cs-3113: add draft report for group project
382
Fall-2024/CS-3113/Group-Project/4-Draft-Report/Draft-Report.typ
Normal file
@ -0,0 +1,382 @@
|
||||
#let gold = rgb("#ffc500")
|
||||
#set text(font: "Calibri", size: 12.5pt)
|
||||
#show link: set text(blue)
|
||||
#let gradient_fill = (
|
||||
color.hsl(230deg, 60%, 20%),
|
||||
color.hsl(225deg, 60%, 15%),
|
||||
color.hsl(220deg, 60%, 15%),
|
||||
color.hsl(220deg, 60%, 15%),
|
||||
color.hsl(220deg, 60%, 15%),
|
||||
color.hsl(220deg, 60%, 15%),
|
||||
color.hsl(210deg, 60%, 15%),
|
||||
color.hsl(210deg, 80%, 20%),
|
||||
)
|
||||
|
||||
#set heading(numbering: "1.1.")
|
||||
#show heading.where(level: 1): it => (
|
||||
context {
|
||||
if counter(heading).get().first() != 1 {
|
||||
pagebreak()
|
||||
}
|
||||
let inset = (x: 8pt, y: 5pt)
|
||||
block(
|
||||
inset: inset,
|
||||
radius: 100%,
|
||||
fill: gold,
|
||||
text(
|
||||
font: "Roboto",
|
||||
fill: black,
|
||||
size: 1.2em,
|
||||
tracking: .1pt,
|
||||
weight: "black",
|
||||
)[#it],
|
||||
)
|
||||
}
|
||||
)
|
||||
|
||||
#let navy = rgb("#00265E")
|
||||
#show heading.where(level: 2): it => {
|
||||
let inset = (x: 8pt, y: 5pt)
|
||||
block(
|
||||
inset: inset,
|
||||
radius: 100%,
|
||||
fill: navy,
|
||||
text(
|
||||
font: "Roboto",
|
||||
fill: white,
|
||||
size: 1.1em,
|
||||
weight: "bold",
|
||||
)[#it],
|
||||
)
|
||||
}
|
||||
#show heading.where(level: 3): it => {
|
||||
let inset = (x: 8pt, y: 5pt)
|
||||
block(
|
||||
inset: inset,
|
||||
radius: 100%,
|
||||
fill: red.darken(50%),
|
||||
text(
|
||||
font: "Roboto",
|
||||
fill: white,
|
||||
size: 1.15em,
|
||||
weight: "bold",
|
||||
)[#it],
|
||||
)
|
||||
}
|
||||
#let shieldnet_font = "IBM Plex Sans"
|
||||
#let title = [NARO, INC. Cybersecurity Assessment Report]
|
||||
#set page(
|
||||
"us-letter",
|
||||
margin: (x: 1in, top: 1in, bottom: 1in),
|
||||
header: context if here().page() > 1 {
|
||||
align(
|
||||
center + horizon,
|
||||
box(
|
||||
width: page.width + 4em,
|
||||
height: 100%,
|
||||
fill: gradient.linear(..gradient_fill),
|
||||
[
|
||||
#place(left + horizon, dx: +page.margin.length)[
|
||||
#text(
|
||||
size: 1.1em,
|
||||
fill: gold,
|
||||
font: shieldnet_font,
|
||||
weight: "black",
|
||||
)[SHIELDNET CYBERSECURITY],
|
||||
#text(size: 1.1em, fill: white)[#title],
|
||||
]
|
||||
#let icon_size = 45%
|
||||
#place(
|
||||
right + horizon,
|
||||
dx: -page.margin.length,
|
||||
box(
|
||||
baseline: icon_size,
|
||||
image(
|
||||
"./assets/shieldnet-logo-7.svg",
|
||||
height: icon_size,
|
||||
fit: "contain",
|
||||
),
|
||||
),
|
||||
)
|
||||
],
|
||||
),
|
||||
)
|
||||
},
|
||||
footer: context if here().page() > 1 {
|
||||
text(
|
||||
size: 0.8em,
|
||||
fill: color.luma(35%),
|
||||
[
|
||||
#v(1.5em)
|
||||
ShieldNet Cybersecurity
|
||||
#h(1fr)
|
||||
#{
|
||||
here().page()
|
||||
}
|
||||
#align(
|
||||
center + bottom,
|
||||
block(
|
||||
width: page.width,
|
||||
height: 20%,
|
||||
fill: gradient.linear(..gradient_fill),
|
||||
),
|
||||
)
|
||||
],
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
// COVER PAGE
|
||||
|
||||
#set page(background: context if here().page() == 1 {
|
||||
box(
|
||||
fill: gradient.linear(angle: 60deg, ..gradient_fill),
|
||||
width: 100%,
|
||||
height: 100%,
|
||||
)
|
||||
|
||||
place(
|
||||
top + center,
|
||||
rect(
|
||||
width: 100%,
|
||||
height: 100%,
|
||||
fill: pattern(
|
||||
size: (18pt, 18pt),
|
||||
place(
|
||||
dy: 3pt,
|
||||
dx: 1pt,
|
||||
circle(
|
||||
radius: 3.5pt,
|
||||
fill: blue.darken(65%),
|
||||
),
|
||||
),
|
||||
),
|
||||
),
|
||||
)
|
||||
|
||||
let globe = read("./assets/globe-thick.svg").replace(
|
||||
"#000000",
|
||||
blue.darken(40%).to-hex(),
|
||||
)
|
||||
place(
|
||||
bottom + right,
|
||||
dy: 70pt,
|
||||
dx: 120pt,
|
||||
rotate(-20deg, image.decode(globe, height: 600pt)),
|
||||
)
|
||||
|
||||
|
||||
let darken_amount = 30%
|
||||
place(
|
||||
top + right,
|
||||
stack(
|
||||
dir: btt,
|
||||
..{
|
||||
let rect_height = 30pt
|
||||
(
|
||||
rect(
|
||||
width: 50pt,
|
||||
height: rect_height,
|
||||
fill: red.darken(darken_amount),
|
||||
),
|
||||
rect(
|
||||
width: 75pt,
|
||||
height: rect_height,
|
||||
fill: gold.darken(darken_amount),
|
||||
),
|
||||
rect(
|
||||
width: 100pt,
|
||||
height: rect_height,
|
||||
fill: blue.darken(darken_amount),
|
||||
),
|
||||
)
|
||||
},
|
||||
),
|
||||
)
|
||||
|
||||
place(
|
||||
horizon + left,
|
||||
rect(
|
||||
fill: blue.darken(darken_amount),
|
||||
height: 100%,
|
||||
width: 8pt,
|
||||
),
|
||||
)
|
||||
|
||||
} else {
|
||||
rotate(45deg, text(size: 250pt, fill: white.darken(6%))[DRAFT])
|
||||
})
|
||||
|
||||
#context {
|
||||
let icon_size = 36pt
|
||||
place(
|
||||
left + top,
|
||||
align(
|
||||
horizon,
|
||||
grid(
|
||||
columns: 2,
|
||||
column-gutter: 5pt,
|
||||
image(
|
||||
"./assets/shieldnet-logo-7.svg",
|
||||
height: icon_size,
|
||||
fit: "contain",
|
||||
),
|
||||
text(
|
||||
size: 1.6em,
|
||||
font: shieldnet_font,
|
||||
fill: gold,
|
||||
weight: "black",
|
||||
)[SHIELDNET\ CYBERSECURITY],
|
||||
),
|
||||
),
|
||||
)
|
||||
place(
|
||||
center + horizon,
|
||||
box(
|
||||
width: page.width,
|
||||
text(
|
||||
font: "Roboto",
|
||||
size: 5em,
|
||||
fill: blue.lighten(75%),
|
||||
weight: "black",
|
||||
)[#title],
|
||||
),
|
||||
)
|
||||
|
||||
place(
|
||||
left + bottom,
|
||||
dy: +8%,
|
||||
text(
|
||||
size: .75em,
|
||||
fill: white,
|
||||
style: "italic",
|
||||
)[ShieldNet Cybersecurity _|_ Prepared for NARO, Inc.],
|
||||
)
|
||||
}
|
||||
#pagebreak()
|
||||
|
||||
|
||||
#set par(
|
||||
leading: 1em,
|
||||
spacing: 2.25em,
|
||||
)
|
||||
// Actual Content
|
||||
= ABSTRACT
|
||||
|
||||
ShieldNet Cyber Security was contracted by NARO, Inc to conduct a cybersecurity audit on its organization. NARO, a small business that specializes in Electric Vehicle (EV) technology, is a non-profit conducting research and development on a small-footprint solar-based vehicle charger that could be installed in apartment complexes. Given the technical nature of the organization’s activities, it’s fitting that employing adequate cybersecurity measures will ensure the continued and sustained operation of their business, which is currently 35 employees strong. ShieldNet took on the task of evaluating the organization’s cybersecurity to find their weaknesses, and provide fixes to maintain their security in the future.
