In today's digital landscape, even the smallest businesses are Goliath-sized targets for hackers. Lacking the resources of tech giants, these local heroes – mom-and-pop shops, non-profits, and public services – struggle to fortify their digital defenses. But a new breed of champions is emerging: college students armed with cybersecurity expertise.
Across the US, universities are establishing innovative clinics staffed by students who offer free cybersecurity assessments, training, and support to resource-strapped organizations. Think of them as legal or medical clinics, but for the digital realm.
"Without a cybersecurity background, vulnerabilities lurk unseen," says Lauren Bristol, a computer science student at Louisiana State University (LSU) and a clinic volunteer. Many small businesses in Louisiana, Bristol explains, haven't yet secured their crown jewels – customer data and financial information. The LSU clinic equips them with the knowledge and tools to build a robust digital fortress, offering free consultations and training sessions.
This initiative isn't isolated. Over 15 universities, including powerhouses like MIT, UC Berkeley, and Indiana University, boast similar clinics, forming a united front – the Consortium of Cybersecurity Clinics. These clinics typically offer risk assessments, vulnerability scans, and tailored recommendations, according to Ann Cleaveland, co-lead of the consortium. The services don't stop there – cybersecurity awareness training, incident response plan creation, and multi-factor authentication implementation are also part of the arsenal.
A $20 million war chest from Google is empowering the expansion of these cybersecurity clinics. The US Cybersecurity and Infrastructure Security Agency (CISA) is also joining the fray, pledging its support and collaboration. Even the National Security Agency (NSA) has entered the arena, awarding grants to three universities to establish their own clinics.
LSU's clinic, funded by a $1.5 million NSA grant, specifically focuses on safeguarding small businesses. Free services are the cornerstone of their operation, just like most other clinics.
"Many small business owners are understandably scared," says Tate Broussard, another LSU computer science student and clinic volunteer. "They don't know how to secure their digital space." Broussard and his team educate clients on red flags like phishing scams and password best practices.
Amanda Floyd Bovino, owner of Baton Rouge's Royal Treatment Pet Manor and Grooming Spa, knows the importance of cybersecurity firsthand. An accidental social media account merge sent her business scrambling. The LSU clinic is now her trusted partner, helping her prevent future incidents and navigate the complexities of virus protection and spam filtering. "We store customer data and credit cards," Bovino emphasizes. "Prevention is key."
LSU students, including graduate business students, can choose their cybersecurity focus during their semester-long clinic experience. Threat and vulnerability assessment, cyber risk assessment, and cyber defense are the available specializations. This semester, 14 students are honing their skills, each assigned to three clients, says Aisha Ali-Gombe, clinic director.
The decision to prioritize small businesses, Ali-Gombe explains, complements LSU's Small Business and Development Center, which offers technical consultations and training. However, the clinic's primary objective is to "sensitize local businesses" about protecting their most valuable assets, Ali-Gombe adds.
Clinics like Indiana University's Cybersecurity Clinic extend their reach beyond small businesses, offering services to critical public infrastructure and community organizations. One IU team collaborated with the Bloomington Fire Department to create a communication breakdown response plan. They implemented multiple backups for the dispatch tracking system and advised on alternative communication methods in case of radio or cellular network outages. Additionally, a risk assessment pinpointed vulnerabilities, further fortifying the department's defenses.
IU, in partnership with Purdue University and the Indiana Office of Technology, identified 12 essential security controls for local governments – a valuable resource for clinics nationwide. Clinic worker Sydney Schnur, a law student specializing in intellectual property and cybersecurity law, spearheaded workshops for Indiana community leaders on cybersecurity best practices, including password creation and safe online shopping habits. "We empower leaders to educate their communities," Schnur emphasizes.
The IU clinic juggles 4-7 clients at a time, according to Scott Shackelford, faculty director and founder. Client needs are diverse, ranging from ransomware prevention to crafting incident response plans. The waiting list is already growing, and new projects are on the horizon through the Purdue collaboration.
The cybersecurity battlefield is constantly morphing. As Artificial Intelligence (AI) becomes more sophisticated, concerns mount about its potential use by malicious actors. Imagine attackers with limited coding experience wielding AI-powered tools to launch devastating cyberattacks. Universities are on the frontlines of this emerging threat, exploring ways to leverage AI for defense.
Indiana University's Shackelford acknowledges the dual-edged sword of AI. It can empower organizations with limited resources to bolster their defenses, but it can also be a weapon in the hands of bad actors. His university is actively researching the potential and perils of AI in the cybersecurity realm.
The success of these student-run clinics hinges on collaboration. Universities, government agencies, and the private sector must work in unison to create a comprehensive cybersecurity ecosystem. Clinics benefit from grants and partnerships, while businesses gain access to essential services, and students receive invaluable real-world experience.
These clinics represent a beacon of hope in the ever-evolving cybersecurity landscape. By equipping students with the knowledge and skills to combat cyber threats, universities are not only protecting businesses and communities today, but also cultivating the next generation of cybersecurity warriors.
Is your small business struggling to fortify its cybersecurity defenses? Don't be afraid to seek help. Universities across the country are likely to have a cybersecurity clinic offering free or low-cost services. A quick online search can put you in touch with your local clinic and its student heroes.
