Wednesday, July 29, 2020

Trusted CI begins Engagement with Galaxy

Galaxy is an open-source, web-based application for performing data-intensive biomedical research. It combines common software tools and data workflows to provide researchers without an informatics platform in an accessible, easy to use interface, which abstracts the complexity of interacting with compute resources. Galaxy provides a free, public, internet accessible instance at https://usegalaxy.org, utilizing infrastructure provided by CyVerse at the Texas Advanced Computing Center, with support from the National Science Foundation. Galaxy can also be installed and run locally at sites, or run in the cloud, providing flexibility for deployment, custom security requirements, and compute availability. The Galaxy Project is supported in part by NSF, NHGRI (National Human Genome Research Institute), The Huck Institutes of the Life Sciences, The Institute for CyberScience at Penn State, and Johns Hopkins University. The Galaxy Team is a part of the Center for Comparative Genomics and Bioinformatics at Penn State, the Department of Biology at Johns Hopkins University, and the Computational Biology Program at Oregon Health & Science University

The overall goal is for Trusted CI to work with Galaxy in reviewing the current security practices of the Galaxy project container-based deployments and provide recommendations to ensure safe handling, processing, and storage of data. To that end, Trusted CI will focus on the following activities:

  • Review Galaxy components and their interactions to gain a detailed understanding of the overall security architecture, and data work-flow, while generating updated architecture diagrams.

  • Evaluate Galaxy against NIST 800-53 and determine where controls need to be implemented.

  • Conduct a HIPAA gap analysis to identify any areas needing additional safeguards. Provide guidance on processes and tools needed to fill any gaps identified.

  • Provide guidance on processes and tools required to fill these gaps.

  • Time permitting: Review the architecture and implementation of usegalaxy.org and make recommendations for improving security.

This engagement is a collaboration between the Science Gateway Community Institute’s (SGCI) incubator service and Trusted CI.


The engagement started July 2020 and is scheduled to conclude by the end of December 2020.

Tuesday, July 28, 2020

Trusted CI Webinar: Transitioning Cybersecurity Research to Practice - Aug. 11th at 11am (EDT)


Add caption
Florence Hudson, Ryan Kiser, Patrick Traynor, and S. Jay Yang, are presenting, Transitioning Cybersecurity Research to Practice - Success stories and tools you can use, on Tuesday August 11th at 11am (Eastern). 

Please register here. Be sure to check spam/junk folder for registration confirmation email.
"Transition to practice is really a passion of mine. It is wonderful to write papers and have great ideas. But it is even cooler to get a million people using it." – Professor Patrick Traynor.

Join us to hear exciting Cybersecurity Research success stories, and lessons learned along the way, from Professor Patrick Traynor from the University of Florida who has successfully transitioned his research to practice in a number of ways. One of his technologies, the Skim Reaper, is being used across multiple U.S. states to protect from credit card skimming. We will also share tools that Trusted CI has developed to help you take the Transition To Practice journey as a developer and researcher. Florence Hudson and Ryan Kiser will present the "Trusted CI TTP Playbook" available on the Trusted CI website, with TTP Tools you can use. This includes a TTP Canvas to enable the researcher and developer to clarify their target users, value proposition, and how they will TTP. We also include a TTP Technology Readiness Level (TRL) assessment tool to design your technical journey to mature and transition to practice your valuable research.
Speaker Bios:

Florence D. Hudson is a Special Advisor at Trusted CI, the NSF Cybersecurity Center of Excellence, co-leading the Transition To Practice (TTP) program. She has led TTP at IBM, Internet2 and Trusted CI. She is a former IBM Vice President and Chief Technology Officer, Internet2 Senior Vice President and Chief Innovation Officer, and Aerospace and Mechanical Engineer at Northrop Grumman and NASA. She is Executive Director for the Northeast Big Data Innovation Hub at Columbia University, and Founder and CEO of Advanced Technology and Diversity & Inclusion Consulting Firm FDHint, LLC. She received her BSE in Mechanical and Aerospace Engineering from Princeton University, and completed Executive Education at Harvard Business School and Columbia University.

Ryan Kiser is a Senior Security Analyst at the Indiana University Center for Applied Cybersecurity Research. Ryan has worked on information security projects across a wide variety of domains including leading efforts to assess and improve the security of automotive engine systems, performing risk assessments for university central IT systems, and supporting researchers in efforts to adhere to regulated data requirements such as HIPAA, FISMA, and various CUI requirements. Ryan has been heavily involved in organizations serving information security needs for higher-ed and national research communities. Some of these include the Open Science Grid (OSG) as a member of the OSG Security Team and Trusted CI where he has led engagements to assist NSF-funded research projects in improving their security posture. His current interests involve novel applications of predictive modeling, machine learning, and brazilian jiu-jitsu.

