A group of students conducted scans, probing the networking for vulnerabilities that hackers can exploit (an outdated version of Windows, for example, or services that were not patched), and delivered a comprehensive report including all vulnerabilities that were found, along with the references and solutions.
The introduction of Connecticut’s Safe Harbor Law in 2021 propelled Chris Gillespie, senior director of technology services for the Catholic Diocese of Bridgeport, to get serious about instituting a more structured cybersecurity program. “The new law safeguards organizations from suffering punitive damages in the case of a security breach, as long as that organization has created and maintained an approved cybersecurity framework,” explained Gillespie. “We don’t have a big IT staff, but I knew the students in the graduate level Cybersecurity program at Fairfield University could help us.” He contacted Mirco Speretta, PhD, director of the master’s program in Cybersecurity, who quickly created a capstone project around the needs of the diocese.
The resulting project involved seven graduate students. After analyzing several protocols for best practices, the students chose to implement the National Institute of Standards and Technology (NIST) 800-53 framework, a protocol that allows for customization and was a good fit for the diocese’s 80 parishes and 29 schools.
“These capstone projects, which directly benefit the most vulnerable nonprofits, are directly aligned with our Jesuit mission and are a common theme across our graduate programs” said Andres Leonardo Carrano, PhD, dean of the School of Engineering.
To properly implement a cybersecurity framework, one needs to be familiar with the organization, including all the procedures and the operational activities that handle data, explained Dr. Speretta. “The students started by interviewing stakeholders, such as the chief financial officer, the human resource director, and also those on the technical side,” he said, “to understand how the organization works and identify key areas where security governance should be applied.”
