Large Synoptic Survey Telescope (LSST) Realigns Cybersecurity Plan to CTSC’s Guide

At the 2014 Cybersecurity Summit, Don Petravick approached CTSC to assist with developing a new LSST security plan based on CTSC’s “Guide to Developing Cybersecurity Programs for NSF Science and Engineering Projects.”  With a January 2015 deadline to provide a progress report to the NSF, CTSC committed to meet with LSST on a weekly basis through the end of 2014 to help rework their security plan. The effort was extended through the end of January 2015. The LSST team carried out the planning effort, with CTSC acting in an advisory role to align the new LSST plan with the CTSC cybersecurity framework.  LSST’s provided CTSC with a first hand view of the Guide in action,and constructive feedback for future versions. At the completion of the five month engagement, LSST had a revised cybersecurity plan that included a Master Information Security Policy, Acceptable Use Policy, Incident Response Policy and a risk assessment based on the current and planned project environment.

“The project was under pressure to deliver an updated Cybersecurrity program. CTSC understood our situation and provided a contemporary framework that was straightforward and practical to apply to our environment. With their support we were able to meet the deadline with a revised modern Cybersecurity plan.” - Don Petravick, PI Dark Energy Survey Data Management, and Consultant To ISLE Project

AARC and CTSC Collaborate on Interfederation

CTSC is starting a collaboration with the European Authentication and Authorisation for Research and Collaboration (AARC) project on use of federated identities for international science. AARC is a two year project that started May 2015. Jim Basney from CTSC joined the June 3-4 AARC kick-off meeting to begin the collaboration.

As the infrastructures for international scientific collaborations migrate from X.509 to SAML for identity management, there is a strong need for interoperability across national SAML federation boundaries. In 2014, the US InCommon federation joined eduGAIN, which connects SAML federations around the world, and now InCommon is engaging with science projects on international interfederation pilots. At the same time, the AARC project in Europe is addressing international adoption of SAML federations by research projects. This represents an opportunity to achieve critical mass around EU-US interfederation activities for science, with CTSC providing needed coordination on the US side.

Specific goals for the CTSC-AARC collaboration include:

1. Training: Develop and disseminate training materials to enable science projects to implement federated access.
2. Pilots: Facilitate US participation in interfederation pilot projects.
3. Incident Response: Establish an operational framework for security and incident response in R&E federations via the SIRTFI working group.
4. Levels of Assurance: Map requirements of cyberinfrastructure providers to an assurance framework that can be implemented in a cost-effective manner by identity federations. 

CTSC will gather input from US cyberinfrastructure (CI) projects for AARC activities, disseminate training and other AARC project outputs to US CI projects, and facilitate EU-US pilot projects.

To participate in the discussion, please join the CTSC Federated Identity Discussion List.