|
||||
|
||||
ShieldNet was given an overview of operations by NARO to assist in understanding how and where they were likely to be exploited. This included information ranging from the physical office spaces to wireless infrastructure and a run-down of NARO’s outsourced IT contractor. ShieldNet also provided NARO with an Audit Checklist to help gauge, at an objective level, where it lies in terms of cybersecurity practice. This helped ShieldNet understand where the organization was putting its effort into keeping their organization secure, and what may need consideration for the future.
|
||||
|
||||
Despite the efforts made by NARO to secure their organization, ShieldNet discovered various variabilities that posed a threat to their information integrity. Some were physical, such as the physical offices potentially allowing unauthorized entry, while others were digital, such as the existence of unencrypted backups. The organization had made more than minimal efforts to ensure security, however there are errors that need correction.
|
||||
|
||||
We recommend that NARO follow-up this assessment with another audit as soon as six months following its conclusion, or as late as a year. ShieldNet stresses that while improvements to NARO’s security handling can help in the short-term, it’s important for the long-term that NARO maintains the process of evaluating its cybersecurity so it can stay ahead of threats to its organization. It is here we’d like to thank NARO, Inc for its cooperation with our auditing practices, especially William Donaldson III, who’s insight and dedication to the project allowed us to conduct our best work in uncovering critical flaws that needed immediate addressing.
|
||||
|
||||
= TABLE OF CONTENTS
|
||||
#par(leading: .95em, outline(title: none, indent: 1.25em))
|
||||
|
||||
= INTRODUCTION
|
||||
This section lays out the background, the reasons why NARO chose to undergo a cybersecurity assessment, the scope of the assessment, what was and wasn't evaluated during the assessment, and finally the organization of this report.
|
||||
|
||||
== Background
|
||||
|
||||
Cybersecurity threats have been expanding targets to include energy infrastructure and energy research companies. As a result, the Department of Energy’s (DOE) Office of Energy Efficiency and Renewable Energy (EERE) delivered a report to congress in May of 2021 to improve cybersecurity among energy companies. Due to this, NARO, Inc. (NARO) contracted with ShieldNet to undertake a cybersecurity assessment in the wake of increasing scrutiny from the DOE’s EERE surrounding NARO’s solar energy technologies.
|
||||
|
||||
== Scope
|
||||
*TO BE FILLED OUT WHEN OUR ACTIVITIES ARE BETTER UNDERSTOOD. SOME OF THIS MAY NEED TO BE MADE UP DUE TO THE LACK OF INFORMATION PROVIDED.*
|
||||
|
||||
== Report Organization
|
||||
|
||||
The remaining content within this report is organized as follows: Section 2 provides an overview of NARO’s systems. Section 3 breaks down the methodologies employed by ShieldNet during our cybersecurity assessment and section 4 describes the ShieldNet audit team’s activities done during the cybersecurity assessment. The results of the assessment and the team’s recommended mitigations can be found within section 5. Section 6 is the final conclusions of the ShieldNet team and additional proposed actions to be taken by NARO based upon this assessment.
|
||||
|
||||
= SYSTEM OVERVIEW
|
||||
NARO provided ShieldNet with various documentation regarding its physical and digital infrastructure. This information laid the groundwork for the vulnerabilities ShieldNet investigated. It also provided useful information regarding what was already secure, and what was being done right. NARO’s offices house its 35 employees, and its digital infrastructure consists of a few workstations, laptops, and a server room.
|
||||
|
||||
== Physical Office Spaces
|
||||
NARO leases two separate office spaces, one for engineers and R&D, and another for administrative staff. The engineering building is its own building, however, the administrative office shares a floor with another organization, Geological Analysis and Surveying (GAS). NARO and GAS share many sections of the building, including custodial rooms, storage, a kitchen, and most notably, a server room. There are 20 staff members that work in the engineering department, and 15 staff members working in the administrative department, totaling 35 employees between the two buildings. The engineering building has basic security features, including proximity cards for access to the engineering office, PIN locks for entering the vehicle bays from the office, and padlocks preventing access to the vehicle bay from the overhead doors on the outside. There also exists a lab for testing equipment and a hazmat storage area, however, the organization of the building regarding these two rooms is not explicit.
|
||||
The building the administrative team is occupying has a second floor, which is currently under renovation. The exterior building doors are left unlocked so construction crews can easily access the building while GAS and NARO are not present/working. The administrative office doors from the lobby are left unlocked during normal working hours, making their proximity card readers only necessary outside of working hours. The receptionist can also bypass the magnetic door locks with a button located at their desk. Leaving the office is as simple as walking to the exit, as the magnetic locks will automatically disengage.
|
||||
== Workstations
|
||||
NARO utilizes very few workstations compared to laptops. The only workstations present across the two buildings are located in the vehicle bay in the engineering building. NARO utilized workstations in this particular area to collect data on vehicle charging that is not capable of being captured by a laptop due to the lack of expansion card support. All devices outside of this (and presumably excepting the servers), are laptops.
|
||||
== Laptops
|
||||
NARO has many windows laptops, each with Office 365, Nord VPN, and Zoom softwares installed. Additionally, many laptops have MatLab, and employees have permissions to download other applications like TikTok, seemingly without needing approval. Laptops update automatically and use the pre-installed Windows Defender as their main antivirus and firewall and use BitLocker for data encryption. Laptops are not stored anywhere when not in use and can be taken home by employees or left on desks unattended. Laptops are monitored and interaction through the laptop is logged into a central logging system. Information can also be deleted remotely on all laptops through this monitoring system. A few older laptops are stored in a storage cabinet.
|
||||
== Remote Access
|
||||
Employees can connect to the NARO network with a VPN that is installed on every laptop, or access work emails through Office 365. The VPN requires NARO username and password to access. According to NARO’s checklist results, this VPN can also be accessed through personal devices (phones, home laptops, etc.). Their network drive is also accessible through OneDrive.
|
||||
== Server Room
|
||||
The server room is located in the NARO administrative building. Their physical server room is shared with GAS, however the networks are separate between NARO and GAS. Each desk, and subsequently each employee, seems to have access to a network KTM that allows direct access to the servers. Unfortunately, the server room seems to lack protections from leaks caused by other rooms in the building according to NARO, Inc. Additional Information. The server room also houses the on-site, physical backup devices.
|
||||
== Servers
|
||||
NARO has 17 servers split between two different brands, Dell and Supermicro. The Dell servers are used for the Windows Domain and run Windows Server 2019, while the Supermicro servers are for R&D data and run Ubuntu 18.04.6 LTS.
|
||||
== Wireless
|
||||
NARO utilizes both a NARO business network, where authentication is required and MAC address filtering is applied, and a NARO guest network where no authentication is required. The two networks are connected via directional antennas on both buildings.
|
||||
== IT Support
|
||||
IT support is outsourced to PITA, who has configured automatic updates on all necessary systems. A PITA consultant comes in every two months to update systems and software that require it, and will come in if there is a failure in anything. PITA has remote access to all systems configured via TeamViewer. So far, PITA has made 2 - 3 visits to NARO for required maintenance after an occurring failure or critical issue. Additionally, PITA seems to be responsible for keeping backups and checking logs for malicious activity.
|
||||
= ASSESSMENT METHODOLOGY
|
||||
ShieldNet’s team utilized an assessment methodology based upon NISTIR-7621 known as ShieldNet’s Small Organization Security Assurance (SOSA) Methodology. The SOSA Methodology was chosen due to NARO’s categorization as a small business. SOSA is expanded upon in the following sections.
