Presentation at the 13th FIM4R Workshop: Federated Identity Management for Research Collaborations.Ope

Basney, Jim

IDEALS @ Illinois

Trusted CI's Approach to Security for Open Science Projects

Illinois Digital Environment for Access to Learning and Scholarship Repository

Trusted CI's approach to security for open science projectsJim Basneyjbasney@ncsa.illinois.edu13th FIM4R Workshop: Federated Identity Management for Research CollaborationsFebruary 11, 2019Trusted CI:The NSF Cybersecurity Center of ExcellenceOur mission: to provide the NSF community a coherent understanding of cybersecurity’s role in producing trustworthy science and the information and know-how required to achieve and maintain effective cybersecurity programs.https://trustedci.org/Trusted CI: ImpactsTrusted CI has impacted over 190 NSF projects since inception in 2012.More than 150 members of NSF projects attended our NSF Cybersecurity Summit. Seventy NSF projects attended our monthly webinars.We have provided more than 250 hours of training to the community.Thirty-five engagements, including nine NSF Large Facilities.https://hdl.handle.net/2022/22148Community-driven GuidanceSecurity Best Practices for Academic Cloud Service Providershttps://trustedci.org/cloud-service-provider-security-best-practices/Operational Securityhttps://trustedci.org/guideIdentity Management Best Practiceshttps://trustedci.org/iamOpen Science Cyber Risk Profilehttps://trustedci.org/oscrp/Annual NSF Cybersecurity SummitOne day of training and workshops.Agenda driven by call for participation.Lessons learned and success from community.Will be in San Diego in 2019.https://trustedci.org/summit/Trusted CI 5-year Vision and Strategic Plan“A NSF cybersecurity ecosystem, formed of people, practical knowledge, processes, and cyberinfrastructure, that enables the NSF community to both manage cybersecurity risks and produce trustworthy science in support of NSF’s vision of a nation that is the global leader in research and innovation.”https://hdl.handle.net/2022/22178Some select results:• Respondents’ cybersecurity budgets vary widely.• Respondents inconsistently establish cybersecurity officers.• Residual risk acceptance is inconsistently practiced.https://hdl.handle.net/2022/22171Community BenchmarkingA Network of Cybersecurity FellowsFellows are liaisons between Trusted CI and communities.Fellows receive training, travel support, and prioritized support.Building on models from UK Software Sustainability Institute, ACI-REFs, Campus Champions.Cybersecurity Transition to Practice (TTP)Migrating cybersecurity research into practice is itself a research challenge with technical, human factor, and economic aspects.contact: TTP@trustedci.orgThe Trusted CI FrameworkFramework Core:  • Concise, clear minimum requirements for cybersecurity programs organized under the 4 Pillars:  Mission Alignment, Governance, Resources, and Controls• Based in general cybersecurity best practice and evidence of what works.• Infrequent updates.Framework Implementation Guide: • Guidance vetted by and tailored to the open science community.• Curated pointers to the very best resources and tools.• Frequent (at least yearly) updates.Coming soon!Framework PillarsMission Alignment• Information classification, asset inventory, external requirementsGovernance• Roles and responsibilities, policies, risk acceptance, program evaluationResources• People, budgets, services and toolsControls• Procedural, technical, administrative safeguards and countermeasuresHarmonizing with SCITrusted CI PillarsMission AlignmentGovernanceResourcesControlsSCI AreasParticipant ResponsibilitiesData ProtectionOperational SecurityIncident ResponseTraceabilityhttps://wise-community.org/sci/Open Science Cyber Risk Profile (OSCRP)OSCRP helps leads of science projects understand cybersecurity risks to their science and prepare for discussing those risks with their campus security office.OSCRP was created by a team of computer security experts and scientists working together through a series of example use cases, which were then generalized to form the basis of the document.OSCRP provides a mechanism for applying controls to mission-specific assets.https://trustedci.org/oscrp/OSCRP 2019 Planned Extensions1. Data integrity issues in scientific computing, e.g., due to bit flips, are planned to be addressed.2. Data privacy and confidentiality (e.g., PII, proprietary technologies) are planned to be explicitly addressed, including technical risk assessments.  3. Network-connected sensors and actuators (“cyber-physical systems”) are planned to be examined in more depth.4. Mitigations are planned to be included.5. Cross references with the Trusted CI Framework will be added.Other Trusted CI ServicesLarge Facilities Security TeamWorking group of security representatives  from NSF Large Facilities.https://trustedci.org/lfst/Ask Us AnythingNo question too big or too small.info@trustedci.orgFollow Ushttps://trustedci.orghttps://blog.trustedci.org@TrustedCICyberinfrastructure VulnerabilitiesLatest news on security vulnerabilities tailored for cyberinfrastructure community.https://trustedci.org/vulnerabilities/Specialized Information for Identity and Access Management, Science Gateways, Software Developmenthttps://trustedci.org/iam/https://trustedci.org/science-gateway-community-institute/https://trustedci.org/software-assurance/AcknowledgmentsTrusted CI is supported by the National Science Foundation under Grant ACI-1547272.The views expressed do not necessarily reflect the views of the National Science Foundation or any other organization.Trusted CI activities are made possible thanks to the contributions of a multi-institutional team:https://trustedci.org/who-we-are/

https://www.ideals.illinois.edu/bitstream/handle/2142/102973/20190211-trustedci-fim4r.pdf?sequence=2&isAllowed=y

Trusted CI's Approach to Security for Open Science Projects

Abstract

Similar works

Full text

Available Versions

IDEALS @ Illinois

Illinois Digital Environment for Access to Learning and Scholarship Repository