Patrick Traynor is a professor of Computer and Information Science and Engineering (CISE) at the University of Florida. Patrick's research focuses on the security of mobile systems, with a concentration on telecommunications infrastructure and mobile devices. His research has uncovered critical vulnerabilities in cellular networks, developed techniques to find credit card skimmers that have been adopted by law enforcement and created robust approaches to detecting and combating Caller-ID scams. He received a CAREER Award from the National Science Foundation in 2010, was named a Sloan Fellow in 2014, a Fellow of the Center for Financial Inclusion at Accion in 2016 and a Kavli Fellow in 2017. Professor Traynor earned his Ph.D and M.S. in Computer Science and Engineering from the Pennsylvania State University in 2008 and 2004, respectively, and his B.S. in Computer Science from the University of Richmond in 2002. He is also a co-founder of Pindrop Security, CryptoDrop, and Skim Reaper.

Dr. S. Jay Yang received his BS degree in Electronics Engineering from National Chaio-Tung University in Taiwan in 1995, and MS and Ph.D. degrees in Electrical and Computer Engineering from the University of Texas at Austin in 1998 and 2001, respectively. He is currently a Professor and the Department Head for the Department of Computer Engineering at Rochester Institute of Technology. He also serves as the Director of Global Outreach in the Center of Cybersecurity at RIT, and a Co-Director of the Networking and Information Processing (NetIP) Laboratory. His research group has developed several pioneering machine learning, attack modeling, and simulation systems to provide predictive analysis of cyberattacks, enabling anticipatory or proactive cyber defense. His earlier works included FuSIA, VTAC, ViSAw, F-VLMM, and attack obfuscation modeling. More recently, his team is developing a holistic body of work that encompasses ASSERT to provide timely separation and prediction of critical attack behaviors, CASCASE to simulate synthetic cyberattack scenarios that integrates data-driven and theoretically grounded understanding of adversary behaviors, and CAPTURE to forecast cyberattacks before they happen using unconventional signals in the public domain. Dr. Yang has published more than sixty papers and worked on eighteen sponsored research projects. He has served on organizing committees for several conferences and as a guest editor and a reviewer for a number of journals and textbooks. He was invited as a keynote or panel speaker for several venues. He was a recipient of Norman A. Miles Outstanding Teaching Awards, and a key contributor to the development of two Ph.D. programs at RIT and several global partnership programs.

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Tuesday, July 21, 2020

Trusted CI Completes a Highly Successful Engagement with UC Berkeley

Handling regulated data is becoming a key requirement for supporting research, especially for high performance computing (HPC) service providers who have not previously been subject to rules and regulations.  While the list of institutions with research cyberinfrastructure approved for critical data such as protected health information (PHI) or Controlled Unclassified Information (CUI) is growing, it still remains woefully short.  Any major university effort to accommodate researchers with regulated data adds to the pool of research enablers, while simultaneously protecting sensitive research data.

For HPC service providers that support research sponsored by the NSF,  pursuing compliance also diverts resources, potentially affecting this support.  External help can be invaluable in reducing the impact, especially for providers tackling compliance for the first time.  

Trusted CI recently concluded a highly successful engagement with UC Berkeley that both validated and bolstered UC Berkeley’s nascent regulated data effort, namely a “Secure Research Data and Compute” (SRDC) platform.   The SRDC platform is expected to have a significant impact on UC Berkeley’s ability to enable and empower a wide range of researchers to conduct research with data subject to rules and regulations in scientific fields as diverse as biology, engineering, computer science, and a broad spectrum of social sciences and professional schools such as business, public health, and law.

According to Ken Lutz, Director of Research Information Technology at UC Berkeley: 

“Our engagement with Trusted CI has been very successful and has been an important part of preparing for the launch of our SRDC Platform. While we had already obtained a commitment by senior leadership to develop the platform, the perspective and expertise provided by the Trusted CI team helped us build trust across our complex network of stakeholders. Our UC Berkeley team especially appreciated the broader higher education experience that the Trusted CI team brought to the engagement. Based on this engagement, we feel confident that we are developing a platform and service that will enable our research community to pursue high impact research involving highly sensitive data.”

Initial engagement objectives included a review of SRDC’s design, security and compliance goals and future vision, a comparison of SRDC security against best practices at peer institutions, gap identification, and recommendations on how to fill those gaps.