|
||||
== The SOSA Methodology
|
||||
SOSA was developed with the security challenges small businesses, non-profits, and other small entities face in mind. Small businesses often have security concerns already handled or otherwise remediated differently in larger companies and organizations. SOSA is designed to be flexible to the widely varying needs found within small organizations and was purposely designed to be broadly applicable to any small organization. The SOSA Methodology has five primary phases derived from NISTIR-7621, those being: Identify, Protect, Detect, Respond, and Recover. These phases are described in detail in the following sections.
|
||||
=== Identify
|
||||
The Identify phase of the SOSA Methodology develops an organizational understanding of how to manage cybersecurity risk to systems, assets, data, and capabilities. It gives an organization, in this case NARO, an understanding of their existing business security stance, their current resources, and builds an awareness of their cybersecurity risks. This enables an organization to prioritize its efforts to remediate, enhance, and reduce security risks related to their business needs. The Identify phase may result in recommendations to modify asset management processes, improved business environment awareness, enhancing governance of risk, and recommended improvements to an organization’s risk management strategy.
|
||||
=== Protect
|
||||
The Protect phase of the SOSA Methodology drives the development of appropriate safeguards to be used within a given organization. This phase supports creating methods or implementing services that limit or contain the potential impact of a security event. Observations from this phase can include access control implementations, improvements to staff training, enhancing data security, implementing information protection procedures, implementation of security maintenance, and implementation of protective technologies.
|
||||
=== Detect
|
||||
The Detect phase is responsible for the identification of controls and activities that should be implemented to improve an organization’s discovery and recognition of cybersecurity events. The goal is to enhance the timely discovery of cybersecurity events to enhance an organization’s resilience in their risk management strategies. Recommendations can include improving the identification of anomalies and events, implementing continuous security monitoring, and detection process improvements.
|
||||
=== Respond
|
||||
The Respond phase assists in the development of appropriate actions to take in the face of a cybersecurity event. The Respond phase supports an organization’s ability to reduce the impact of a potential cybersecurity event and improve critical service uptime. Recommendations coming from this phase may include response planning, communications enhancement, mitigating risk vectors, and general organizational security response improvements.
|
||||
=== Recover
|
||||
The Recover phase handles the restoration of assets and operations impacted by a cybersecurity incident. It supports the timely restoration of operations which reduces the felt effects of cybersecurity incidents. This may include recommendations surrounding recovery planning, recovery improvements, and recovery communication improvements.
|
||||
|
||||
= ASSESSMENT ACTIVITIES
|
||||
NARO provided ShieldNet with various documentation of its work environment, both physical and digital to assist in vulnerability discovery. ShieldNet also provided NARO with an Audit Checklist with the purpose of understanding its current minimum cybersecurity requirements. This directly influenced some of ShieldNet’s investigative activities, the results of which will be explained in the following section.
|
||||
== NARO Overview Review
|
||||
NARO provided ShieldNet Cyber Security with various insights into its operational facilities and procedures. This included information regarding its offices, devices, servers, network infrastructure, and IT support. This information was necessary for us to understand where NARO was most vulnerable, and where attacks are most likely to occur from. A follow up from William Donaldson III provided additional insight into NARO’s wireless networking, as well as the backup procedures provided by an outsourced IT company, PITA.
|
||||
== Audit Checklist
|
||||
NARO was made to fill out an audit checklist to help us understand what cybersecurity procedures/policies the company already had in place. ShieldNet Cyber Security was able to make many conclusions from the results of this checklist, including what practices in place were sufficient, what could use improvement, and what requires immediate implementation.
|
||||
== Email Phishing
|
||||
Phishing emails are a common way for an attacker to gain access to sensitive information. Attackers typically pose as an organization or individual of importance, such as someone with immediate work or familial relation to the target, and attempt to make the target click on a malicious link or download a dangerous file. Phishing can be conducted in a variety of manners, however, our team focused on email phishing schemes targeting NARO staff. In an ideal scenario, email services would filter out attempts to phish for private information. Most significant email services have sufficient spam filtering, but no filter is perfect.
|
||||
We conducted multiple phishing campaigns, targeting both engineering and administrative staff by posing as various individuals or companies. Many of the schemes involved mimicking threats of compromised account security, asking users to follow a link to reset their password that would have been designed to capture account credentials. Others involved sending attachments and seeing how many targets downloaded/opened them.
|
||||
The goal of the phishing schemes were not to actively steal any employee account information or to install malicious software on NARO or user machines *(I AM PUTTING THIS HERE BECAUSE WE HAVE NOT DISCUSSED NARO RULES OF ENGAGEMENT, AND I DOUBT NARO WANTS SHIELDNET TO STEAL EMPLOYEE INFORMATION FOR THE SAKE OF EXAMPLE)*, but to instead understand the threat such schemes poses on employees and NARO as a whole.
|
||||
= RESULTS AND RECOMMENDATIONS
|
||||
The findings from Section 4’s assessment activities are laid out below. This includes an evaluation of NARO’s strengths, weaknesses, and general observations as discovered by ShieldNet. Strengths observed show what NARO is doing correctly, and should continue to do. Weaknesses reveal vulnerabilities NARO’s current infrastructure holds, their severity, and how NARO can mitigate them. General observations don’t fall into either category, but instead can be read as cautions that could offer improvement, without having an immediate threat to cybersecurity.
|
||||
== Weaknesses
|
||||
|
||||
*(Moderate) Exterior doors are left unlocked outside of NARO business hours*\
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Justification]: As outlined in the overview of NARO, the external doors to the building housing the administrative office are left unlocked because of the “off-hour” work nature of the construction crew renovating the second floor. While on its own, this wouldn’t be a significant threat to the administrative office’s security, the reception desk has a button which disables the magnetic locks to NARO’s administrative office. Assuming the reception desk is not manned outside of typical business hours, the unlocked doors and reception bypass button could be utilized by a bad actor to grant unauthorized access into NARO’s administrative office. The engineering building is not exploitable in this manner, since all points of entry into that building require either a proximity card, PIN, or destructive means to enter.]
|
||||
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Mitigations]: We recommend NARO implements a multi-factor means of opening doors to the administrative office. Requiring a proximity card of an authorized employee in addition to pressing the button would minimize the risk that anyone who can simply press the reception desk button would be able to enter the office. A PIN could also be used, however, NARO would need to ensure that the PIN could not be seen when being entered by the receptionist. In this situation, a proximity card is both convenient for the receptionist and minimizes the risk of the second factor becoming redundant if the PIN were to be leaked.]
|
||||
|
||||
*(Severe) NARO and GAS share server rooms*\
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Justification]: NARO and GAS sharing the first floor also means they share a server room. This is remarkably dangerous because individuals outside of the NARO organization can access the physical server modules NARO utilizes. This also means NARO’s security of the server room is reliant on GAS’s ability to keep the server room secure. If either of them falter, both of their servers are at risk. Perhaps most distressingly, NARO keeps hard drives with unencrypted backup data in the server room. Even if these are under lock and key, if anyone were to possess those drives, any and all data on them would be easily accessible.]
|
||||
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Mitigations]: Unless NARO can move office spaces into an area where they can have an isolated server room, nothing can be done about the shared nature of the server room. Instead, NARO should act as though the server room is already compromised. This means including multiple means of protecting the physical servers from unauthorized access (such as physically locking the racks from being tampered with easily) and ensuring any and all devices stored in the server room are essentially impossible to be read by encrypting them. Ideally, backups should be stored off-site where no one but trusted NARO employees could access them.]
|
||||
|
||||
== Strengths
|
||||
- The engineering building is, all-around, very secure from unauthorized access. An unorganized individual would have trouble getting anywhere from attacking it. A simple component of this security is that the locks to the vehicle bays’ overhead doors are located on the interior of the vehicle bay. This prevents attackers from using simple destructive means to break the locks and gain access to the vehicle bay. An attacker would likely need to have insider knowledge of the overhead doors and its locks if they wanted to attack them.
