In Could 2019, the federal government of Baltimore, Maryland, fell into chaos. Cybercriminals had locked town out of lots of its crucial recordsdata and demanded fee to decrypt them. Town refused to pay ransom. The assault incapacitated a swath of companies, together with actual property transactions and invoice fee, and restoration prices soared into the thousands and thousands.
The syllabus of sophistication 11.074/11.274 (Cybersecurity Clinic), a course within the MIT Division of City Research and Planning (DUSP), features a case research on Baltimore’s scenario for example of more and more widespread ransomware assaults on municipal governments and different public companies. To counter such threats, Lecturer Jungwoo Chun and Ford Professor of City and Environmental Planning Lawrence Susskind launched the MIT Cybersecurity Clinic in 2019. They’ve supplied the course almost each semester since.
Very similar to a authorized or medical clinic, the course doubles as hands-on coaching for college students and a pro-bono service to at-risk communities. After finishing tutorial modules and passing a certification examination, college students are assigned in groups to a shopper. By the tip of the semester, every crew creates a report assessing the shopper’s vulnerabilities to cyberattack and recommending steps to enhance safety. To date, the clinic has offered greater than 40 assessments, confidential and freed from cost, primarily for New England municipalities and health-care organizations.
In 2025, the FBI’s Web Crime Criticism Heart documented a mean of two,765 cyberattacks concentrating on Individuals day by day. When these assaults strike cities and cities, the fallout goes past funds, says Chun: “There’s a terrifying, cascading impact on each dimension of our lives.”
Lately, cyberattacks concentrating on the sorts of shopper communities served by MIT’s clinic have imperiled water provides, impeded 911 and police companies, and uncovered residents’ private information.
Regardless of being gateways to important infrastructure, many small municipalities and hospitals lack in-house employees skilled in cybersecurity. Demand for such specialists far exceeds provide in immediately’s labor market, and public sector budgets hardly ever can match the excessive salaries non-public corporations supply certified candidates.
Based on Comparitech, from 2018 to 2024, there have been 525 ransomware assaults on U.S. authorities entities, roughly one each 5 days, resulting in an estimated $1.09 billion in downtime prices.
“Underfunded public and not-for-profit our bodies have to observe a self-help pathway,” Susskind says. “There are various low-cost strikes that these organizations can implement with a bit teaching from a free-service clinic.”
Defensive social engineering
Some could be stunned to discover a college cybersecurity program housed outdoors the pc science division. Chun is an utilized social scientist with experience in public coverage and planning, and Susskind is a number one scholar of battle decision and consensus constructing. They name the method they’ve developed for the clinic “defensive social engineering” to emphasise that cybersecurity isn’t solely a technical problem.
Chun acknowledges that the fast growth of synthetic intelligence has created alarming new instruments for criminals — “now AI cannot solely determine the vulnerability, however do the assault itself, which is absolutely scary” — and an ever-evolving menu of software program claims to protect in opposition to these assaults. Accordingly, the course spends appreciable time on the technical features of cybersecurity. “However on the finish of the day,” Chun says, “the largest assault vector continues to be via people.”
The time period “social engineering” generally refers to methods cybercrime victims are manipulated into compromising safety (for instance, by sending cash to a scammer, downloading malicious code, or disclosing delicate data). Susskind and Chun’s idea of defensive social engineering is equally grounded in human psychology. The method emphasizes that cybersecurity have to be a part of everybody’s job, technical or in any other case.
“It’s about individuals figuring out what to do, individuals making the fitting selections,” says Chun. “It’s serving to them use the sources and price range they’ve now on issues that may be long-lasting, moderately than simply spending on the newest antivirus software program.”
“College students with pc science backgrounds are stunned by the significance we connect to serving to purchasers construct organizational capability,” says Susskind. “College students want to grasp the management dynamics of their shopper communities. The IT director can’t simply do what he or she desires. They rely upon the native authorities for his or her price range. They want approval to rent new employees.”
Alternatively, Susskind says, college students from planning or social science backgrounds usually research good metropolis improvements with out studying a lot concerning the applied sciences wanted to handle the related dangers. And there are features of AI and superior system design — together with cyber legislation and different subjects crucial to cybersecurity — that engineering college students could not study of their different programs. The Cybersecurity Clinic goals to spherical out the information of scholars from each self-discipline. The course goals to broaden these college students’ information, too, by inviting a minimum of half a dozen visitor audio system every semester from trade, different universities and MIT tutorial departments, trade, and/or related public companies.
