The main idea of our project is to conduct a network penetration test on Saint Martin's University network infrastructure. This process will identify possible vulnerabilities that may put the university at risk for a cyber-attack. The implementation of the test will be conducted in two different ways. Our method will involve the use of hardware tools and software to conduct network security.
In light of the news within the last year regarding system hacks and ransomware, cybersecurity has become and increasingly important consideration for organizations of every size. With a large number of staff, faculty, and students continously going in and out of their physical facilities and digital systems, as well as accessing their systems both on and off-site, universities are more susceptible to attacks than the average organization.
The purpose of the project was to conduct a penetration test on the network infrastructure of Saint Martin’s University. The processes used were specifically chosen and designed to identify possible vulnerabilities that may put the university at risk of a successful cyber-attack. The implementation of the tests was all done on-site and were conducted using both specialized hardware and software tools. All the tools used were chosen in part due to their being easily available on the open market.
This test also served as the senior/graduate student project for the SPG and was closely monitored and advised by Peter Truax (SMU ITS), Mark Wright (Vets2Tech), Dr. Joachim Beer (SMU Computer Science Department), and Dr. Harold Nelson (SMU Computer Science Department).
Through the course of this project, SMU's data network and infrastructure were rigorously tested for security weaknesses and vulnerabilities. To minimize risk, this project was performed during the 2021 winter break on approved sections of the network and at approved facilities. All efforts were made to keep any potential liabilities at a minimum, and the tests were completed under the direct supervision of a SMU ITS representative. The team used the National Institute of Standards and Technology (NIST) special publication 800-115 for reference and implementation of guidelines. The following list gives a clear picture of the in-scope and out-of-scope parameters with section refences that we followed in implementing this project.
This project has the potential to benefit the school both academically and financially. Academically, it will not only showcase the school's resolve to using its facilities themselves as teaching tools (such as the case with Cebula Hall), but if the project is published, then it will further the reputation of the school's growing Computer Science program. Financially, this project will save the school the thousands of dollars it would otherwise have to spend for such tests to be performed
Unfortunately, due to the vulnerabilities mentioned, the university's cyber infrastructure was found to be insecure. Although the suggested remediations would elevate the security of the overall systems infrastructure, it does also need to be balanced with a proper cost-to-benefit analysis. Before implementing any remediations, an analysis on how the remediation would impact the user experience is also of important consideration. This is especially true as the university is a non-typical environment, where thousands of users are moving from one system to another on a regular basis.
Most critically though, the best way to ensure the safety and security of the school’s system is to make sure its users are properly, and regularly, trained in healthy cybersecurity practices. More than that though, to instill into them an understanding on why such practices is important. Not just for the school, but for themselves as well since the network and systems are a shared environment. This includes not just the faculty and staff, but also the students, and any other potential users.
Team Members : Roles
Gary Choi : Project Manager, Programmer
Micah Au-Haupu : Graphic Designer, Programmer
Kevin Salas : Administrator, Programmer
Mitchell "Mitch" Wommack : Administrator, Programmer