|
||||
== Observations
|
||||
|
||||
*No workstations are present in the administrative office*\
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Description]: Since the only devices used for work in the administrative office are laptops and the server room, there are no physical workstations that can be accessed in the administrative office. Despite this, laptops may still be left behind by employees on their desks.]
|
||||
|
||||
#box(inset: (
|
||||
left: 2em,
|
||||
))[#underline[Recommendations]: NARO should encourage employees to take their work devices home at the end of the work day, or provide the ability to lock them up either in their desk or somewhere else in the office to keep them from immediate contact. Even though the laptops are encrypted and password protected, they can still be stolen if left unattended.]
|
||||
|
||||
= CONCLUSION AND FOLLOW-UP ACTIVITIES
|
||||
|
||||
The cybersecurity assessment team ShieldNet covers the evaluation of NARO, inc. and their cybersecurity practices. This assessment focuses on evaluating NARO’s physical and digital security, especially concerning its shared facilities. The ShieldNet team utilized the Small Organization Security Assurance (SOSA) Methodology, which is based on NISTIR-7621 and tailored for small organizations. The findings included several vulnerabilities but also included its best practices that will ensure great security.
|
||||
|
||||
The assessment identified various vulnerabilities in NARO’s cybersecurity, specifically around shared facilities and device access controls. This also includes that NARO shares a server room with Geological Analysis and Surveying (GAS), which compromises the security of NARO’s servers and physical backups and unauthorized access from non-NARO representatives, which presents a risk to the integrity of NARO’s data. External doors to NARO’s administrative office are left unlocked outside business hours and NARO’s dependence on laptops, which can be left unattended in unsecured areas, creates vulnerabilities. Although equipped with basic security software, laptops and data backups lack sufficient physical protections or encryption.
|
||||
|
||||
For follow-on activities, in order to strengthen security, NARO should take these recommended steps to ensure a matured system design:
|
||||
|
||||
+ Improving physical security is a priority, including moving to a dedicated server room or adding locked racks and restricted access in shared spaces.
|
||||
+ Additional controls like multi-factor access for the administrative office would further reduce risks.
|
||||
+ All data backups should be encrypted, ideally with off-site storage for added safety. For device security, NARO could provide lockable storage for laptops and restrict VPN access to NARO devices with multi-factor authentication. Regular cybersecurity training, such as phishing simulations, will help employees stay alert to potential threats.
|
||||
+ Finally, regular security audits, vulnerability scans, and penetration tests will ensure NARO’s defenses remain strong and up to date against evolving threats.
|
After Width: | Height: | Size: 18 KiB |
241
Fall-2024/CS-3113/Group-Project/4-Draft-Report/assets/globe.svg
Normal file
@ -0,0 +1,241 @@
|
||||
<?xml version="1.0" standalone="no"?>
|
||||
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN"
|
||||
"http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
|
||||
<svg version="1.0" xmlns="http://www.w3.org/2000/svg"
|
||||
width="1247.000000pt" height="1280.000000pt" viewBox="0 0 1247.000000 1280.000000"
|
||||
preserveAspectRatio="xMidYMid meet">
|
||||
<metadata>
|
||||
Created by potrace 1.15, written by Peter Selinger 2001-2017
|
||||
</metadata>
|
||||
<g transform="translate(0.000000,1280.000000) scale(0.100000,-0.100000)"
|
||||
fill="#000000" stroke="none">
|
||||
<path d="M5870 12789 c-934 -56 -1901 -349 -2705 -819 -664 -389 -1262 -905
|
||||
-1744 -1505 -657 -818 -1107 -1800 -1305 -2845 -83 -438 -110 -739 -110 -1220
|
||||
0 -481 27 -782 110 -1220 178 -945 564 -1840 1124 -2609 331 -454 754 -895
|
||||
1187 -1237 54 -43 134 -112 179 -154 125 -117 291 -231 479 -328 140 -72 656
|
||||
-318 760 -362 593 -251 1197 -402 1860 -466 251 -25 809 -25 1060 0 819 79
|
||||
1576 299 2269 660 572 297 674 360 901 557 50 43 160 135 245 206 171 141 488
|
||||
447 640 618 788 883 1314 1951 1534 3115 83 438 110 739 110 1220 0 481 -27
|
||||
782 -110 1220 -218 1155 -731 2203 -1511 3090 -150 171 -477 489 -653 636
|
||||
-845 707 -1833 1171 -2892 1359 -469 82 -965 112 -1428 84z m700 -49 c1337
|
||||
-82 2558 -570 3590 -1434 257 -215 690 -653 659 -665 -8 -3 -41 -35 -74 -70
|
||||
-33 -35 -103 -96 -156 -136 -92 -69 -315 -205 -335 -205 -6 0 -51 53 -101 118
|
||||
-432 558 -973 1040 -1612 1436 l-152 94 46 27 c62 36 233 166 270 204 27 29
|
||||
28 33 13 47 -15 15 -23 11 -95 -51 -79 -67 -215 -163 -265 -185 -24 -11 -34
|
||||
-8 -116 39 -120 68 -526 266 -679 330 -459 193 -1015 367 -1388 436 -49 10
|
||||
-92 19 -94 21 -8 8 328 4 489 -6z m-985 -54 c-541 -138 -1066 -344 -1528 -600
|
||||
-75 -42 -140 -76 -143 -76 -17 0 -101 129 -121 187 l-11 31 56 25 c507 226
|
||||
1164 398 1777 466 146 16 141 10 -30 -33z m374 -206 c22 -379 40 -1044 29
|
||||
-1055 -2 -2 -116 0 -253 6 -288 11 -680 51 -701 72 -6 6 106 233 174 352 69
|
||||
122 222 350 299 445 37 47 109 126 158 176 106 107 266 229 276 211 4 -7 12
|
||||
-100 18 -207z m112 169 c147 -95 348 -288 489 -470 177 -228 440 -670 410
|
||||
-689 -14 -9 -55 -14 -280 -35 -155 -15 -628 -36 -641 -29 -3 2 -9 144 -12 316
|
||||
-7 321 -23 705 -36 861 -4 48 -4 87 0 87 3 0 35 -19 70 -41z m-316 -21 c-243
|
||||
-201 -491 -540 -697 -952 -44 -89 -82 -163 -84 -165 -5 -5 -189 37 -304 70
|
||||
-188 54 -437 159 -425 179 9 15 230 198 320 266 345 260 767 487 1150 618 95
|
||||
32 97 32 40 -16z m775 -109 c399 -177 789 -435 1130 -747 58 -52 106 -99 108
|
||||
-103 9 -21 -612 -169 -712 -169 -17 0 -29 15 -55 68 -99 204 -290 504 -434
|
||||
