IT Lab: Summer Cybersecurity Fellowship

What solidified my drive to stay in this field were the Friday external speakers. There was one particular individual, a CISO at Yahoo, who came in and told us a riveting story about when Yahoo got breached. And I just thought, ‘I can’t believe she got paid to do that.’ Rachel Kang | IT Lab '18 / Intelligence & Invesitgations, OpenAI

• Recent Projects

  United States Strategic Command (USSTRATCOM) and the National Security Innovation Network (NSIN)

  Students worked with USSTRATCOM subject-matter experts to research and recommend strategies to address the following policy and technical challenge problems:

  • What is the role of U.S. nuclear weapons in deterring strategic or existential attacks?
  • What could break deterrence in the 21st century? What could strengthen deterrence?
  • What is the efficacy of multi-domain deterrence in an economically competitive environment?
  • How might cyber-attacks on Nuclear Command, Control and Communications (NC3) systems introduce doubt in the reliability and effectiveness of an actor’s NC3 systems?

  Department of Homeland Security Cybersecurity Infrastructure Security Agency (CISA) and the National Risk Management Center (NRMC)

  • Students developed a comprehensive inventory of lists, historical compilations, and trends of cybersecurity incidents.
  • Students developed a comprehensive inventory of metrics used to describe cybersecurity incidents and how they are reported.
  • Students developed a profile of model organizations that produce metrics/statistics today.
  • Students developed an anatomy of a complex cyber incident as an exemplar use case.

  Carnegie Mellon University CISO Office

  • Students assisted in the development and documentation of the control/maturity framework and process indicators for the implementation of a business resiliency program aligned to the ISO 22301 Societal security -- Business continuity management systems international standard.
  • Students developed and deployed data analytics and visualization tools for security monitoring at Carnegie Mellon University.  Deliverables included building dashboards using the ‘glass table’ functionality of Splunk for Enterprise Security.

  Allegheny Health Choices, INC.

  • Students conducted a feasibility study of the implementation of blockchain technologies to protect health care data with Allegheny Health Choices.

  Consortium for Public Education

  • Students performed a vulnerability assessment of the technology currently used by the Consortium for Public Education. The assessment documented a technology baseline along with recommendations for a strategic plan for long-term technology investments.

  Urban League of Greater Pittsburgh

  • Students developed a technical training curriculum for the Pittsburgh Public School District to prepare students for continuing education or entry into the Information Security workforce.

  Pittsburgh Mercy

  • Students developed a security strategy for Pittsburgh Mercy to define organizational policy for the selection, support, and security of technology around mobile computing.

  Allegheny Digital

  • Students examined smart home automation technologies to further understand information security and data privacy risks, such as data leakage and ease of compromise. The IT Lab project team developed technical countermeasures to minimize the threat surface, providing consumers with greater control over the data their smart home is storing, processing, and transmitting.

  National Cyber Forensic Training Alliance (NCFTA)

  • Students developed a comprehensive written Information Security Plan that articulates and documents the organization’s administrative, technical, and physical safeguards for the protection of all information and data maintained, including information maintained on behalf of third parties. The plan recommended procedures for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, and protecting all information and data.

  Nimbus Robotics

  • Students performed a security assessment on the IT infrastructure of the organization and evaluated the security of data collected, stored, and transmitted from bionic shoes produced by the company to Nimbus Robotics data repositories.