How IU’s Cybersecurity Clinic is addressing ‘cyber hygiene’ while training students

BLOOMINGTON, Ind. -- The Indiana University Cybersecurity Clinic offers its pro-bono services throughout Indiana and the Midwest, offering vital cybersecurity services to critical public infrastructure and community organizations, while also giving hands-on experience to students pursuing careers in the cybersecurity field.

Isak Nti Asare is the Executive Director of the IU Cybersecurity Clinic and Co-director for the Cybersecurity and Global Policy program in the Hamilton Lugar School of Global and International Studies.

The clinic offers its resources to address a variety of cybersecurity needs at a time when the "attack surface" is large.

“From small businesses to utility providers to universities, K-12 schools, you name it. And so, our interest is really that sort of soft underbelly of cybersecurity, the sort of folks who need cybersecurity, but particularly capacity building, resources, support, but often can't afford it. So, our interest is, how do we make sure that we build resilient Indiana across the digital ecosystem,” said Nti Asare.

A big part of the program is not only helping clients but also providing experience for students pursuing careers in the cybersecurity field and filling jobs.

“There are, right now, in Indiana, something like 4600 jobs in cybersecurity that we don't have people to fill. And so, one of the things that we're trying to do is make sure that our students are filling those jobs. We work all across the state— local governments, utility providers, small businesses, nonprofits, you name it. Anybody who is low-resourced and a critical infrastructure provider, we're working with them, and so we usually put students in teams of about four to six, and we'll work with clients for 14 to 16 weeks on bespoke things that they need. We actually customize all of our engagements with them,” said Nti Asare. “We have about eight to ten clients a semester, so we're working with about 20 clients a year, and those are all across the state of Indiana. The students then have some funding to travel to and help. A lot of this is also done virtually. So, the sort of day in the life is sourcing problems, of which we have a, you know, waiting list of people who need this type of free service, and then working with them to really understand their context. And then once we do that, they get paired with at least one faculty member, and that number, that group of students, three to five students, and then there's three of us who teach the class.”

ABC57’s Jordan Tolbert spoke with a few students involved with the clinic, pursuing either undergraduate or master's degrees in the cybersecurity field.

That includes Jake George, who worked with a small business.

“These folks have limited resources, and some of them are sole owners of these businesses. They can't be expected to be cybersecurity professionals, privacy professionals, and run their operations,” said George.

George just wrapped up his Master’s in Cybersecurity Risk Management at IU and serves as a Lead Security Analyst at the university.

“The IU Cyber Clinic has become an excellent resource for non-profits, small businesses, and municipalities in the state of Indiana. In our projects, we provide under resourced organizations with cybersecurity, privacy, legal, and technical services, as well as enable information sharing of industry best practices. As the adversary becomes more capable with AI tools, we can best improve our cyber defenses through industry collaboration, resource sharing, and shared governance," said George.

Noah Raymond is pursuing a Master’s Degree in Cybersecurity Risk Management at IU.

“I think one of the biggest issues in general is that most businesses have become pseudo-tech businesses themselves. They have to address these problems and from the ground up, and it's something that will not go away going forward,” said Raymond.

Undergraduate Junior Liam Kruis is pursuing a Bachelor’s Degree in Cybersecurity & Global Policy at IU. He did a risk assessment for a small, local nonprofit.

“You have to understand the resource that they have, and kind of, like the budget that they have, because, you know, with, at least with me, there wasn't a lot of money to be able to spend on certain, you know, cyber security tooling and being able to block certain fishnets or any other ransomware. So, we had to really work within their scope and really have them understand it's like, here's what you could do now, and here's what you could do later,” said Kruis.

To learn more about the program or fill out a client application online.