The engagement spanned eleven 1-hour meetings and an all-day virtual campus visit. The meetings, submitted artifacts, and other input from UC Berkeley enabled Trusted CI to assess the SRDC security architecture, workflows, and current policies and procedures, evaluate and validate the cybersecurity framework UC Berkeley is developing with help from a commercial third party, and gauge UC Berkeley’s approach to regulated data against what peer institutions are doing.

During the virtual campus visit, Trusted CI met many of the other SRDC stakeholders on campus (including the CISO) and did a presentation for a group of these stakeholders that detailed current regulated research data approaches nationally and how UC Berkeley’s effort fits in.

The final product of the engagement was a 21-page report containing specific, prioritized recommendations on how to address the security gaps identified during the engagement (including HIPAA gaps), adopt best practices, and avoid pitfalls while maintaining a healthy balance between usability and security.  Trusted CI also provided policy templates and guidance on how best to leverage the cybersecurity framework recommended by the third party.

Trusted CI benefited from this engagement as well from working alongside a commercial third party and learning about their approach to compliance, and from the addition of another institution that Trusted CI can refer future seekers of compliance to for guidance and counsel.

The success of this engagement is noteworthy in light of the challenges COVID-19 introduced in the midst of the engagement, including the cancellation of a campus visit and face to face interaction, both of which are typically important to the success of highly collaborative projects.

Thursday, July 9, 2020

PEARC20: Join us at the Fourth Workshop on Trustworthy Scientific Cyberinfrastructure

Join us at the Fourth Workshop on Trustworthy Scientific Cyberinfrastructure at PEARC20 on Monday July 27th, 8:00am - 12:00pm Pacific Time (11:00am - 3:00pm Eastern Time / 15:00 - 19:00 UTC). The workshop provides an opportunity for sharing experiences, recommendations, and solutions for addressing cybersecurity challenges in research computing. It also provides a forum for information sharing and discussion among a broad range of attendees, including cyberinfrastructure operators, developers, and users.

The workshop is organized according to the following goals:

  • Increase awareness of activities and resources that support the research computing community's cybersecurity needs. 
  • Share information about cybersecurity challenges, opportunities, and solutions among a broad range of participants in the research computing community.
  • Identify shared cybersecurity approaches and priorities among workshop participants through interactive discussions.

Schedule

See our workshop page for the full presentation abstracts. The order of presentations is subject to change and will be posted to the workshop page
  • 8:00 am Pacific / 11:00 am Eastern 
    • Community Survey Results from the Trustworthy Data Working Group   
      • Presenters: Jim Basney, NCSA / Trusted CI
        Jeannette Dopheide, NCSA / Trusted CI
        Kay Avila, NCSA / Trusted CI
        Florence Hudson, Northeast Big Data Innovation Hub / Trusted CI
  • 8:30 am Pacific / 11:30 am Eastern 
    • Characterization and Modeling of Error Resilience in HPC Applications 
      • Presenter: Luanzheng Guo, University of California-Merced
  • 9:00 am Pacific / 12:00 pm Eastern
    • Trusted CI Fellows Panel
      • Moderator: Dana Brunson, Internet2 
      • Panelists: Jerry Perez, University of Texas at Dallas
        Laura Christopherson, Renaissance Computing Institute
        Luanzheng Guo, University of California, Merced
        Songjie Wang, University of Missouri
        Smriti Bhatt, Texas A&M University - San Antonio
        Tonya Davis, Alabama A&M University

  • 9:30 - 10:30 am Pacific / 12:30 pm - 1:30 pm Eastern ***Break/Lunch***
  • 10:30 am Pacific / 1:30 pm Eastern
    • Analysis of attacks targeting remote workers and scientific computing infrastructure during the COVID19 pandemic at NCSA/UIUC
      • Presenters: Phuong Cao, NCSA/U of Illinois at Urbana-Champaign
        Yuming Wu, Coordinated Science Lab/UIUC
        Satvik Kulkarni, U of Illinois at Urbana-Champaign
        Alex Withers, NCSA/U of Illinois at Urbana-Champaign
        Chris Clausen, NCSA/U of Illinois at Urbana-Champaign
  • 11:00 am Pacific / 2:00 pm Eastern
    • Regulated Data Security and Privacy: DFARS/CUI, CMMC, HIPAA, and GDPR
      • Presenters: Erik Deumens, University of Florida
        Gabriella Perez, University of Iowa
        Anurag Shankar, Indiana University
  • 11:30 am Pacific / 2:30 pm Eastern
    • Securing Science Gateways with Custos Services
      • Presenters: Marlon Pierce, Indiana University
        Enis Afgan, Johns Hopkins University
        Suresh Marru, Indiana University
        Isuru Ranawaka, Indiana University
        Juleen Graham, Johns Hopkins University
For any questions regarding this workshop, please contact workshop-cfp@trustedci.org.