682 -93 116 -306 327 -380 378 -26 18 -47 35 -47 36 0 10 264 -89 390 -145z
|
||||
m95 46 c281 -77 638 -204 939 -332 169 -71 511 -237 628 -304 l91 -52 -59 -30
|
||||
c-81 -41 -224 -103 -315 -137 l-75 -27 -115 104 c-383 350 -723 573 -1239 812
|
||||
-32 14 -17 11 145 -34z m-1286 -19 c-371 -166 -845 -479 -1100 -724 l-47 -44
|
||||
-73 50 c-41 27 -96 69 -124 94 l-49 45 74 42 c257 143 582 295 867 404 170 65
|
||||
504 176 533 177 8 0 -28 -20 -81 -44z m-1545 -466 c16 -25 40 -57 54 -72 l25
|
||||
-27 -48 -28 c-103 -61 -376 -244 -490 -329 -454 -340 -874 -764 -1191 -1204
|
||||
l-86 -119 -55 47 c-107 92 -205 230 -248 349 l-23 62 217 213 c502 495 1032
|
||||
872 1636 1164 l150 72 15 -41 c9 -23 29 -62 44 -87z m169 -196 c34 -31 90 -74
|
||||
124 -97 l62 -41 -152 -155 c-170 -174 -271 -292 -422 -492 -238 -315 -465
|
||||
-702 -626 -1064 -34 -77 -65 -144 -69 -148 -11 -12 -241 78 -415 163 -128 63
|
||||
-273 148 -359 212 -12 8 122 195 261 365 364 447 801 839 1285 1156 139 91
|
||||
239 155 246 156 2 1 32 -24 65 -55z m4582 -162 c511 -318 986 -720 1362 -1154
|
||||
89 -102 227 -273 271 -336 l24 -32 -89 -41 c-276 -128 -673 -261 -1054 -352
|
||||
-23 -6 -28 -3 -40 26 -87 220 -240 542 -352 742 -191 341 -487 745 -713 975
|
||||
-46 47 -84 88 -84 91 0 3 19 12 43 18 59 18 235 94 337 145 l85 43 45 -25 c25
|
||||
-14 99 -59 165 -100z m-4027 -146 c107 -37 366 -106 401 -106 11 0 23 -4 26
|
||||
-10 3 -5 -12 -51 -34 -102 -181 -427 -348 -994 -467 -1585 -36 -182 -39 -193
|
||||
-61 -193 -86 0 -603 77 -843 126 -195 40 -592 143 -607 158 -8 8 136 316 230
|
||||
491 253 473 527 850 880 1212 l148 151 112 -53 c62 -29 158 -69 215 -89z
|
||||
m3388 -48 c295 -300 602 -742 834 -1199 110 -217 246 -527 235 -537 -15 -15
|
||||
-458 -99 -750 -141 -253 -37 -575 -74 -582 -67 -3 2 -20 78 -39 168 -125 600
|
||||
-310 1190 -508 1621 -19 42 -32 77 -28 77 63 0 532 105 667 149 33 11 65 20
|
||||
70 20 6 1 51 -41 101 -91z m-2793 -93 c162 -26 367 -44 628 -55 139 -6 255
|
||||
-12 256 -14 6 -6 21 -1852 15 -1858 -9 -8 -769 8 -1002 22 -387 22 -550 38
|
||||
-550 54 0 6 7 45 15 86 116 600 278 1170 455 1601 28 68 56 136 62 152 12 32
|
||||
4 31 121 12z m1933 -72 c121 -261 282 -717 379 -1073 52 -194 150 -621 157
|
||||
-685 l3 -30 -70 -7 c-278 -28 -891 -57 -1212 -59 l-232 0 -6 378 c-2 208 -7
|
||||
626 -11 929 l-6 552 104 6 c57 3 200 10 318 16 118 7 280 20 360 29 80 10 153
|
||||
19 162 20 12 1 28 -21 54 -76z m-5328 -710 c33 -90 117 -209 218 -309 l93 -91
|
||||
-43 -64 c-249 -372 -491 -878 -648 -1356 -35 -106 -67 -193 -72 -193 -16 0
|
||||
-181 135 -275 225 -103 100 -205 228 -252 320 l-32 60 53 105 c164 327 407
|
||||
710 646 1016 77 99 282 344 288 344 2 0 13 -26 24 -57z m9296 -225 c273 -339
|
||||
519 -724 725 -1136 l81 -162 -102 -103 c-106 -105 -272 -235 -413 -324 -109
|
||||
-69 -226 -136 -229 -131 -2 1 -16 41 -31 88 -160 488 -386 951 -678 1388 -49
|
||||
74 -87 135 -85 136 2 2 35 20 73 41 93 51 195 117 275 177 73 55 196 172 212
|
||||
203 13 22 6 30 172 -177z m-8839 -273 c165 -109 534 -283 654 -310 17 -4 31
|
||||
-8 31 -10 0 -2 -24 -65 -54 -142 -125 -321 -243 -718 -326 -1093 -25 -111 -75
|
||||
-374 -85 -442 -4 -27 -10 -48 -14 -48 -16 0 -218 72 -366 131 -254 100 -676
|
||||
323 -692 365 -6 17 118 387 190 564 108 266 223 502 358 737 65 113 192 313
|
||||
199 313 4 0 51 -29 105 -65z m8154 -138 c235 -354 421 -713 573 -1107 45 -116
|
||||
129 -362 125 -366 -1 -1 -48 -25 -103 -52 -231 -116 -576 -250 -879 -342 -197
|
||||
-60 -555 -153 -561 -147 -3 3 -16 78 -30 168 -74 495 -189 963 -347 1422 -36
|
||||
103 -51 160 -43 162 6 2 74 20 151 40 339 88 699 213 930 324 44 21 84 36 88
|
||||
34 4 -3 47 -64 96 -136z m-7054 -302 c294 -72 617 -129 978 -172 123 -14 146
|
||||
-19 142 -32 -2 -9 -20 -115 -40 -236 -62 -394 -115 -848 -151 -1310 -9 -115
|
||||
-18 -212 -20 -214 -7 -7 -434 50 -671 89 -280 47 -549 105 -775 165 -272 72
|
||||
-306 84 -302 103 2 9 15 82 29 162 90 509 262 1115 429 1511 l15 37 93 -30
|
||||
c51 -16 174 -49 273 -73z m5772 -100 c86 -237 198 -629 258 -910 63 -292 131
|
||||
-703 118 -716 -12 -11 -365 -82 -609 -123 -305 -51 -428 -67 -906 -121 -35 -4
|
||||
-48 -2 -48 7 0 40 -43 552 -61 718 -33 320 -106 843 -140 1002 -6 27 -9 51 -7
|
||||
53 2 3 87 14 189 25 345 39 661 89 954 150 99 21 186 37 194 36 9 0 32 -48 58
|
||||
-121z m-4337 -115 c222 -18 513 -30 1103 -46 l207 -6 0 -896 0 -895 -402 6
|
||||
c-222 4 -520 14 -663 22 -288 17 -705 52 -713 60 -19 18 88 1050 149 1435 53
|
||||
337 53 340 66 340 4 0 118 -9 253 -20z m2893 -2 c15 -61 80 -480 106 -688 52
|
||||
-410 109 -1057 94 -1071 -8 -7 -468 -42 -789 -59 -105 -5 -362 -13 -570 -17
|
||||
l-379 -6 3 895 2 895 38 7 c20 3 125 6 232 6 287 0 1124 42 1139 56 2 2 30 4
|
||||
62 4 51 0 57 -2 62 -22z m-6892 -366 c77 -139 264 -338 450 -480 l96 -73 -28
|
||||
-102 c-111 -394 -202 -943 -234 -1412 -9 -126 -19 -261 -23 -298 l-7 -68 -165
|
||||
83 c-306 155 -512 302 -658 471 l-33 37 26 153 c83 488 203 926 374 1357 58
|
||||
147 163 380 170 380 3 0 18 -22 32 -48z m11197 -205 c202 -481 340 -961 426
|
||||
-1482 37 -224 39 -248 27 -240 -6 3 -35 -14 -63 -40 -92 -82 -268 -197 -448
|
||||
-292 -134 -70 -456 -210 -464 -202 -2 2 -9 92 -15 199 -32 552 -117 1080 -246
|
||||
1527 -25 88 -31 120 -22 126 7 4 74 45 150 90 187 112 360 242 481 362 56 55
|
||||
104 99 108 98 3 -2 33 -67 66 -146z m-10463 -464 c216 -129 515 -264 791 -359
|
||||
76 -26 140 -48 140 -48 1 -1 -2 -26 -7 -56 -58 -359 -104 -917 -115 -1415 -4
|
||||
-157 -10 -285 -14 -285 -17 0 -388 95 -515 131 -235 68 -512 164 -658 228
|
||||
l-48 21 6 107 c34 638 128 1252 261 1711 l16 53 26 -17 c15 -10 68 -42 117
|
||||
-71z m9635 -90 c132 -481 208 -952 240 -1488 5 -93 10 -186 10 -206 l0 -36
|
||||
-212 -71 c-418 -140 -794 -234 -1327 -332 -117 -22 -215 -40 -216 -40 -1 0 -5
|
||||
215 -8 478 -6 509 -22 772 -74 1218 l-5 51 128 32 c491 122 940 279 1304 455
|
||||
63 30 118 56 121 56 4 0 21 -53 39 -117z m-8554 -362 c463 -136 885 -217 1604
|
||||
-309 l55 -7 -2 -35 c-23 -346 -43 -984 -43 -1369 l0 -264 -82 7 c-539 45
|
||||
-1140 128 -1594 219 l-159 32 3 285 c3 408 35 864 87 1250 8 63 18 139 21 168
