{"id":63316,"date":"2026-07-14T08:33:00","date_gmt":"2026-07-14T12:33:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=63316"},"modified":"2026-07-14T08:33:00","modified_gmt":"2026-07-14T12:33:00","slug":"mit-cybersecurity-clinic-ransomware-defense","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/mit-cybersecurity-clinic-ransomware-defense\/","title":{"rendered":"MIT Students Defend Municipalities from Ransomware Attacks"},"content":{"rendered":"

When ransomware locked the city of Baltimore out of its critical systems in May 2019, the resulting chaos shut down real estate transactions and bill payments, ultimately costing millions in recovery. That case study is now a core teaching tool at MIT<\/a>, where a unique program has turned the fight against municipal cyberattacks into a live, semester-long clinic. The MIT Cybersecurity Clinic<\/a>, housed within the Department of Urban Studies and Planning (DUSP), has since provided over 40 free, confidential vulnerability assessments to New England municipalities and healthcare organizations, demonstrating that the most effective defense against digital extortion often begins not with code, but with human psychology and organizational structure.<\/p>\n

The Rise of Ransomware in the Public Sector<\/h2>\n

The threat landscape for local governments is stark. In 2025, the FBI<\/a>\u2019s Internet Crime Complaint Center recorded an average of 2,765 cyberattacks targeting Americans<\/a> every single day. For small cities and towns, these attacks create cascading failures that threaten water supplies, disrupt 911 services, and expose citizens\u2019 personal data. According to Comparitech, 525 ransomware attacks on U.S. government entities occurred between 2018 and 2024\u2014roughly one every five days\u2014leading to an estimated $1.09 billion in downtime costs.<\/p>\n

The core problem is a critical resource gap: the public sector cannot compete with private industry for cybersecurity talent. While a hospital or town hall might have an IT director, they rarely have a dedicated security team. \u201cUnderfunded public and not-for-profit bodies need to follow a self-help pathway,\u201d explains MIT Ford Professor Lawrence Susskind. \u201cThere are many low-cost moves that these organizations can implement with a little coaching from a free-service clinic.\u201d<\/p>\n

Defensive Social Engineering: A New Approach to Cybersecurity<\/h2>\n

What makes the MIT Cybersecurity Clinic distinctive is its academic home. It is not run by the computer science department but by DUSP, led by Lecturer Jungwoo Chun, an applied social scientist, and Susskind, a leading scholar in conflict resolution. They have termed their methodology \u201cdefensive social engineering.\u201d This framework acknowledges that while the technical arms race is accelerating\u2014AI can now identify vulnerabilities and execute attacks autonomously\u2014the largest attack vector remains the human one.<\/p>\n

The concept inverts the typical hacker tactic of social engineering (manipulating people into compromising security). Instead, defensive social engineering trains everyone in an organization to be a security asset. \u201cIt\u2019s about people knowing what to do, people making the right choices,\u201d says Chun. \u201cIt\u2019s helping them use the resources and budget they have now on things that can be long-lasting, rather than just spending on the latest antivirus software.\u201d This lens forces students to understand the political and budgetary realities their clients face. An IT director cannot simply demand new staff or software; they must convince a city council to allocate funds, often using the clinic\u2019s report as leverage.<\/p>\n

How the MIT Cybersecurity Clinic Operates<\/h2>\n

The course, known as 11.074\/11.274 (Cybersecurity Clinic), functions like a legal or medical clinic. For the first four weeks, students complete instructional modules, covering the 23 most relevant risk areas for their clients, and must pass a certification exam. The curriculum includes simulations of difficult client interactions, such as being dismissed for being a student or managing expectations for a report\u2019s findings.<\/p>\n

Once certified, student teams are assigned to real clients, such as a small town government or a community hospital. The onus is on the students to coordinate, build trust, and conduct the assessment. \u201cYou represent MIT, and that is quite the responsibility,\u201d says Diego Contreras, a computer science and engineering senior who completed the course. \u201cThis course has given me people skills I wouldn\u2019t have developed in any other context.\u201d Teams produce a final deliverable: a confidential report that acts as a \u201croadmap for improvement,\u201d balancing critical feedback with validation of existing security measures.<\/p>\n

Common, Low-Cost Recommendations That Make a High Impact<\/h3>\n

While every report is tailored, many share a core set of recommendations because they address fundamental vulnerabilities common to under-resourced organizations. These low-cost actions form the foundation of what Susskind calls a self-help pathway:<\/p>\n