Thursday, September 27, 2018

Student Program at the 2018 NSF Cybersecurity Summit

In August we hosted our annual NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure in Alexandria, VA. The Summit included training workshops, plenary talks, and networking opportunities for members of NSF Large Facilities and the CI community.

As Summit attendance and funding grows so has our ability to provide learning opportunities for new members to the community. Last year we launched a student scholarship program to follow through on our goals of outreach and broadening impact. Students apply to the program by sharing their resumes and a brief essay sharing their security interests and what they hope to gain from attending the Summit.

This year we were able to fund the attendance of six students to the Summit. Their names and schools they attend are listed below (see: photo, left to right):
  • Emily Dillon; Master of Science student at Capella University
  • Sanchari Das; PhD student at Indiana University
  • Grant Allard; PhD student at Clemson University
  • Preston Ruff; Bachelor of Science student at New Mexico Institute of Mining and Technology
  • Maggie Ahern; Bachelor of Science student at Lehigh University
  • Leah Dorman; Bachelor of Science student at University of Maine Augusta
We also paired the students with volunteer mentors. We thank them for helping make the students feel welcome at the Summit. Their names and organizations are listed below:
  • Florence Hudson; Trusted CI and Northeast Big Data Innovation Hub
  • Mark Krenz; Trusted CI and Indiana University's CACR
  • Steve Barnet; Wisconsin IceCube Particle Astrophysics Center
  • Susan Sons; Trusted CI and Indiana University's CACR
  • Susan Ramsey; National Center for Atmospheric Research
  • Elisa Heymann; Trusted CI and University of Wisconsin
We asked the students to share some insights into their Summit experience. Their comments are quoted below.

Sanchari Das:

My name is Sanchari and I am a doctoral student in the School of Informatics, Computing, and Engineering at Indiana University Bloomington, specializing in Usable Privacy and Security. I think this summit was a great opportunity to meet researchers and practitioners from other organizations. I thoroughly enjoyed their perspective, and insights in the discipline of cybersecurity and gathered knowledge to pave my future research directions. Given the diverse research areas which was covered, this truly was a golden opportunity to broaden a graduate student's vision, such as myself, understanding more about usable privacy and security.

The NSF cybersecurity summit provided the perfect blend of academicians and those working in industry, who do and preach cybersecurity practices and direct their research accordingly. Given the workshops and talks that was conducted in the summit, it was not limited to discuss cybersecurity infrastructure, but also discussed about the users who are a major part, are affected, and contribute to follow cybersecurity practices. It was one of the gathering where practitioners from the industry likewise joined to discuss around the applications of such research.

As a student I learned about the current challenges in the field of cybersecurity, how usable security and privacy is slowly but surely making its marking where we all aim in not keeping the humans out of the loop but making them aware through simple but informative tools. I also learned how people from different field such as, law (policy makers), software developers, security engineers, academicians can all work together to help build a secure environment to protect data of an organization or individual.

Apart from interesting ideas, I would particularly like to thank my mentor Mark Krenz and Jeannette Dopheide, who made the process smooth and helped me throughout my stay and helped me interact with eminent researchers and practitioners in my field. I enjoyed the workshops I was involved in as well, Susan Son’s insights on the different version controls and monitoring old patches to find loopholes which can be played further was interesting.

I would also like to thank Von Welch, the director of Indiana University’s Center for Applied Cybersecurity Research who is extremely approachable and helps every student to achieve their best in this field through such initiatives.

Grant Allard:

The Trusted CI/NSF 2018 Cybersecurity Summit provides an outstanding opportunity to professionally and scholastically improve my understanding of the key issues in scientific cyberinfrastructure. The Trusted CI leadership team makes you, as a student, feel welcome and helps you to explore the pressing challenges facing the scientific cyberinfrastructure community today. The mentoring initiative associated with the student program is a superb educational tool that helped me put my experience in context and learn from one of the leaders of this field. One of my big takeaways from the week together is the importance that we as students will play to the scientific cyberinfrastructure community as we enter the scientific workforce: cybersecurity is not only a concern for CISOs but for the entire scientific community. The academic community owes a huge debt of gratitude to our CISOs for helping us keep our data secure, accessible, and integral.

I am taking what I learned from this conference and using it to develop a white paper and I identify how I, as an aspiring scholar of public policy, can contribute to the community. This conference also has given me multiple opportunities at my university to meet new people and contribute to new efforts. This experience was exactly how a student program should be--in my opinion--and I highly recommend it to students of all levels or to advisors who are looking to promote their students' growth." 

Preston Ruff:

I enjoyed the close-knit, friendly, and informative experience of the NSF summit. There I was able to test my text parsing skills in a log analysis workshop and I was exposed to the mystery of industrial control systems. Thank you to everyone at Trusted CI for hosting the event. I'm grateful to have met such brilliant people who work to create the cybersecurity systems and policy of tomorrow.

Maggie Ahern:

Attending the NSF 2018 Cybersecurity Summit was a fantastic learning experience. I have always been interested in cybersecurity, but this summit gave insight into the field that I had never been exposed to before. Some of the highlights include Software Engineering Best Practices and Legal Policy on Cybersecurity. I also particularly enjoyed the breakout session we had during lunch where we could discuss different topics of interest. I sat at a table that discussed books with the theme of cybersecurity and I went home with a few recommendations. The Student Program also connected us with a mentor for the duration of the conference. My mentor was incredibly understanding, knowledgeable, and inspiring. She is someone that I really admire and strive to live up to one day. Without this opportunity I probably would not have gotten to meet her, or all the other amazing individuals that I was able to interact with during the summit. All in all, I am incredibly grateful that I was given this opportunity to learn more about this subject and meet new individuals passionate about cybersecurity.

Leah Dorman:

At the NSF Cybersecurity conference, I immediately noticed a coherent understanding of cybersecurity's crucial role in science as well as a collaborative effort to produce trustworthy technology.  The Trusted CI program committee did an excellent job putting on this event and as a student I felt very welcomed and was provided with the information and resources needed to enhance my cybersecurity knowledge and research skills.  The first day was a training day.  I attended Automated Assessment Tools – Theory & Practice which was about injection attacks (one of the most common vulnerabilities) and had hands-on training using source code analysis tools to find code errors and flaws.  Then I attended Security Log Analysis Training which included ideas to improve security logging & monitoring as well as command examples that you can customize on your own logs and how to analyze data and look for patterns.  This hands-on training provided me with valuable experience that would only improve my cybersecurity skills.
The next two days there were several presenters that covered topics such as
  • Security Best Practices for Academic Cloud Service Providers (a big one I took away from this was Identity Access Management-aware Continuous Integration/Continuous Delivery Services)
  • Involving Students in Cybersecurity for CI
  • Silent Librarian (series of phishing attacks)
  • Responding to advanced threats as a global community (building a trust relationship in cybersecurity community)
  • XSEDE lessons learned (importance of multi-factor authentication)
  • Incident Response Communications
  • Password Adventures for a VO
  • A case study on implementing crowdsourced threat intel and active response
Overall, the focus was on being Proactive vs being Reactive; changing the focus of cybersecurity from protecting (specifically against malicious attacks) to enabling - moving beyond the fear of data breach and focusing on how to better enable end users to deal with data theft and how to be ready to respond to events like that.

I am very thankful for the knowledge I gained at this conference. Thank you, Trusted CI, for allowing me to participate as a student and for the engaging conversations and presentations that challenged and enhanced the way I think about cybersecurity.
We were more than impressed with the Student Program this year. Their participation and enthusiasm was a rewarding affirmation of our commitment to community building. We look forward to seeing where their careers take them and sponsoring more students in the future.