|
||||
4 28 8 52 9 52 1 0 47 -13 101 -29z m6922 -168 c13 -102 37 -357 53 -558 5
|
||||
-77 13 -354 16 -616 l6 -476 -139 -21 c-395 -61 -953 -122 -1329 -147 -49 -3
|
||||
-108 -9 -129 -12 l-39 -5 6 178 c6 209 -8 1107 -22 1339 -6 88 -9 160 -8 162
|
||||
2 1 104 14 227 28 266 30 520 65 757 106 193 32 525 98 532 105 2 2 16 4 31 4
|
||||
27 0 28 -2 38 -87z m-4858 -182 c387 -30 649 -43 1053 -50 l367 -6 0 -819 c0
|
||||
-450 -2 -821 -4 -825 -11 -18 -1072 13 -1550 44 -121 8 -230 15 -243 15 l-23
|
||||
0 0 288 c0 316 13 764 32 1141 l12 243 50 -6 c28 -3 166 -14 306 -25z m3239
|
||||
-351 c12 -316 18 -1286 8 -1296 -16 -16 -858 -49 -1485 -58 l-292 -4 2 827 3
|
||||
826 350 7 c456 8 930 32 1315 66 l75 7 6 -35 c4 -19 12 -172 18 -340z m-7480
|
||||
-316 c121 -89 319 -205 478 -281 l143 -68 0 -295 c0 -405 24 -766 74 -1110 13
|
||||
-85 22 -157 20 -159 -5 -6 -252 128 -364 197 -218 135 -443 326 -536 457 -31
|
||||
43 -44 54 -60 50 -27 -6 -29 10 -45 295 -17 306 0 807 37 1091 l6 45 83 -81
|
||||
c46 -45 120 -108 164 -141z m12040 39 c47 -521 37 -1031 -30 -1513 -142 -1024
|
||||
-520 -1994 -1100 -2822 -116 -164 -218 -255 -442 -394 -263 -163 -725 -356
|
||||
-1097 -459 -28 -8 -36 -18 103 133 327 355 649 825 877 1282 l73 145 149 59
|
||||
c388 153 776 382 972 572 67 65 68 66 47 81 -21 14 -25 12 -79 -42 -152 -151
|
||||
-476 -355 -772 -486 -126 -55 -283 -120 -285 -117 -1 2 29 76 67 166 153 365
|
||||
287 815 363 1217 15 77 30 146 34 153 3 7 60 37 126 66 360 159 690 363 889
|
||||
550 68 63 70 66 52 85 -18 19 -19 19 -74 -36 -122 -120 -293 -242 -517 -368
|
||||
-139 -79 -453 -230 -461 -222 -2 2 4 64 15 138 52 359 72 615 80 1037 l6 354
|
||||
95 38 c327 129 687 329 835 464 28 25 53 45 56 46 3 0 11 -57 18 -127z
|
||||
m-11237 -462 c252 -100 617 -212 936 -287 l162 -38 0 -56 c0 -121 21 -556 35
|
||||
-730 20 -240 39 -413 71 -633 14 -98 24 -181 21 -183 -16 -16 -629 162 -886
|
||||
258 -117 43 -360 143 -368 151 -1 2 -13 81 -27 177 -53 377 -76 714 -76 1121
|
||||
0 148 2 269 5 269 2 0 60 -22 127 -49z m10175 -333 c-7 -399 -35 -747 -88
|
||||
-1088 -15 -96 -14 -96 -87 -125 -395 -159 -926 -311 -1462 -419 -124 -25 -236
|
||||
-48 -249 -51 -22 -6 -23 -4 -17 27 55 298 115 886 136 1347 5 118 11 216 13
|
||||
217 2 2 78 17 168 34 570 103 1128 244 1494 378 44 16 84 30 89 31 5 0 6 -146
|
||||
3 -351z m-8877 -33 c463 -93 1076 -177 1606 -221 l82 -6 6 -257 c9 -338 31
|
||||
-775 57 -1095 11 -142 19 -260 16 -262 -9 -9 -539 49 -847 92 -301 42 -914
|
||||
154 -929 170 -6 6 -35 193 -61 394 -38 298 -62 626 -76 1023 -5 154 -4 187 7
|
||||
187 8 0 70 -12 139 -25z m7066 -147 c-3 -46 -8 -144 -11 -218 -15 -342 -56
|
||||
-757 -110 -1118 -14 -89 -25 -166 -25 -171 0 -25 -863 -140 -1350 -181 -69 -6
|
||||
-146 -13 -172 -16 l-48 -6 5 29 c18 102 60 794 76 1248 6 182 13 332 14 333 2
|
||||
2 111 12 242 23 423 33 945 92 1233 138 169 28 153 35 146 -61z m-5061 -103
|
||||
c385 -25 688 -37 1125 -44 l425 -6 3 -809 2 -809 -402 6 c-222 4 -491 11 -598
|
||||
17 -331 16 -725 42 -732 49 -18 16 -71 883 -84 1354 l-6 257 23 0 c13 0 123
|
||||
-7 244 -15z m3385 -57 c0 -206 -33 -862 -60 -1215 -11 -139 -20 -265 -20 -280
|
||||
0 -49 -9 -53 -136 -63 -247 -20 -753 -40 -1151 -47 l-413 -6 0 809 0 809 323
|
||||
3 c487 4 911 19 1435 51 21 1 22 -3 22 -61z m-7707 -207 c15 -20 69 -78 120
|
||||
-130 170 -172 436 -353 738 -502 l86 -42 12 -66 c87 -477 251 -1025 425 -1415
|
||||
14 -33 24 -61 22 -63 -12 -13 -389 175 -538 268 -195 122 -384 282 -480 406
|
||||
-33 44 -43 51 -58 43 -22 -12 -32 12 -109 259 -113 361 -193 718 -241 1081
|
||||
-32 243 -31 238 -17 216 7 -10 25 -35 40 -55z m1161 -766 c275 -112 589 -214
|
||||
925 -299 l174 -44 42 -208 c86 -422 205 -838 339 -1183 20 -52 34 -96 32 -98
|
||||
-7 -7 -97 13 -336 72 -250 62 -493 135 -670 200 -69 26 -138 51 -153 57 -34
|
||||
12 -59 61 -146 276 -147 365 -268 777 -346 1175 -14 77 -18 117 -11 114 6 -3
|
||||
74 -31 150 -62z m9916 57 c0 -24 -63 -316 -99 -458 -84 -333 -179 -618 -313
|
||||
-932 -71 -167 -44 -147 -298 -230 -416 -136 -828 -236 -1340 -326 -74 -13
|
||||
-136 -22 -138 -21 -2 2 28 97 67 212 120 357 214 713 285 1082 20 102 37 186
|
||||
39 187 1 1 117 25 257 54 523 105 1085 264 1450 409 83 33 90 35 90 23z
|
||||
m-8520 -461 c411 -83 881 -150 1415 -201 66 -7 121 -13 122 -14 1 -1 9 -65 18
|
||||
-142 38 -343 115 -832 179 -1139 19 -88 33 -161 32 -162 -3 -4 -420 35 -571
|
||||
53 -307 36 -619 83 -901 135 l-110 21 -56 146 c-108 283 -195 565 -268 866
|
||||
-37 150 -100 454 -100 478 0 6 9 8 23 4 12 -3 110 -24 217 -45z m6662 -58
|
||||
c-70 -405 -206 -928 -339 -1303 l-55 -157 -112 -17 c-187 -28 -480 -64 -701
|
||||
-86 -198 -19 -548 -49 -552 -46 -1 1 14 87 33 191 62 336 115 712 153 1073 11
|
||||
95 21 175 24 178 2 3 101 13 218 24 257 22 460 44 669 71 200 25 624 89 629
|
||||
95 2 2 12 4 21 4 13 0 16 -6 12 -27z m-4862 -173 c262 -21 730 -40 1118 -47
|
||||
l402 -6 0 -591 c0 -325 3 -648 7 -718 l6 -127 -274 5 c-458 8 -1112 35 -1206
|
||||
50 -31 5 -32 6 -52 97 -69 303 -158 851 -191 1172 -6 55 -13 117 -16 138 l-6
|
||||
37 44 0 c23 0 99 -5 168 -10z m3253 -37 c-38 -400 -131 -1047 -189 -1324 l-16
|
||||
-77 -77 -6 c-240 -20 -1378 -53 -1391 -40 -3 3 -7 326 -8 718 l-4 713 418 7
|
||||
c443 7 998 31 1255 55 14 1 16 -7 12 -46z m-7127 -284 c191 -184 557 -408 880
|
||||
-539 l81 -33 72 -146 c235 -472 550 -926 907 -1309 58 -61 104 -112 101 -112
|
||||
-2 0 -69 22 -148 49 -525 177 -955 423 -1160 662 -30 35 -68 77 -85 94 -93 91
|
||||
-362 531 -527 862 -112 222 -277 602 -277 636 0 5 17 -13 39 -40 21 -26 74
|
||||
-82 117 -124z m10033 -700 c-235 -470 -542 -910 -923 -1321 -100 -109 -134
|
||||
-139 -164 -147 -313 -85 -778 -176 -1142 -226 -63 -8 -130 -18 -147 -21 -18
|
||||
-3 -33 -2 -33 1 0 3 35 56 78 118 225 323 415 669 585 1067 41 96 77 184 81
|
||||
196 6 18 21 24 114 38 174 28 589 112 768 156 213 51 544 147 704 202 69 24
|
||||
126 43 128 42 2 -1 -20 -48 -49 -105z m-8764 14 c260 -87 659 -196 896 -243
|
||||
l56 -11 54 -122 c189 -434 505 -957 757 -1256 l46 -54 -54 7 c-99 12 -502 96
|
||||
