RedTech30 AEC Case Study

Implementing the NIST Risk Management Framework
with Ronald Woerner
Case Study
Red30 Tech AEC (Architecture, Engineering, and Construction) is a wholly owned subsidiary of Red30 Tech.
It was formed shortly after Red30 Tech built its tenth data center when they acquired the firm that was
designing and building their data centers and offices. Red30 Tech CEO Oliver McNeil said at the time, “We’re
already a leader in technology. Why pay someone else to do what we’re great at?”
Red30 Tech AEC provides computer-aided design (CAD), architecture, construction program management,
and engineering services to companies and government agencies throughout the US with the focus
on sustainability and scalability. When McNeil established Red30 Tech AEC, he insisted that they be an
autonomous unit led by his college buddy Chris Meyers. Their major clients include city, state, and federal
government agencies; energy sector and utility companies; and universities.
Red30 Tech AEC employs approximately 350 employees in five cities. The main office is in Reston, Virginia,
which houses 100 of the employees. Red30 Tech AEC also has offices in Chicago, Illinois; Austin, Texas; San
Jose, California; and Seattle, Washington, with each having around 60 employees. Each of the offices is tied
to a Red30 Tech data center.
Their IT infrastructure is as follows:

• Each office and data center have state-of-the-art physical security in place.
• The major data types used or stored at Red30 Tech AEC includes architectural and engineering
diagrams, construction project management files (for example, parts lists, timelines, personnel),
client demographic and financial data and points of contact, and company financial data.
• They primarily use Microsoft servers and PCs with a number of Mac computers used by architects
and engineers to perform design work. They use Active Directory and have a web server for their
internet website, ten servers housing their architecture applications, a training server, eight Microsoft
SQL database servers, and two redundant Microsoft Exchange servers for email. They have their
own internal cloud architecture for file sharing across the company using a combination of legacy
SharePoint and shared folders.
◦◦ There are 24 virtualized Windows Server 2016 servers in the main office on eight physical
server blades.
◦◦ System updates and patches are pushed from the main office using Windows Server Update
Services (WSUS). Most servers and clients get Microsoft updates once a month, but some are
missed. Also, most third-party products (for example, Adobe PDF and Flash, Java, AutoCAD,
and web browsers) are not kept up to date.
◦◦ Each satellite office has their own virtualized servers for storing files, printing, and running
local applications.
◦◦ Each office has its own decentralized wireless network connected to the production network.
Default SSID is used with a common password of Spartans2018.
Implementing the NIST Risk Management Framework with Ronald Woerner 1 of 3

with Ronald Woerner
◦◦ Each employee has a desktop or laptop PC running Windows 10. HR personnel have laptops for
conducting interviews.
• They outsource their email spam filter and all HR applications to two separate third-party companies.
• The network at each location sits behind a gateway router and firewall (Cisco ASA 5525).
• Trend Micro Antivirus is in use but is not automatically updated across the company since many
employees work remotely.
• Employees often work remotely and use DUO multifactor authentication to gain access to the
corporate systems through a company VPN (Cisco AnyConnect v4.6.). Once connected through
the VPN, many engineering employees will RDP to Windows desktops and servers to access their
applications and files.
• Remote employees have local administrator capabilities and often store files on their local PCs. Many
will back up their own data on their own USB drives.
• The Red30 Tech Accounting team is spread across each location to provide local support for clients.
The accounting application they use is KPMG Spark.
• A password policy is in place requiring at least eight characters with complexity. Employees need to
change their passwords at least once every 90 days.
• Draymond Jackson, Red30 Tech AEC director of IT, has a full-time staff of 12 employees, one of which
does security duties part time. There is at least one IT staff member at each location.
There are a few known issues with their IT infrastructure and organization.
• Recently, a number of laptops and office equipment were stolen from the office.
• Two employees (an HR manager and an architect) in the Austin office were victims of
CryptoLocker ransomware.
• Vulnerability scanning is conducted monthly by the parent company. Only high-risk items are shared
with the AEC IT director.
• It’s at the data owner’s discretion as to whether or not to secure their data files or folders. Many do
not secure their files because there are many other employees who often need to work with the files.
There have been rumors that customer data and intellectual property have been lost.
• Two employees recently left the company and went to Red30 Tech AEC’s biggest competitor, where
they just landed a contract with their largest account.
• Vendors are allowed access to the site and computers without authorization or supervision.
• On-site staff at each location provides IT support part time along with their other responsibilities.
Password resets are done by giving out a generic password of Red30TechAEC.
• The organization’s IT policies were written in 2012. There have been many attempts to update them,
but it always gets put on the back burner. Each AEC new employee needs to sign an acceptable user
agreement upon hire and go through a 30-minute security awareness presentation. There is no
requirement for employees to re-sign the agreement or receive other security training.

with Ronald Woerner
• The last audit of system accounts was in 2018. It was found 20 prior employees still had access to
internal networks and applications.
• The parent company has a 24x7x365 network and security operation center (NSOC) to monitor
and alert on anomalies and potential threats or vulnerabilities. The security information and event
management (SIEM) application will send high-risk alerts to the IT director’s email. The SIEM was
initially put in place in 2018. There’s a project for 2021 to update it with new rules, but it’s rumored
this is on hold due to recent events.
• The Red30 Tech AEC incident response plan was written in 2015 and updated in 2017. It contains
contact information for now-terminated employees. There is no specific response or recovery tests
nor training, as IT says they rely on the parent company. The recovery plan is failover to one of the
other sites.
Red30 Tech AEC has been told by their state and federal government clients that they need to be NIST
compliant for all future contracts. The driver is the Cybersecurity Maturity Model Certification (CMMC)
compliance required for their US defense industry clients. Julie Livingston, Red30 Tech AEC chief financial
officer and head of audit, has hired you as an independent assessor to conduct the assessment to help them
determine compliance gaps and security risks for their entire IT infrastructure, organization, and processes.

RedTech30 AEC Case Study

Uploaded by

Copyright:

Available Formats

RedTech30 AEC Case Study

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RedTech30 AEC Case Study

Uploaded by

Copyright:

Available Formats

Implementing the NIST Risk Management Framework

with Ronald Woerner

Their IT infrastructure is as follows:

Implementing the NIST Risk Management Framework with Ronald Woerner 1 of 3

Implementing the NIST Risk Management Framework with Ronald Woerner 2 of 3

Implementing the NIST Risk Management Framework with Ronald Woerner 3 of 3

You might also like