CASE STUDY:

Security and Resilience at the Chicago Architecture Center

Part 1: “The Problem” (CAC’s Cybersecurity Challenges)

 

Circumstances of Engagement

Facing a rapid increase in cyber threats, the CAC Board directed executive leadership to seek a trusted partner capable of safeguarding the organization’s digital assets and protecting its reputation. The organization engaged NTG in early 2024 to address critical cybersecurity issues. Simone Edwards, the CFO, took the lead on the project after the IT department was placed under her oversight.

 

Pain Points

The primary challenge was a pervasive lack of proper IT infrastructure and cybersecurity awareness, which made the organization highly vulnerable to attack.

• Frequent Email Compromises: CAC leadership’s business emails were vulnerable to compromise due to a lack of training and awareness of common phishing schemes. One member of the CAC C-suite had their email compromised six times in the space of only a couple of years. This vulnerability was compounded by a dual-factor authentication system that was in place but was not fully implemented.
• Lack of Staff Cyber Awareness: The primary cause of CAC’s cybersecurity vulnerabilities stemmed from a lack of informed phishing and spoof-email identification skills among staff.
• Inadequate IT Infrastructure/Support: While CAC had been working with an external managed service provider, the services being offered were not comprehensive or specific to the organization’s needs, and the provider didn’t offer full support or training for internal IT staff.
• Lack of Monitoring and Reporting: There was no comprehensive cybersecurity monitoring or reporting system in place at CAC. As a result, the board and leadership were unable to get a detailed appraisal of the organization’s cybersecurity posture or anticipate any potential threats.

Part 2: “The Solution” (NTG’s Tailored Approach)

 

Initial Goals

NTG’s engagement was designed to move CAC from a state of vulnerability to one of comprehensive protection and awareness.

• Assessment: Perform a Cybersecurity Risk Assessment.
• Understanding: Understand the organization’s structure, mission, pain points, and goals.
• Protection: Provide comprehensive Cybersecurity services to prevent, detect, and respond to emerging threats.

 

Strategy and Methodology

NTG’s approach is highly customized, contrary to the broad “one-size-fits-all” service packages offered by other MSPs. Instead, we spent one to two months auditing CAC’s specific needs, size, operations, and growth potential. This level of initial focus was a key differentiator in NTG’s strategy and impact.

“They listened. So they learned the organization and they tailored what we would need…Bashir, Brian, and Tavarian really wanted to know about the organization and they put together a package that fits our organization and the tools that we need.” — Simone Edwards, CFO, Chicago Architecture Center

We implemented scalable tools and solutions, establishing a proactive security posture through diligent monitoring and quick response capabilities. NTG’s role also expanded to become a trusted advisor, providing ancillary Tier 3 systems support for complex issues that exceeded the capabilities of the internal team.

 

Specific Services Performed

NTG’s solution was multi-faceted, addressing security, infrastructure, and support.

• Cybersecurity & Infrastructure:
• Completed a Cybersecurity Risk Assessment and implemented a Cybersecurity tool stack.
• Provisioned Cyber Threat protection to combat and defend against attacks.
• Successfully implemented dual-factor authentication.
• Data Migration & Consolidation:
• Consolidated cloud services onto the Microsoft Azure platform for better data sharing and communication.
• Executed a cloud data migration from Box to SharePoint.
• Set up cloud backup domain controllers and a data backup solution.
• IT Support:
• Provided Tier 3 network and application support and escalation for the internal IT staff.

 

Comprehensive Training and Monitoring

A key differentiator was NTG’s focus on reducing “human risk” through specialized training and ongoing monitoring.

• Engaging Training: We introduced engaging, gamified cybersecurity training with leaderboards, making it attainable and even fun for all staff.
• Targeted Training: We implemented ongoing monitoring to identify users who consistently clicked on false emails, allowing us to provide specific, tailored training based on individual performance.
• Detailed Reporting: NTG set up ongoing real-time monitoring and provided detailed reports on attacks, quarantined threats, and the organization’s security score, which was critical for providing board-level assurance.

 

Part 3: “The Impact” (Results and Value)

NTG’s work transformed CAC’s security posture, giving the organization a more secure, efficient, and confident foundation for growth.

Overall Impact

• Strengthened Security Posture: The organization’s enhanced ability to identify and respond to phishing and spoofing attempts.
• Reduced Human Risk: Increased overall cybersecurity awareness among staff and built a “culture of security and stability” by making security everyone’s responsibility.
• Operational Agility and Resilience: Cloud migrations created a more agile and resilient IT environment, improving continuity of operations.
• Enhanced IT Support: The IT team gained support to quickly resolve complex issues, and technology became reliably managed, shifting IT from a point of concern to a trusted foundation.

Metrics and Data Illustrating Impact

• Zero Cybersecurity Breaches or Hacks: There have been no cybersecurity breaches or hacks since the engagement.
• Ongoing Defense: Several attempted attacks have been defended or thwarted by NTG’s Cyber Threat Protection.
• Increased Efficiency: The amount of system-related support tickets has reduced.
• Board-Level Assurance: Detailed reporting provided the board with comfort and assurance that cybersecurity is being taken seriously.

 

Value of Cybersecurity Investment

CAC views its partnership with NTG as an essential investment in the security and growth of the organization:

 Essential Protection: Cybersecurity is like insurance—a necessary layer of protection against potentially business-ending threats.

 Cost-Effective and High-Quality: NTG offers high-quality tools and high-level expertise at a reasonable cost. CAC is now in a position to scale with confidence thanks to NTG, benefiting from more protection, lower cost, and higher-level expertise.

Testimonial Quotes from Simone Edwards – CFO

“The difference that I personally felt is that Bashir, Brian, and Tavarian really wanted to know about the organization…They sat with me for a month or two to understand the organization and how we work, and they put together a package that really fits our scale, our goals, and the tools that we need.”

“I look at cybersecurity as a critical form of insurance: you have to get it, you need it, and you don’t want to use it, but you want it to be there just in case something happens…For small to mid-sized organizations like us, if they get hit with a cyber attack, it can put them out of business.”