-685 142 l-180 46 -63 61 c-269 262 -583 666 -807 1037 -79 130 -255 457 -255
|
||||
473 0 3 17 -1 38 -10 20 -9 109 -40 197 -70z m1615 -367 c257 -37 498 -65 790
|
||||
-91 96 -9 178 -19 182 -21 4 -3 8 -13 8 -22 0 -34 120 -470 180 -656 64 -197
|
||||
153 -434 214 -573 20 -45 36 -84 36 -87 0 -6 -22 -4 -360 25 -245 21 -386 36
|
||||
-630 69 l-145 20 -39 42 c-118 130 -364 484 -506 728 -100 172 -330 635 -330
|
||||
664 0 1 80 -13 178 -31 97 -17 287 -48 422 -67z m5430 24 c0 -22 -154 -368
|
||||
-239 -539 -141 -281 -345 -618 -488 -803 -49 -64 -28 -58 -273 -83 -328 -33
|
||||
-730 -62 -730 -51 0 3 17 52 39 108 117 312 226 702 336 1205 6 26 12 27 225
|
||||
43 310 23 784 75 1030 114 47 8 88 14 93 15 4 0 7 -4 7 -9z m-4075 -155 c160
|
||||
-8 486 -20 724 -25 239 -6 436 -12 437 -13 0 -1 7 -294 13 -652 7 -357 15
|
||||
-653 17 -657 10 -17 -847 -1 -1024 18 l-52 5 -31 67 c-127 279 -274 717 -374
|
||||
1112 -40 158 -42 170 -17 164 9 -2 148 -11 307 -19z m2654 -72 c-73 -358 -221
|
||||
-876 -330 -1159 l-39 -101 -138 -6 c-75 -4 -311 -10 -523 -14 l-386 -6 -6 294
|
||||
c-4 162 -10 459 -14 660 l-6 367 249 6 c390 9 929 28 1044 36 58 4 119 8 136
|
||||
8 l31 2 -18 -87z m3490 -360 c-244 -315 -889 -947 -967 -948 -11 0 -36 -20
|
||||
-57 -45 -46 -55 -168 -147 -390 -295 -228 -151 -306 -195 -465 -260 -279 -116
|
||||
-630 -219 -980 -289 -169 -34 -489 -86 -527 -86 -10 0 38 25 106 55 180 79
|
||||
455 219 621 315 441 255 797 516 1155 846 l130 120 100 28 c148 42 422 136
|
||||
570 196 195 78 476 221 600 304 61 41 112 75 114 75 2 1 -3 -7 -10 -16z
|
||||
m-9446 -61 c228 -173 604 -353 1016 -486 l173 -56 102 -96 c488 -462 1128
|
||||
-881 1808 -1184 43 -19 74 -36 69 -38 -28 -9 -509 82 -736 140 -189 48 -491
|
||||
146 -591 192 -157 73 -483 274 -718 444 -113 82 -184 153 -235 235 -12 20 -26
|
||||
37 -29 37 -19 -1 -34 -20 -28 -35 16 -43 -300 241 -524 471 -155 159 -390 424
|
||||
-376 424 3 0 34 -22 69 -48z m7893 -622 c-339 -317 -777 -632 -1221 -877 -239
|
||||
-132 -679 -338 -815 -382 -35 -11 -329 -41 -403 -41 -39 0 -38 1 69 71 127 84
|
||||
273 193 399 298 141 117 479 462 594 606 57 72 110 135 118 141 7 6 43 14 81
|
||||
18 228 23 861 136 1112 200 137 35 139 34 66 -34z m-6416 6 c169 -41 449 -97
|
||||
602 -122 l108 -17 62 -71 c360 -409 845 -802 1293 -1047 l70 -39 -65 6 c-182
|
||||
16 -303 62 -710 265 -438 219 -812 456 -1161 735 -110 88 -306 258 -359 311
|
||||
-22 22 -23 24 -5 19 11 -3 85 -21 165 -40z m1043 -185 c231 -30 441 -50 717
|
||||
-71 80 -6 145 -12 146 -13 0 -1 39 -76 86 -167 175 -338 324 -559 547 -807 85
|
||||
-96 100 -88 -131 -72 l-153 10 -142 79 c-431 239 -831 548 -1173 908 -126 132
|
||||
-151 162 -136 162 4 0 111 -13 239 -29z m4019 -38 c-105 -146 -451 -507 -637
|
||||
-665 -132 -112 -327 -256 -471 -348 -130 -82 -148 -88 -322 -89 l-93 -1 41 48
|
||||
c159 184 365 539 509 874 l57 133 120 7 c143 9 583 47 674 57 36 5 82 9 103
|
||||
10 l38 1 -19 -27z m-2707 -63 c187 -6 412 -12 500 -13 l160 -2 2 -80 c6 -171
|
||||
34 -794 40 -874 l6 -84 -189 5 -189 6 -83 88 c-148 159 -317 387 -439 595 -65
|
||||
111 -179 327 -188 358 -6 21 -5 23 16 18 13 -3 177 -11 364 -17z m1702 -67
|
||||
c-54 -133 -233 -483 -304 -596 -83 -131 -189 -277 -246 -340 l-44 -47 -175 0
|
||||
-175 0 -7 93 c-11 154 -36 735 -36 845 l0 102 248 1 c136 1 328 5 427 8 99 4
|
||||
217 8 262 9 l82 2 -32 -77z m1748 -682 c-28 -27 -452 -199 -675 -274 -488
|
||||
-165 -1033 -272 -1525 -302 -55 -3 -120 -8 -145 -11 -72 -9 -41 5 71 32 220
|
||||
53 560 158 755 234 59 23 118 36 239 51 433 54 895 149 1175 242 124 41 116
|
||||
39 105 28z m-4912 -105 c225 -61 526 -119 834 -161 152 -21 188 -29 320 -78
|
||||
171 -63 413 -141 593 -191 140 -39 127 -43 -70 -21 -565 62 -1052 182 -1587
|
||||
391 -138 54 -258 107 -200 90 9 -3 59 -17 110 -30z m1425 -250 c37 -18 93 -43
|
||||
124 -56 112 -46 46 -31 -139 30 -103 34 -190 65 -193 68 -3 2 28 2 68 -2 53
|
||||
-4 91 -15 140 -40z m1686 -11 c-153 -51 -481 -145 -504 -145 -7 0 69 40 167
|
||||
89 l178 90 110 9 c226 19 229 16 49 -43z m-1318 7 c12 -10 55 -44 96 -77 40
|
||||
-33 85 -68 98 -78 l25 -18 -25 7 c-57 15 -280 99 -384 145 l-111 49 140 -6
|
||||
c109 -4 145 -9 161 -22z m238 8 l143 0 7 -106 c4 -59 5 -109 2 -111 -8 -8
|
||||
-155 85 -243 154 -81 63 -99 81 -67 69 9 -3 80 -6 158 -6z m701 -37 c-49 -25
|
||||
-119 -58 -155 -74 -79 -33 -177 -72 -170 -67 3 2 48 45 102 96 l96 92 109 -1
|
||||
108 0 -90 -46z m-279 -31 c-68 -63 -188 -152 -206 -152 -7 0 -20 120 -20 187
|
||||
l0 33 150 0 150 0 -74 -68z"/>
|
||||
</g>
|
||||
</svg>
|
After Width: | Height: | Size: 17 KiB |
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 53 63.18">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
fill: #231f20;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
stroke: #fff;
|
||||
stroke-miterlimit: 10;
|
||||
stroke-width: 3px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: none;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<path class="cls-1" d="m37.29,61.5l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
<ellipse class="cls-2" cx="23.08" cy="13.24" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-2" d="m1.5,49.92c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
</svg>
|
After Width: | Height: | Size: 762 B |
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 52 62.12">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
fill: none;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
stroke: #fff;
|
||||
stroke-miterlimit: 10;
|
||||
stroke-width: 2px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: #ffc60b;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<path class="cls-2" d="m36.79,61l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
<ellipse class="cls-1" cx="22.58" cy="12.74" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-1" d="m1,49.42c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
</svg>
|
After Width: | Height: | Size: 758 B |
@ -0,0 +1,24 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 52 62.12">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
fill: none;
|
||||
