Cybersecurity

It has been a few years, but I was once asked to implement 800-171. The document was aggressively vague and really the sort of thing that requires hiring a consultant to setup and probably at least one FTE to maintain. Thankfully our project was abandoned before I had to start looking for other employment just get away from the damn thing.

So I emphasize with Georgia Tech for not perfectly implementing the rules to the governments confusing standards.

However, the researchers refusal to run anti-virus even when required by the contract was just stupid. "Academic freedom" doesn't mean anything when your grants are revoked or you get sued for millions over a breach. That said, they should have been able to work out some sort of "compensating control" to use instead of anti-virus and get that approved by the government.

I think the security researcher has a valid point.

In a secure environment you don't want random things running in memory, sending samples to third parties.

Would a static virus scanner run periodically on the volume itself been sufficient? If yes, then the researcher was being unreasonable.

But this "overall" plan was basically fictional—it was a model, and apparently not an accurate one. Georgia Tech doesn't have a unified IT setup; it has hundreds of different IT setups, including a different one at most research labs.

Yes... this is actually common. Your typical state school is actually made up of many different colleges working in tandem with each other. The nursing "school" is different than the law "school" at your university. Often even holding completely different names internally.

The imperial economy is approximately 95% people grifting off the fundamentally corrupt military state. It will never be fixed because it's a major point of its existence. These GT people are just dust in the wind relatively.