his company's online environment.

At that moment, I realized, that not only can we equip youth with the literacy and skills on cyber security, but we can also together contribute to the community’s financial wellbeing. Numerous small businesses, often under-resourced and lacking cybersecurity expertise, are exposed to significant risks such as financial losses, business interruption, and non-compliance due to potential cyberattacks targeting their websites. From a recent IBM report, the average cost per breached record is $164 and the average breach cost for businesses with 500 or fewer employees is $2.98 million. As youth with cybersecurity skills, we have the means to assist our local small businesses in securing their online presence.

With nearly 700,000 cybersecurity job openings remaining unfilled, our nation faces a critical shortage of cybersecurity experts to protect our critical infrastructures and networks from cyber threats. This issue becomes even more amplified among local small business owners. Recent reports from Verizon and IBM show 43% of data breaches involve small business victims and the average data breach cost for businesses with fewer than 500 employees is $2.98 million. A significant number of these entrepreneurs lack technical expertise and operate on tight budgets, leaving their websites vulnerable to potential cyberattacks. Therefore, it is of utmost importance to secure their online environments. As a high school student who has grown a deep passion for cybersecurity over the past few years, I strongly believe that it is my calling to contribute to the betterment of my local community. Guided by my mentors, I have been actively engaged in enhancing the cybersecurity knowledge of young individuals, both locally and nationally. This endeavor aligns perfectly with my desire to utilize my skills and experience to serve my community. The aim of my proposal is two-fold: to empower young individuals with cybersecurity literacy and skills, and to assist small business owners in the community in enhancing the security of their websites to mitigate potential financial losses.

Recognizing the need for a sustained effort to address the gap, we have developed a comprehensive, long-term action plan. Acquiring cybersecurity skills during one's high school years demands commitment and dedication. In 2021, I established Youth Cyber Defender, a non-profit organization with a focus on fostering youth cybersecurity knowledge and help our community. To achieve our mission, we have enlisted cybersecurity professionals to serve as mentors, guiding us on this journey. We conduct weekly study meetings and host summer educational sessions, extending our outreach to a broader audience of students of diverse backgrounds. We use the materials from CyberPatriot, CyberStart America and various Catch The Flag events. We regularly invite cybersecurity industry experts to conduct seminars, thereby keeping us well-informed about the latest cybersecurity threats and trends. Furthermore, we organized site visits to institutions such as the Oregon Research and Teaching Security Operations Center at Oregon State University. These visits allowed students to gain firsthand insights into the world of cybersecurity and its potential as a future career path. 

We have conducted a pilot project this summer to validate our skills and methodologies. We are meeting with local community leaders for potential business owners who have concerns about their online security.

A team of five students has been actively engaged in a pilot project since last year. We obtained official authorization from a major community organization in Oregon to conduct a security assessment of their website. This NPO, a small business by its revenue and by employment, relies heavily on volunteers and operates with limited resources, leaving them without a cybersecurity budget. Their website serves as their primary platform for communication and outreach. To guide our pilot project, we adopted the OWASP Web Security Testing Guide as the framework. Throughout the course of our pilot, we identified and familiarized ourselves with various cybersecurity tools. We have successfully completed the execution phase of our pilot and are now entering the final reporting phase. Building upon the success of our pilot, we have validated our methodology through a real-world application. With the support of the Prudential Emerging Visionaries award, we aspire to extend the reach of our project beyond the pilot phase. Our plan is to utilize this award to provide cybersecurity training to more students. In the next six months, we plan to outreach to the Oregon Small Business Association and Oregon Cybersecurity Advisory Council to identify local small business owners that may need our services. With proper authorizations, we plan to serve 3-5 small businesses in the next 12 months.

Over the past several years, we have inspired over a hundred students from diverse backgrounds and locations to start building their cybersecurity literacy. The impact of our efforts extends beyond our local community, as we have welcomed students from outside Oregon to participate in our online sessions. Some of these students have gone on to establish their own school clubs, further amplifying our reach and influence to benefit even more individuals. Despite these accomplishments, it is clear that a significant skill gap still exists, particularly in the realm of systematically assessing and securing websites. Many students, despite possessing basic cybersecurity skills, lack the knowledge and expertise required for this crucial task. With the generous support of the Prudential Emerging Visionaries award, we will be able to subscribe to more cybersecurity training resources from Udemy and Hackthebox etc.. We plan to provide training in cybersecurity assessment general methodologies to those students who already possess foundational cybersecurity skills. By doing so, we aim to equip them with the capabilities needed to contribute to the security of numerous small businesses within our community and beyond. Our vision is to foster a new generation of cybersecurity experts who can make a meaningful difference in securing online platforms for businesses in need.