In Could 2019, the federal government of Baltimore, Maryland, fell into chaos. Cybercriminals had locked the town out of lots of its important information and demanded fee to decrypt them. The town refused to pay ransom. The assault incapacitated a swath of companies, together with actual property transactions and invoice fee, and restoration prices soared into the tens of millions.
The syllabus of sophistication 11.074/11.274 (Cybersecurity Clinic), a course within the MIT Division of City Research and Planning (DUSP), features a case research on Baltimore’s scenario for instance of more and more widespread ransomware assaults on municipal governments and different public companies. To counter such threats, Lecturer Jungwoo Chun and Ford Professor of City and Environmental Planning Lawrence Susskind launched the MIT Cybersecurity Clinic in 2019. They’ve supplied the course almost each semester since.
Very like a authorized or medical clinic, the course doubles as hands-on coaching for college kids and a pro-bono service to at-risk communities. After finishing educational modules and passing a certification examination, college students are assigned in groups to a shopper. By the top of the semester, every crew creates a report assessing the shopper’s vulnerabilities to cyberattack and recommending steps to enhance safety. To date, the clinic has supplied greater than 40 assessments, confidential and freed from cost, primarily for New England municipalities and health-care organizations.
In 2025, the FBI’s Web Crime Grievance Heart documented a median of two,765 cyberattacks focusing on People day by day. When these assaults strike cities and cities, the fallout goes past funds, says Chun: “There’s a terrifying, cascading impact on each dimension of our lives.”
Lately, cyberattacks focusing on the sorts of shopper communities served by MIT’s clinic have imperiled water provides, impeded 911 and police companies, and uncovered residents’ private knowledge.
Regardless of being gateways to important infrastructure, many small municipalities and hospitals lack in-house workers skilled in cybersecurity. Demand for such specialists far exceeds provide in at the moment’s labor market, and public sector budgets not often can match the excessive salaries non-public corporations provide certified candidates.
In keeping with Comparitech, from 2018 to 2024, there have been 525 ransomware assaults on U.S. authorities entities, roughly one each 5 days, resulting in an estimated $1.09 billion in downtime prices.
“Underfunded public and not-for-profit our bodies have to comply with a self-help pathway,” Susskind says. “There are various low-cost strikes that these organizations can implement with a little bit teaching from a free-service clinic.”
Defensive social engineering
Some may be stunned to discover a college cybersecurity program housed exterior the pc science division. Chun is an utilized social scientist with experience in public coverage and planning, and Susskind is a number one scholar of battle decision and consensus constructing. They name the strategy they’ve developed for the clinic “defensive social engineering” to emphasise that cybersecurity isn’t solely a technical problem.
Chun acknowledges that the fast growth of synthetic intelligence has created alarming new instruments for criminals — “now AI can’t solely establish the vulnerability, however do the assault itself, which is absolutely scary” — and an ever-evolving menu of software program claims to protect in opposition to these assaults. Accordingly, the course spends appreciable time on the technical elements of cybersecurity. “However on the finish of the day,” Chun says, “the largest assault vector continues to be by means of people.”
The time period “social engineering” generally refers to methods cybercrime victims are manipulated into compromising safety (for instance, by sending cash to a scammer, downloading malicious code, or disclosing delicate info). Susskind and Chun’s idea of defensive social engineering is equally grounded in human psychology. The strategy emphasizes that cybersecurity should be a part of everybody’s job, technical or in any other case.
“It’s about folks figuring out what to do, folks making the best selections,” says Chun. “It’s serving to them use the sources and finances they’ve now on issues that may be long-lasting, somewhat than simply spending on the most recent antivirus software program.”
“College students with pc science backgrounds are stunned by the significance we connect to serving to shoppers construct organizational capability,” says Susskind. “College students want to know the management dynamics of their shopper communities. The IT director can’t simply do what he or she desires. They depend upon the native authorities for his or her finances. They want approval to rent new workers.”
Then again, Susskind says, college students from planning or social science backgrounds typically research sensible metropolis improvements with out studying a lot in regards to the applied sciences wanted to handle the related dangers. And there are elements of AI and superior system design — together with cyber regulation and different subjects important to cybersecurity — that engineering college students could not be taught of their different programs. The Cybersecurity Clinic goals to spherical out the data of scholars from each self-discipline. The course goals to broaden these college students’ data, too, by inviting no less than half a dozen visitor audio system every semester from business, different universities and MIT educational departments, business, and/or related public companies.
