{"id":366311,"date":"2026-07-14T19:37:16","date_gmt":"2026-07-14T14:07:16","guid":{"rendered":"https:\/\/ebiztoday.news\/?p=366311"},"modified":"2026-07-14T19:37:16","modified_gmt":"2026-07-14T14:07:16","slug":"how-mit-students-are-helping-to-forestall-cyberattacks-mit-news","status":"publish","type":"post","link":"https:\/\/ebiztoday.news\/index.php\/2026\/07\/14\/how-mit-students-are-helping-to-forestall-cyberattacks-mit-news\/","title":{"rendered":"How MIT students are helping to forestall cyberattacks | MIT News"},"content":{"rendered":"
\n

In May 2019, the federal government of Baltimore, Maryland, fell into chaos. Cybercriminals had locked town out of lots of its critical files and demanded payment to decrypt them. The town refused to pay ransom. The attack incapacitated a swath of services, including real estate transactions and bill payment, and recovery costs soared into the tens of millions.<\/p>\n

The syllabus of sophistication 11.074\/11.274 (Cybersecurity Clinic), a course within the MIT Department of Urban Studies and Planning (DUSP<\/a>), features a case study on Baltimore\u2019s situation for instance of increasingly common ransomware attacks on municipal governments and other public agencies. To counter such threats, Lecturer Jungwoo Chun and Ford Professor of Urban and Environmental Planning Lawrence Susskind launched the\u00a0MIT Cybersecurity Clinic<\/a> in 2019. They’ve offered the course nearly every semester since.<\/p>\n

Very like a legal or medical clinic, the course doubles as hands-on training for college kids and a pro-bono service to at-risk communities. After completing instructional modules and passing a certification exam, students are assigned in teams to a client. By the top of the semester, each team creates a report assessing the client\u2019s vulnerabilities to cyberattack and recommending steps to enhance protection. Thus far, the clinic has provided greater than 40 assessments, confidential and freed from charge, primarily for Latest England municipalities and health-care organizations.<\/p>\n

In 2025, the FBI\u2019s Web Crime Grievance Center documented a median of two,765 cyberattacks targeting Americans on daily basis. When these attacks strike cities and towns, the fallout goes beyond funds, says Chun: \u201cThere\u2019s a terrifying, cascading effect on every dimension of our lives.\u201d\u00a0<\/p>\n

Lately, cyberattacks targeting the sorts of client communities served by MIT\u2019s clinic have imperiled water supplies, impeded 911 and police services, and exposed residents\u2019 personal data.<\/p>\n

Despite being gateways to essential infrastructure, many small municipalities and hospitals lack in-house staff trained in cybersecurity. Demand for such experts far exceeds supply in today\u2019s labor market, and public sector budgets rarely can match the high salaries private corporations offer qualified candidates.<\/p>\n

In response to Comparitech, from 2018 to 2024, there have been 525 ransomware attacks on U.S. government entities, roughly one every five days, resulting in an estimated $1.09 billion in downtime costs.\u00a0\u00a0<\/p>\n

\u201cUnderfunded public and not-for-profit bodies must follow a self-help pathway,\u201d Susskind says. \u201cThere are lots of low-cost moves that these organizations can implement with slightly coaching from a free-service clinic.\u201d<\/p>\n

Defensive social engineering<\/strong><\/p>\n

Some is perhaps surprised to search out a university cybersecurity program housed outside the pc science department. Chun is an applied social scientist with expertise in public policy and planning, and Susskind is a number one scholar of conflict resolution and consensus constructing. They call the approach they\u2019ve developed for the clinic \u201cdefensive social engineering\u201d to emphasise that cybersecurity isn\u2019t solely a technical challenge.<\/p>\n

Chun acknowledges that the rapid development of artificial intelligence has created alarming recent tools for criminals \u2014 \u201cnow AI can’t only discover the vulnerability, but do the attack itself, which is actually scary\u201d \u2014 and an ever-evolving menu of software claims to protect against these attacks. Accordingly, the course spends considerable time on the technical features of cybersecurity. \u201cBut at the top of the day,\u201d Chun says, \u201cthe largest attack vector remains to be through humans.\u201d<\/p>\n

The term \u201csocial engineering\u201d commonly refers to ways cybercrime victims are manipulated into compromising security (for instance, by sending money to a scammer, downloading malicious code, or disclosing sensitive information). Susskind and Chun\u2019s concept of defensive social engineering is similarly grounded in human psychology. The approach emphasizes that cybersecurity have to be a part of everyone\u2019s job, technical or otherwise.<\/p>\n

\u201cIt\u2019s about people knowing what to do, people making the fitting decisions,\u201d says Chun. \u201cIt\u2019s helping them use the resources and budget they’ve now on things that could be long-lasting, relatively than simply spending on the newest antivirus software.\u201d<\/p>\n

\u201cStudents with computer science backgrounds are surprised by the importance we attach to helping clients construct organizational capability,\u201d says Susskind. \u201cStudents need to grasp the leadership dynamics of their client communities. The IT director can\u2019t just do what he or she wants. They depend upon the local government for his or her budget. They need approval to rent recent staff.\u201d<\/p>\n

