Google.org will provide $500,000 grants, volunteers, and in-kind support to ten university-based cybersecurity clinics across the country

BERKELEY, CA – Ten university-based cybersecurity clinics — all members of the Consortium of Cybersecurity Clinics — will each receive $500,000 in grant funding and additional support from Google’s Cybersecurity Clinics Fund. The funding from Google.org, the company’s philanthropic arm, is part of a $20-million collaboration that Google’s CEO, Sundar Pichai, announced in June as part of an initiative to expand the number of cybersecurity clinics across the United States. 

University cybersecurity clinics provide free security services in the same way law or medical schools offer free clinics in their communities. They give students the opportunity to learn and improve digital security skills in a real-world context, while helping to protect the digital networks of critical infrastructure, such as hospitals, schools, and energy grids, as well as non-profits and other public interest organizations.

“We are tremendously grateful for Google’s commitment to strengthen and grow university-based cyber clinics, which bring diverse students into the cybersecurity profession while providing vital security assistance to civic institutions across the country,” said Ann Cleaveland, Co-Founder and Co-Chair of the Consortium of Cybersecurity Clinics and Executive Director of the UC Berkeley Center for Long-Term Cybersecurity, the Consortium’s administrative home. “Cybersecurity clinics deliver hands-on training to students while assisting civic organizations like hospitals, local governments, and non-profits that play a vital role in our society, but don’t always have the resources to defend themselves against ransomware and other cyber threats.”

Cyber attacks increased by 38% globally in 2022, and have cost the U.S. economy billions of dollars over the past five years. Despite the need for more cybersecurity professionals, there are currently more than 550,000 unfilled cybersecurity jobs in the U.S.

“Consortium members share a wide range of teaching materials, including digital training modules, so that schools interested in creating a clinic can move quickly to get started,” said Professor Larry Susskind, Co-Chair of the Consortium and Director of the MIT Cybersecurity Clinic. “This level of collaboration among members — which now include over two dozen active clinics, clinics in development, and allies — is one of the great strengths of the Consortium.”

The ten grants from Google.org will support clinics at the University of Alabama; University of Georgia, Athens; Indiana University; Massachusetts Institute of Technology (MIT); University of Nevada, Las Vegas; Rochester Institute of Technology (RIT); Stillman College; the University of Texas at Austin; the University of Texas at San Antonio; and the University of California at Berkeley.

In addition to grant funding, Google is offering the ten clinics volunteer mentorship from Google employees, Titan Security Keys, and scholarships for the new Google Career Certificate in Cybersecurity.

“These clinics have been designed to provide the next generation of professionals with the tools and resources they need to succeed in the ever-growing field of cybersecurity,” said Royal Hansen, Google’s Vice President of Privacy, Safety, and Security Engineering. “We’re proud to lend a hand to help grow a strong security workforce responsible for strengthening and protecting our infrastructure for years to come.”

Google and the Consortium have opened the application for other institutions interested in launching a clinic. The deadline is March 1, 2024. Learn more at https://cyberclinics.withgoogle.com.

###

About the Consortium of Cybersecurity Clinics: The Consortium of Cybersecurity Clinics is a network of clinics and allies dedicated to sharing resources and best practices to advance the cybersecurity clinic model worldwide. The Consortium works to expand the reach and visibility of university-based cybersecurity clinics and lower the barriers for other institutions of higher education to successfully establish their own clinics. Learn more at https://cybersecurityclinics.org.

Video link: “What is a cybersecurity clinic?”  https://youtu.be/_aMizzvSefE
Media contact: For more about the Consortium of Cybersecurity Clinics, email cybersecurityclinics@berkeley.edu. For Google.org-specific inquiries, contact kwill@google.com.

Registration is now OPEN(opens in a new tab) for the UC Berkeley Cyber Civil Defense Summit.Thank you for confirming your interest in our previous Save the Date — you are the first to hear about the registration launch! 

Space is limited and tickets will go fast, so make sure to snag your ticket today. 

The event will be held Wednesday, June 14th at The Showroom in Washington DC. For more information on the agenda, speakers, and venue, please check out our website at https://cybercivildefensesummit.org/.

Register

Hosted by: UC Berkeley’s Center for Long-Term Cybersecurity, in partnership with Craig Newmark Philanthropies

When: June 14th, 2023, 9:00am to 4:00pm
Where: The Summit DC, 1099 14th Street NW, Washington, DC 20005

The Summit: The Cyber Civil Defense Summit — a one-of-a-kind gathering of cyber defenders, academics, and policymakers with the mission of protecting our most vulnerable public infrastructure, from municipalities to nonprofits to small hospitals. 

This year’s theme is Innovation, and the Summit will showcase and analyze creative aimed at helping community organizations, including providing proactive services to bolster resilience and reactive services to enhance incident response and recovery.

The Summit endeavors to join forces across defenders, academics, volunteers, and public servants to showcase replicable models of regional cyber defense.

Who should participate: Anyone involved in, or interested in, cyber defense! Our Summit is not sector-specific, and we welcome participants from all industries, backgrounds, and job descriptions. 

More information on the agenda, speakers, and venue can be found at https://cybercivildefensesummit.org(opens in a new tab).

Register

For the past year, the MIT Cybersecurity Clinic has been making updates to the tools and techniques we use to assess the information security readiness of cities, towns and hospitals.  While industry-wide frameworks like NIST 800-53, ISO 27000-series, NIST CSF, and the like provide the knowledge complex entities need, they are not right-sized for municipal agencies that often consist of small teams very early in their security journey. 