This previous spring, for instance, the lineup of lecturers included Dan Ricci, the founding father of Industrial Knowledge Works, on the modeling of threat in power techniques inside budget-constrained environments; Gus Serino, president of I&C Safe Inc., on operational-technology cybersecurity for industrial management techniques; and representatives from the MassCyberCenter and the Cybersecurity Infrastructure Safety Company offering overviews of their respective state- and federal-level organizations’ packages and initiatives.
“There are extremely specialised issues to be taught, particularly in regards to the methods AI is altering cybersecurity, that we’d like assist educating,” Susskind says. “The speed at which the sphere of cybersecurity is altering implies that most teachers may have a really laborious time maintaining.”
A roadmap for enchancment
Clinic college students spend the primary 4 weeks of the semester getting ready for subject assignments. A collection of on-line modules, supplemented by class dialogue, define the scope and nature of cyberattacks in opposition to important city infrastructure; evaluate the 23 threat areas most related to their sort of shoppers; and supply steering for every step of the evaluation course of. This contains simulations of tough shopper interactions. What if shoppers don’t take college students critically, or fail to supply the required info? What in the event that they argue to obtain a extra optimistic evaluation than the info warrant?
“I’ve by no means ever had a category that ready us for such practical situations earlier than,” says Diego Contreras, a rising senior majoring in pc science and engineering who accomplished the course this spring.
The modules culminate in an examination college students should move on their first attempt to obtain a subject task. For the rest of the semester, they’ll obtain continued assist through weekly class conferences and get college enter on their drafted experiences, however the onus is on college students to coordinate their crew’s actions and construct shopper belief.
“You characterize MIT, and that’s fairly the accountability,” Contreras says. “This course has given me folks expertise I wouldn’t have developed in another context.”
“Probably the most delicate side of the mission was balancing our evaluation findings,” says Zev Moore ’26, who took the category final fall as a senior finding out mathematical economics and finance. “Our strategy was to supply vital suggestions whereas concurrently validating the optimistic safety measures our shopper already had in place, which ensured our report felt like a collaborative roadmap for enchancment.”
Sure key suggestions present up within the majority of experiences. For instance, shoppers are suggested to stock all {hardware} and software program tied into their community and observe who has entry; patch software program and again up knowledge commonly; require multi-factor authentication and frequent password updates; prepare workers to not open attachments from unknown events; put together an assault response plan that clarifies traces of authority and contains the group’s stance on paying ransoms; and solely use distributors with good cybersecurity hygiene.
“None of this stuff is expensive,” Susskind says. “Collectively, they are going to in all probability keep away from 80 p.c or extra of the doable value and hazard of cyberattacks.”
Spreading the mannequin
To this point, greater than 120 college students have accomplished the total course at MIT. The net modules that put together college students for certification are freely obtainable to the general public as a large open on-line course on MITx known as Cybersecurity for Important City Infrastructure, which has attracted tens of hundreds of learners. The modules are additionally utilized by universities with their very own cybersecurity clinics — a rising cohort, thanks partly to a consortium (with 61 member establishments and counting) co-founded by MIT in 2021 with the College of California at Berkeley, Indiana College, and the College of Alabama.
Most scholar groups wrap up shopper work after finalizing their suggestions; a couple of have volunteered to remain on after semester’s finish to advise on implementation. In both case, Susskind and Chun verify in periodically with shoppers for no less than two years following every engagement.
“We regularly hear of the vulnerability evaluation report serving because the group’s blueprint for his or her short-term, mid-term, and long-term agenda to be extra ready for future assaults,” says Chun. “We primarily work with IT administrators or chief know-how officers, and plenty of of them have been telling us post-engagement that they shared the MIT report with the town or city management and had been capable of persuade them they wanted additional finances or a particular line merchandise. They had been utilizing the scholar report as leverage to say, ‘it’s not simply me saying it. We’ve a reputable crew who devoted their time and these are the findings.’
“It is actually a humbling expertise,” Chun provides, “when a few of our previous shoppers attain out to us once more after a while to say: ‘Now we’ve completely different folks, we simply bought new gear. Can we do that yet again?’”