stroke: #fff;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
stroke-miterlimit: 10;
|
||||
stroke-width: 2px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: #ffc60b;
|
||||
stroke: #ffc60b;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<ellipse class="cls-1" cx="22.58" cy="12.74" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-1" d="m1,49.42c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
<path class="cls-2" d="m36.79,61l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
</svg>
|
After Width: | Height: | Size: 783 B |
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 52 62.12">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
stroke: #fff;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
fill: none;
|
||||
stroke-miterlimit: 10;
|
||||
stroke-width: 2px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
stroke: #ffc60b;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<ellipse class="cls-1" cx="22.58" cy="12.74" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-1" d="m1,49.42c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
<path class="cls-2" d="m36.79,61l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
</svg>
|
After Width: | Height: | Size: 760 B |
@ -0,0 +1,24 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 52.5 62.68">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
stroke: #fff;
|
||||
stroke-width: 2px;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
fill: none;
|
||||
stroke-miterlimit: 10;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
stroke: #ffc60b;
|
||||
stroke-width: 3px;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<ellipse class="cls-1" cx="22.58" cy="12.74" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-1" d="m1,49.42c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
<path class="cls-2" d="m36.79,61l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
</svg>
|
After Width: | Height: | Size: 789 B |
@ -0,0 +1,21 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 60">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
fill: #ffc60b;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
stroke-width: 0px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: #fff;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<ellipse class="cls-2" cx="21.58" cy="11.74" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-2" d="m34.36,28.81c-2.81-2.33-6.14-3.91-9.76-4.48-.99-.16-1.99-.24-3.01-.24C9.66,24.09,0,34.98,0,48.42h35.79l.64-17.59-2.07-2.02Z"/>
|
||||
<path class="cls-1" d="m35.79,60l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
</svg>
|
After Width: | Height: | Size: 735 B |
@ -0,0 +1,62 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
||||
<svg
|
||||
id="Layer_1"
|
||||
data-name="Layer 1"
|
||||
viewBox="0 0 50.5 60.56"
|
||||
version="1.1"
|
||||
sodipodi:docname="lil-guy+shield_emptystroke.svg"
|
||||
inkscape:version="1.3.2 (091e20ef0f, 2023-11-25)"
|
||||
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
|
||||
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
|
||||
xmlns="http://www.w3.org/2000/svg"
|
||||
xmlns:svg="http://www.w3.org/2000/svg">
|
||||
<sodipodi:namedview
|
||||
id="namedview2"
|
||||
pagecolor="#000000"
|
||||
bordercolor="#000000"
|
||||
borderopacity="0.25"
|
||||
inkscape:showpageshadow="2"
|
||||
inkscape:pageopacity="0.0"
|
||||
inkscape:pagecheckerboard="0"
|
||||
inkscape:deskcolor="#d1d1d1"
|
||||
inkscape:zoom="20.260898"
|
||||
inkscape:cx="25.245673"
|
||||
inkscape:cy="30.304679"
|
||||
inkscape:window-width="2539"
|
||||
inkscape:window-height="1370"
|
||||
inkscape:window-x="0"
|
||||
inkscape:window-y="0"
|
||||
inkscape:window-maximized="1"
|
||||
inkscape:current-layer="Layer_1" />
|
||||
<defs
|
||||
id="defs1">
|
||||
<style
|
||||
id="style1">
|
||||
.cls-1 {
|
||||
fill: #fff;
|
||||
stroke-width: 0px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: #ffc60b;
|
||||
stroke: red;
|
||||
stroke-miterlimit: 10;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<ellipse
|
||||
class="cls-1"
|
||||
cx="21.58"
|
||||
cy="11.74"
|
||||
rx="12.44"
|
||||
ry="11.74"
|
||||
id="ellipse1" />
|
||||
<path
|
||||
id="path1"
|
||||
class="cls-1"
|
||||
d="M 21.589844 24.089844 C 9.6598557 24.089844 0 34.979935 0 48.419922 L 18.580078 48.419922 L 18.580078 31.369141 L 23.886719 28.642578 C 26.01841 27.544237 28.274997 26.773166 30.582031 26.304688 C 28.716294 25.339295 26.707383 24.661965 24.599609 24.330078 C 23.60961 24.170078 22.609843 24.089844 21.589844 24.089844 z M 35.791016 31.779297 C 32.634343 31.779297 29.476685 32.512281 26.634766 33.976562 L 26.632812 33.978516 L 24.580078 35.03125 L 24.580078 48.419922 L 35.789062 48.419922 L 36.394531 31.796875 C 36.193086 31.790907 35.992543 31.779297 35.791016 31.779297 z " />
|
||||
<path
|
||||
style="color:#000000;display:inline;fill:#ffc60b;stroke:none;stroke-miterlimit:10;-inkscape-stroke:none;paint-order:stroke fill markers;fill-opacity:1"
|
||||
d="M 35.79,60 46.01,54.9 C 48.46,53.68 50,51.27 50,48.66 V 33.2 l -3.68,-1.89 c -6.56,-3.38 -14.5,-3.38 -21.06,0 l -3.68,1.89 v 15.46 c 0,2.62 1.53,5.02 3.99,6.24 z"
|
||||
id="path6" />
|
||||
</svg>
|
After Width: | Height: | Size: 2.3 KiB |
@ -0,0 +1,23 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 53 63.18">
|
||||
<defs>
|
||||
<style>
|
||||
.cls-1 {
|
||||
fill: #fff;
|
||||
}
|
||||
|
||||
.cls-1, .cls-2 {
|
||||
stroke: #FF0000;
|
||||
stroke-miterlimit: 10;
|
||||
stroke-width: 3px;
|
||||
}
|
||||
|
||||
.cls-2 {
|
||||
fill: none;
|
||||
}
|
||||
</style>
|
||||
</defs>
|
||||
<path class="cls-2" d="m37.29,61.5l10.22-5.1c2.45-1.22,3.99-3.63,3.99-6.24v-15.46l-3.68-1.89c-6.56-3.38-14.5-3.38-21.06,0l-3.68,1.89v15.46c0,2.62,1.53,5.02,3.99,6.24l10.22,5.1Z"/>
|
||||
<ellipse class="cls-1" cx="23.08" cy="13.24" rx="12.44" ry="11.74"/>
|
||||
<path class="cls-2" d="m1.5,49.92c0-13.44,9.66-24.33,21.58-24.33,1.02,0,2.03.08,3.01.24,3.62.57,6.95,2.15,9.76,4.48"/>
|
||||
</svg>
|
After Width: | Height: | Size: 763 B |