A winning combination: Internships educate students and companies

When Paul Black set out in early 2017 to start a summer internship program at McKesson he had high expectations.

The vice president of cybersecurity operations and services was impressed by Arizona State University’s Ira A. Fulton Schools of Engineering faculty and students from previous interactions.

“Early on I was impressed,” Black said, “but in order to see what we could do together, I wanted to get interns in on the ground and make sure they had opportunities to make a difference.”

Black was referencing McKesson’s cybersecurity initiatives — an important area of work in a world where data is everywhere and accessible. 

McKesson, the oldest and largest health care company in the nation, has a great interest in protecting its information. After all, the company serves more than 50 percent of U.S. hospitals and 20 percent of physicians, delivers a third of all medications used daily in North America and operates in more than 16 countries.

In this new partnership, the company and the interns would have much to learn from each other.

A new opportunity for a growing industry

Black hired five ASU seniors as McKesson Scottsdale’s first internship class for the summer of 2017.

Fulton Schools computer science students Chase Lybbert, Jeffrey Moore and Derek Wallace and computer systems engineering student Jonathan Villegas joined Jenny Brito, a computer information systems student in ASU’s W. P. Carey School of Business, to begin their internships.

Initially, Black hoped to have them rotate through various cybersecurity disciplines McKesson operated in — such as operations, identity, software development and security automation. What ended up happening was much better for both the company and the interns.

The five interns worked on a project with McKesson's subject matter experts to create an automated phishing detection tool they called Phishbot. Photo courtesy of McKesson

“As the internship program evolved, we wanted them to have a big project to work on as a team rather than individuals working on specific activities,” Black said.

Moore recalled that it was the interns who came up with the idea for a project: automating the manual process of addressing phishing activity reports.

“I loved how we came up with our own project,” Moore said. “We noticed a problem at McKesson and were given the tools and resources needed to run with the idea and get this project done to the best of our ability.”

The students worked with McKesson’s cybersecurity subject matter experts to begin developing an automated solution that would become known as “Phishbot.”

Phishbot scans an email inbox where employees send suspicious emails, extracts relevant information and attachments and creates a ticket. It also automatically checks for duplicate tickets and consolidates the requests. Phishbot sends the potentially malicious email attachment to a sandbox environment for safe detonation, or uses another tool to check suspicious links, and adds results to the ticket.

Villegas thought it was a great learning experience.

“We were able to be there from the design phase to the requirements, deadlines and the limitations,” Villegas said. “We all were able to get a little taste of what project management is like.”

Lybbert is proud of what the team of interns was able to accomplish.

“We all contributed ideas, worked together on several modules and it was amazing to see it all come together in the end,” he said.

After eight weeks of development, the product had dramatic results — increasing coverage of phishing detection by 80 percent and saving the time of 89 analysts who would have had to do the process manually.

Black noted that the tool was fully operational by the end of the summer, and McKesson uses it nonstop.

“Phishbot is very key to our security and anti-phishing capabilities, and it’s working very well,” Black said, adding that it continues to be improved.

Computer information systems senior Jenny Brito and the other interns learned a lot about cybersecurity on the job. Brito noted that she had not taken any cybersecurity courses as part of her program in Arizona State University's W. P. Carey School of Business, so her knowledge had come from watching movies or TV shows like "Mr. Robot," and others noted they did not start taking elective cybersecurity courses until senior year — after they began their internship. Photo by Marco-Alexis Chaira/ASU

Learning from each other

Interns often learn from the experts, but at McKesson the experts also learned from the interns. For a company that is 183 years old, the young, enthusiastic minds were well received.

“They challenged the status quo, which is awesome and made our subject matter experts think twice about what they’re doing and how things are being done,” Black said. “Coming in with that mindset has definitely improved my existing teams and how they approach solutions.”

Moore agrees that he and his fellow interns were able to assist the company beyond their Phishbot project.

“I think McKesson professionals learned that it’s important to innovate and change what they’re doing,” Moore said. “It’s very important to keep innovating to stay on top of the competition.”

Hard skills with the benefit of soft skills

Beyond basic technical skills such as a good foundation in programming and general knowledge of TCP/IP for a security internship, students need the right attitude to be successful.

Softer skills, such as an appreciation for their new corporate environment and good manners, also can go a long way, Black noted.

Black and other management at McKesson were also impressed with the students’ communication and presentation skills.

“They did this awesome presentation — a team effort with live demos that went off without a hitch,” Black said. “It was phenomenal. It amazed everyone.”

Black noted that the ASU students’ presentation was, in his opinion, the best out of all of McKesson’s summer interns company wide, who came from other prestigious universities including Georgia Tech and Stanford.

