Problem
CS3113 Principles of Cybersecurity assigned a six-person team, operating under the name Death Star Consulting, to assess the cybersecurity posture of NARO Inc., a fictitious nonprofit doing R&D on mini wind turbines. The scope covered physical access controls across NARO's two office buildings, network and remote-access security across its 17 servers, and the maturity of its cybersecurity policies. It was a documentation review: no active penetration testing or direct system interaction, a limitation the report states explicitly rather than leaving implied.
Approach
NIST Cybersecurity Framework 2.0 structured the assessment across its six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The team adapted that framework with Sandia National Laboratories' IDART methodology, a process-oriented approach that ties each finding to evidence from NARO's own documented processes rather than general best-practice assumptions. Findings were sorted into Weaknesses, Strengths, and Observations, each carrying a severity rating of High, Moderate, or Low and mapped to a specific CSF 2.0 function and subcategory.
Two findings from the Weaknesses section, both rated High, show how that mapping worked. NARO relied on a single factor, username and password, for all remote VPN access, which the report flagged as a single point of failure and mapped to CSF 2.0 Protect, PR.AA-03. Separately, NARO's Supermicro R&D servers ran Ubuntu 18.04.6 LTS, which stopped receiving security patches in May 2023, mapped to CSF 2.0 Protect, PR.PS-02. These are two findings out of a full set covering physical access, network segmentation, and policy gaps, not the complete report.
My role
I built every figure in the report, including the network topology diagrams and the data flow diagram above. I also wrote Section 6, Assessment Results and Recommendations, the full Weaknesses/Strengths/Observations writeup, and mapped each weakness and observation to its NIST CSF 2.0 function and subcategory.
Outcome
The report was delivered as an independent evaluation NARO's (fictitious) leadership could use to prioritize cost-effective mitigations without assuming dedicated security staff or a large security budget. It runs about 30 pages; this write-up summarizes it rather than reproducing it.