Background

An Ohio based defense electronics company supplies products directly to the US DoD and large prime contractors. The company’s customers are increasingly requiring it to be NIST 800-171 compliant. The company engaged a service provider in 2018 to perform a NIST assessment, but based on increasingly stringent customer requirements, the CEO felt the need to have an advanced cybersecurity assessment conducted and chose ResiliEYE by ResiliAnt.

Key observations

Despite completing a cybersecurity assessment just over a year earlier, the company had many vulnerable areas to address. Almost 47% of the network connected devices were vulnerable including the router and firewall. They also lacked many good practices such as encryption of backup data, a password management policy, a policy for system access management, etc. With social engineering led cyber-attacks increasing, the company could benefit from delivering cybersecurity awareness training to its employees. Given the nature of its business and vulnerabilities, a cyber-attack could pose risks to government classified information.