Alternatively, Susskind says, students from planning or social science backgrounds often study smart city innovations without learning much concerning the technologies needed to administer the associated risks. And there are features of AI and advanced system design \u2014\u00a0together with cyber law and other topics critical to cybersecurity \u2014\u00a0that engineering students may not learn of their other courses. The Cybersecurity Clinic goals to round out the knowledge of scholars from every discipline. The course goals to broaden those students\u2019 knowledge, too, by inviting not less than half a dozen guest speakers each semester from industry, other universities and MIT academic departments, industry, and\/or relevant public agencies.<\/p>\n

This past spring, for instance, the lineup of lecturers included Dan Ricci, the founding father of Industrial Data Works, on the modeling of risk in energy systems inside budget-constrained environments; Gus Serino, president of I&C Secure Inc., on operational-technology cybersecurity for industrial control systems; and representatives from the MassCyberCenter and the Cybersecurity Infrastructure Security Agency providing overviews of their respective state- and federal-level organizations\u2019 programs and initiatives.<\/p>\n

\u201cThere are highly specialized things to learn, especially concerning the ways AI is changing cybersecurity, that we want help teaching,\u201d Susskind says. \u201cThe speed at which the sector of cybersecurity is changing means that almost all academics can have a really hard time maintaining.\u201d<\/p>\n

A roadmap for improvement<\/strong><\/p>\n

Clinic students spend the primary 4 weeks of the semester preparing for field assignments. A series of online modules, supplemented by class discussion, outline the scope and nature of cyberattacks against critical urban infrastructure; review the 23 risk areas most relevant to their kind of clients; and supply guidance for every step of the assessment process. This includes simulations of tricky client interactions. What if clients don\u2019t take students seriously, or fail to offer the needed information? What in the event that they argue to receive a more positive assessment than the facts warrant?<\/p>\n

\u201cI\u2019ve never ever had a category that prepared us for such realistic scenarios before,\u201d says Diego Contreras, a rising senior majoring in computer science and engineering who accomplished the course this spring.<\/p>\n

The modules culminate in an exam students must pass on their first attempt to receive a field task. For the rest of the semester, they\u2019ll receive continued support via weekly class meetings and get faculty input on their drafted reports, however the onus is on students to coordinate their team\u2019s activities and construct client trust.<\/p>\n

\u201cYou represent MIT, and that is sort of the responsibility,\u201d Contreras says. \u201cThis course has given me people skills I wouldn\u2019t have developed in another context.\u201d<\/p>\n

\u201cProbably the most delicate aspect of the project was balancing our assessment findings,\u201d says Zev Moore \u201926, who took the category last fall as a senior studying mathematical economics and finance. \u201cOur approach was to offer essential feedback while concurrently validating the positive security measures our client already had in place, which ensured our report felt like a collaborative roadmap for improvement.\u201d<\/p>\n

Certain key recommendations show up in nearly all of reports. For instance, clients are advised to inventory all hardware and software tied into their network and track who has access; patch software and back up data frequently; require multi-factor authentication and frequent password updates; train employees to not open attachments from unknown parties; prepare an attack response plan that clarifies lines of authority and includes the organization\u2019s stance on paying ransoms; and only use vendors with good cybersecurity hygiene.<\/p>\n

\u201cNone of these things is expensive,\u201d Susskind says. \u201cTogether, they’ll probably avoid 80 percent or more of the possible cost and danger of cyberattacks.\u201d<\/p>\n

Spreading the model<\/strong><\/p>\n

So far, greater than 120 students have accomplished the complete course at MIT. The net modules that prepare students for certification are freely available to the general public as a large open online course on MITx<\/em> called\u00a0Cybersecurity for Critical Urban Infrastructure<\/a>, which has attracted tens of 1000’s of learners. The modules are also utilized by universities with their very own cybersecurity clinics \u2014\u00a0a growing cohort, thanks partially to a\u00a0consortium<\/a> (with 61 member institutions and counting) co-founded by MIT in 2021 with the University of California at Berkeley, Indiana University, and the University of Alabama.<\/p>\n

Most student teams wrap up client work after finalizing their recommendations; a couple of have volunteered to remain on after semester\u2019s end to advise on implementation. In either case, Susskind and Chun check in periodically with clients for not less than two years following each engagement.<\/p>\n

\u201cWe regularly hear of the vulnerability assessment report serving because the organization’s blueprint for his or her short-term, mid-term, and long-term agenda to be more prepared for future attacks,\u201d says Chun. \u201cWe primarily work with IT directors or chief technology officers, and plenty of of them have been telling us post-engagement that they shared the MIT report with town or town leadership and were capable of persuade them they needed extra budget or a selected line item. They were using the coed report as leverage to say, \u2018it\u2019s not only me saying it. We now have a reputable team who dedicated their time and these are the findings.\u2019<\/p>\n

\u201cIt’s really a humbling experience,\u201d Chun adds, \u201cwhen a few of our past clients reach out to us again after a while to say: \u2018Now now we have different people, we just purchased recent equipment. Can we do that all yet again?\u2019\u201d<\/p>\n<\/p><\/div>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

In May 2019, the federal government of Baltimore, Maryland, fell into chaos. Cybercriminals had locked town out of lots of its critical files and demanded payment to decrypt them. The town refused to pay ransom. The attack incapacitated a swath of services, including real estate transactions and bill payment, and recovery costs soared into the […]<\/p>\n","protected":false},"author":1,"featured_media":366312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[4442,863,182,395,3760,976],"class_list":["post-366311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-cyberattacks","tag-helping","tag-mit","tag-news","tag-prevent","tag-students"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t