It is with this knowledge that the Clinic has created a tailored assessment toolkit and questionnaire to help public agencies in their efforts to stay resilient and secure, even as they increase digitalization of services and face dynamically shifting threats. 

Ransomware attacks remain a major concern for public agencies who provide essential services for their citizens. They rely on the public’s trust to maintain these services. Washington DC’s police department (2021) and Baltimore’s EMS services (2019) suffered ransom attacks.  Both needed to restore services and rebuild public trust. The MIT Cybersecurity Clinic’s cyber risk assessment process gives special weight to 

• Understanding essential/ mission-critical services, functions, processes, and supportive technologies;
• Building resilience/ recovery measures, response/ contingency plans, and testing these to protect essential services;
• Managing residual risk through insurance; and 
• Investing in relationships with peer, state, and federal agencies for additional support.

In tandem with ransomware, there has also been an increase in third-party/ supply chain attacks and compromises in security due to cloud misconfigurations or attacks in recent years. Making matters worse, sometimes attackers purposefully target vendors that users rely on or trust the most, all to get a foothold in user environments. Some notable cases include: 

• The Microsoft Exchange server compromise (2021) that left vulnerable not only emails, calendars, and collaboration environments, but could have been used as a launch point for further server hijacking, planting backdoors, data theft, or malware deployment;
• The SolarWinds incident (2021) that further exposed pivot points to entities like security firm FireEye, the National Nuclear Security Administration, DHS, other public and private entities that used SolarWinds’s IT infrastructure monitoring tool, Orion;
• The Accellion incident (2021) where attackers targeted the firewall vendor’s File Transfer Appliance, which was dedicated to moving sensitive user data;
• A cloud storage misconfiguration (2021) that exposed sensitive citizen data of over 80 municipalities, including addresses, phone numbers, driver’s license numbers, and tax documents;
• Another cloud storage misconfiguration by a Utah COVID testing company (2021) that left patient personal data exposed, including scanned passports and health insurance IDs. 

These instances serve as yet another reminder that today’s IT environments are ever-growing, interconnected, and complex webs of supplier and user relationships. The attack surfaces at and between the nodes are becoming more difficult to defend. 

With all of this in mind, we added three new learning and assessment modules to our vulnerability assessment tools: 

• Vulnerability management, with greater emphasis on prioritized remediation, 
• Vendor risk management, and
• Cloud security configurations.

In these modules, we provide short guides for student assessors that talk about 

• What students are going to need to find out from their client community or agency;
• What recommendations students will be expected to provide if they observe gaps in practice;
• How clients are likely to act to these recommendations;
• What questions students may expect to encounter from the client once recommendations are provided – with an indication of how students ought to respond, and
• What supplementary resources and guidance student can offer so that clients are able to do more independent research and take follow-up actions on their own. 

Why These Three Modules in Particular? 

Vulnerability Management

In previous iterations, this module focused exclusively on identifying vulnerabilities, but the challenge – as we now know – has less to do with running scans, and more to do with closing those vulnerabilities in a timely, risk-appropriate manner.

Keeping with the fundamentals of information security, this module now emphasizes process – including knowing when to perform assessments/scans, a sample logic tree for prioritizing remediations, and what to do when an important vulnerability is ‘risk-accepted’ or marked as an exception – as some inevitably are for critical urban infrastructure and services. This module aims to help public entities re-interrogate these processes for improvement on their own,  

Vendor Risk Management

Sun Tzu says, in the Art of War, that “you can be sure of succeeding in your attacks if you attack places which are undefended.” Vendor risk continues to be one of the most daunting and least mature security domains, not only for municipalities, but even for larger more resourced enterprises. Knowing this, hackers will make their way, not to well-defended perimeters, but to less guarded supplier connections. 

In this module, we again emphasize prioritizing and right-sizing the assessment process by learning which client services/ functions are mission-critical, learning which vendors/ products/ processes support those services, and concentrating protection efforts there. The prime challenge often is not in creating templates or criteria to risk-rank services and vendors (though this can also take time), but rather collaborating cross-departmentally within each organization to change the way things are done every step of the way, navigating the politics, and all the while, trying not to extend procurement cycles or add undue complexity. There is no one-size-fits-all prescription in this domain; so recommendations need to include considerable flexibility for implementation.

Cloud Security Configurations

Cloud solutions can be useful in the public sector for a variety of reasons. Saving time and human resources by offloading infrastructure maintenance responsibilities as well as potential cost-savings are two major drivers. Security in the cloud and hybrid environments, however, can be quite different from traditional on-premise IT. The upside is that all major cloud providers have a variety of built-in security features with detailed user instructions that cover common threats. The challenge, though, is that default settings can be insecure, and require quite a bit of configuration and customization based on what an organization is doing in the cloud. 

We apply the same guiding principles as before in this module, emphasizing understanding key services that need to survive disruptions (requiring resilience controls) and sensitive data that needs to be kept secure (requiring data protection and monitoring controls). Rather than prescribing specific configurations, we review ways of determining whether these two requirements are understood and which safeguards can be implemented to serve these objectives. 

What is Next?

Beginning Fall 2022, we will incorporate these new modules into our client assessments for municipalities and hospitals. With feedback from clients and students, we will continue to revise them along pragmatic and educational lines. For more information regarding the Clinic, its work and our new assessment tools, please visit our website or contact Prof. Lawrence Susskind.