How Cyber Volunteers Help Protect Nonprofits and Local Govt

A consortium of university-based cybersecurity clinics are bringing free cyber support to the organizations least prepared to defend themselves.

The UC Berkeley Center for Long-Term Cybersecurity’s Consortium of Cybersecurity Clinics gives students hands-on experience that will help them land jobs, while at the same time bolstering the cyber readiness of small organizations with limited budgets. This type of volunteer program is important to reducing chances of damaging cyber attacks, while policymakers seek long-term solutions for making the overall digital landscape safer, panelists said during the 2024 RSA Conference.

The Consortium of Cybersecurity Clinics launched in 2021 and coordinates and shares best practices among 15 university-based clinics across the U.S., which support entities like local governments, critical infrastructure, small businesses and nonprofits.

Nonprofits have traditionally thought their humanitarian visions put them out of harm’s way, but the 2022 hack on the Red Cross dispelled that hope, said Adrien Ogée, chief operations officer at the CyberPeace Institute. And even when criminals aren’t specifically targeting nongovernmental organizations, they seem to be willing to extort any they happen to hit in mass and indiscriminate attacks. Ideologically motivated attackers also pursue certain nonprofits, like those focused on refugee assistance, LGBT advocacy or women’s health care, said Sarah Powazek, program director of Public Interest Cybersecurity at the Center for Long-Term Cybersecurity.

In the cyber clinic initiative, faculty oversee computer science and cybersecurity students in providing certain cyber supports. They might advise on matters like patching and multifactor authentication, or they may translate advice from respected organizations like the National Institute of Standards and Technology and Center for Internet Security, which otherwise may be too complicated for the average part-time IT person to easily parse, Powazek said.

While the Consortium of Cybersecurity Clinics shares its best ideas, each clinic also charts a localized approach, Powazek said. One at Indiana…