This previous spring, for instance, the lineup of lecturers included Dan Ricci, the founding father of Industrial Knowledge Works, on the modeling of danger in vitality techniques inside budget-constrained environments; Gus Serino, president of I&C Safe Inc., on operational-technology cybersecurity for industrial management techniques; and representatives from the MassCyberCenter and the Cybersecurity Infrastructure Safety Company offering overviews of their respective state- and federal-level organizations’ applications and initiatives.
“There are extremely specialised issues to study, particularly concerning the methods AI is altering cybersecurity, that we’d like assist instructing,” Susskind says. “The speed at which the sphere of cybersecurity is altering implies that most lecturers could have a really laborious time maintaining.”
A roadmap for enchancment
Clinic college students spend the primary 4 weeks of the semester getting ready for discipline assignments. A collection of on-line modules, supplemented by class dialogue, define the scope and nature of cyberattacks in opposition to crucial city infrastructure; evaluate the 23 danger areas most related to their sort of purchasers; and supply steerage for every step of the evaluation course of. This consists of simulations of tough shopper interactions. What if purchasers don’t take college students severely, or fail to supply the required data? What in the event that they argue to obtain a extra constructive evaluation than the info warrant?
“I’ve by no means ever had a category that ready us for such sensible situations earlier than,” says Diego Contreras, a rising senior majoring in pc science and engineering who accomplished the course this spring.
The modules culminate in an examination college students should move on their first attempt to obtain a discipline project. For the rest of the semester, they’ll obtain continued help through weekly class conferences and get school enter on their drafted studies, however the onus is on college students to coordinate their crew’s actions and construct shopper belief.
“You symbolize MIT, and that’s fairly the duty,” Contreras says. “This course has given me individuals expertise I wouldn’t have developed in every other context.”
“Probably the most delicate side of the undertaking was balancing our evaluation findings,” says Zev Moore ’26, who took the category final fall as a senior learning mathematical economics and finance. “Our method was to supply necessary suggestions whereas concurrently validating the constructive safety measures our shopper already had in place, which ensured our report felt like a collaborative roadmap for enchancment.”
Sure key suggestions present up within the majority of studies. For instance, purchasers are suggested to stock all {hardware} and software program tied into their community and observe who has entry; patch software program and again up information frequently; require multi-factor authentication and frequent password updates; prepare workers to not open attachments from unknown events; put together an assault response plan that clarifies traces of authority and consists of the group’s stance on paying ransoms; and solely use distributors with good cybersecurity hygiene.
“None of this stuff is expensive,” Susskind says. “Collectively, they are going to in all probability keep away from 80 p.c or extra of the doable value and hazard of cyberattacks.”
Spreading the mannequin
So far, greater than 120 college students have accomplished the total course at MIT. The web modules that put together college students for certification are freely out there to the general public as a large open on-line course on MITx referred to as Cybersecurity for Essential City Infrastructure, which has attracted tens of 1000’s of learners. The modules are additionally utilized by universities with their very own cybersecurity clinics — a rising cohort, thanks partly to a consortium (with 61 member establishments and counting) co-founded by MIT in 2021 with the College of California at Berkeley, Indiana College, and the College of Alabama.
Most pupil groups wrap up shopper work after finalizing their suggestions; a couple of have volunteered to remain on after semester’s finish to advise on implementation. In both case, Susskind and Chun verify in periodically with purchasers for a minimum of two years following every engagement.
“We frequently hear of the vulnerability evaluation report serving because the group’s blueprint for his or her short-term, mid-term, and long-term agenda to be extra ready for future assaults,” says Chun. “We primarily work with IT administrators or chief expertise officers, and lots of of them have been telling us post-engagement that they shared the MIT report with town or city management and had been capable of persuade them they wanted additional price range or a selected line merchandise. They had been utilizing the coed report as leverage to say, ‘it’s not simply me saying it. We’ve a reputable crew who devoted their time and these are the findings.’
“It is actually a humbling expertise,” Chun provides, “when a few of our previous purchasers attain out to us once more after a while to say: ‘Now we’ve got totally different individuals, we simply bought new gear. Can we do that yet again?’”