Overall, the Fulton Schools students impressed Black with their professionalism, dedication and eagerness to learn what it’s like to work in cybersecurity.

“They are very bright, super smart, well-rounded students,” he said. “They’re so willing to learn and grasp things so quickly.”

As the way companies conduct business changes, students must keep up with the latest tools and methods of working. Black pointed out he wants to see students possess a better familiarity with Scaled Agile framework, a project management methodology that is becoming mainstream in industry jobs.

“I want students to be aware of what businesses need today and bringing in that skill set would be massive for a company like us,” Black said, noting that major companies in the Phoenix metro area including Intel and Honeywell also work in a Scaled Agile framework. 

Moore found himself wishing that he had gone into his internship knowing “more about software engineering practices like extreme programming (XP), pair programming and technologies that are new and upcoming like Docker, containerization and Kubernetes.” But he and the other students enjoyed applying and expanding their technical skills in cybersecurity, various security tools, network and programming, and benefitted from the professional experience by learning soft skills such as email etiquette, professional development, project management and teamwork.

Jonathan Villegas, who will complete studies for his bachelor's degree in computer systems engineering from the Ira A. Fulton Schools of Engineering in May, said he learned about communicating in a professional setting, such as keeping questions and meetings short and to the point for productivity and to value others' time. Photo by Marco-Alexis Chaira/ASU

“This valuable experience is also a boon for employers,” said Robin Hammond, director of the Fulton Schools Career Center.

“Interns are the first population employers go to when hiring full-time employees,” Hammond said. “For both students and employers, the internship is like an extended interview. Employers can get a better sense of what an individual brings to their team and students can get a feel for company culture and understand the skills needed to be a good employee of a company.”

Beyond internships, she also recommends students look “outside the box” when it comes to professional experience.

“There are many opportunities to build professional skills before and after graduation, including bounty-based projects like MindSumo and Parker Dewey, or professional communities like GitHub, Stack Overflow, and even hackathons and inventathons, like Devils Invent,” Hammond said. “The most important thing students can do is to build their brand. You do this by engaging in experiences that build value-added skills, whether its entrepreneurial, technical or leadership skill building,” she said, “This mindset clearly differentiates top talent from the average job seeker, and what innovative companies seek in top talent prospects.”

Lybbert also thought building skills outside the classroom is important for students seeking internships.

“For any student looking for an internship it is important to stand out and do extracurriculars within the field that are outside of the classroom,” Lybbert said. “There are a few exceptions, but for the most part everyone working for the same degree has completed the same classes and projects.”

A bright future ahead

The five students did such a good job, they were asked to stay on in the fall.

“We offered each of the students an opportunity to continue working part time here at McKesson to continue their work on the project and others, and all five took that up,” Black said. “And we’ve offered all five a full-time job after graduation, and all five have accepted.”

Lybbert said he was speechless at hearing the offer of a full-time position.

“Knowing that I would be able to work with all the amazing people I met throughout the internship once I obtained my degree was awesome, and I am so thankful,” Lybbert said. “As I was approaching my senior year at ASU my biggest worry was the pursuit of a job after graduation, which was alleviated when I was presented with the news.”

Chase Lybbert now works at McKesson full time in security operations after he graduated in December with a bachelor's degree in computer science from Arizona State University's Ira A. Fulton Schools of Engineering. Photo by Marco-Alexis Chaira/ASU

Moore, who now works at McKesson full time since his December graduation, continues to improve Phishbot’s capabilities.

Lybbert, also now a full-time employee, and Villegas, a part-time employee who is still completing his senior year at ASU, work primarily in security operations to automate and simplify other manual tasks for the company’s analysts and engineers.

Wallace is developing identity access management solutions — such as single sign-on — part time while he also finishes up studies at ASU to graduate in May.

Brito works part time in the company’s digital forensics department and continues to develop skills in analyzing malware and other forensic tasks.

“While finishing up my final semester at ASU, it has been very helpful to continue working part-time at McKesson and expanding my knowledge of the cybersecurity world until I graduate,” Brito said, adding the internship helped her learn cybersecurity skills she didn’t learn as a computer information systems major.

They all continue to impress Black both on the technical and social sides of work as they improve and create new tools and participate in social committees and team events.

“They’re very much part of the family and getting themselves involved,” Black said.

As the spring semester progresses, Black looks forward to adding five more summer interns from ASU in 2018 and hopes to expand McKesson’s partnership with ASU and the Fulton Schools to bring on top talent.

“I see this as the beginning of a long partnership,” Black said. “Ideally, we continue to work with ASU on obtaining (and retaining) top students across undergrad, grad and PhD pursuits — after all, this experience has been a win-win.”