Wednesday, July 8, 2020

Introducing Trusted CI office hours: Thursday July 23 at 10am Central time

Trusted CI is launching a new monthly office hours project to provide direct assistance to members of our community in an informal setting. Our first session is Thursday July 23rd at 10am Central. Office Hours will be held on our Slack Channel.

Notification of upcoming sessions will be communicated via our Discuss list. Subscribe to the Trusted CI Discuss List. (Posting is limited to subscribers to prevent spam.)

This month's session will be attended by experts in identity and access management (IAM); but we welcome any cybersecurity questions related to your project, or questions regarding services offered by Trusted CI.
Trusted CI offers many opportunities to connect with the open science community. We host webinars, the Trustworthy Data Working Group, and now office hours; all open to the general public. Our Framework Advisory Board, Large Facilities Security Team, IAM working group, and Fellows Program are targeted to more specific audiences. We hope you can find one or more opportunities to connect with us.

Tuesday, July 7, 2020

Trusted CI Webinar July 20th at 11am ET: Whose line is it anyway? - Problem solving in complex networks with Doug Southworth

Indiana University's Doug Southworth is presenting the talk, Whose line is it anyway? - Problem solving in complex networks, on July 20th at 11am (Eastern). 

Please register here. Be sure to check spam/junk folder for registration confirmation email.
Today’s collaborative science often utilizes massive datasets shared across great distances. With better access to data we ask harder questions: interactive data sources change the very science we do. These factors have also given rise to new challenges, namely understanding the end-to-end performance of large data transfers. In a growing, complex, global network, no one person or entity controls all the pieces. End users don’t know what kind of performance to expect. Soft failures are notoriously difficult to find. Just as today’s science is collaborative, so must be our approach to troubleshooting and resolution of network performance issues. EPOC was created to be a focal point for these efforts, bringing together operational expertise and analysis to shed light on the multi-faceted problems that hamper research data movement.  Along with our partners in this space, such as Trusted CI, we are able to coordinate efforts between researchers, CI engineers, and network operators to bring resolution to complex data transfer issues, whether the root cause is technical or, as we have discovered in many cases, social. Community engagement has often proven to be the missing piece of the puzzle in this ever changing landscape, and lessons learned from these engagements are invaluable as we continue forward to the next phases of large-scale collaborative science.
Speaker Bio:
Doug Southworth is a Network Systems Analyst for International Networks at Indiana University, working with EPOC, perfSONAR, and NetSage in both developer and science engagement roles, focusing on performance analysis. Prior to working at IU, Southworth has held senior systems engineer positions with several state and federal agencies, including his last position with the United States Courts.

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Ransomware continues to threaten scientific research

The recent IT Security Incident at UCSF reminds us that ransomware attacks continue to threaten scientific research on our campuses. Ransomware has been a threat to our community for many years -- our 2016 blog post on the topic is still relevant. Sophos (via REN-ISAC) provides a detailed analysis of the Netwalker ransomware that is being used in recent attacks. Additionally, the NIST Cybersecurity Practice Guides on Data Integrity (SP 1800-11 and SP 1800-26) include advice on preparing for ransomware (and related) attacks, including configuration change control, backups, encryption, integrity checking, audit logging, monitoring, and incident response planning. Also, the National Student Clearinghouse Ransomware Playbook provides a reference process for handling Ransomware incidents.

Do you have concerns about ransomware? Resources or best practices to share? Join our email discussion list.

Thursday, July 2, 2020

Survey Report: Scientific Data Security Concerns and Practices


The Trustworthy Data Working Group has published a report at https://doi.org/10.5281/zenodo.3906865 that summarizes the results from our survey of scientific data security concerns and practices. 111 participants completed the survey from a wide range of positions and roles within their organizations and projects. We invite the community’s feedback on this report and input to the ongoing work of the working group via the working group mailing list. You may also send input directly to Jim Basney at jbasney@illinois.edu.

Next, the working group will be developing guidance on trustworthy data for science projects and cyberinfrastructure developers, based on the survey results and on resources from NIST, RDA, ESIP and others. Related work includes NIST 1800-25, the TRUST Principles for Digital Repositories, and Risk Assessment for Scientific Data. The working group will also be providing input into the next revision of the Open Science Cyber Risk Profile (OSCRP).

Working group membership is open to all who are interested. Please visit https://www.trustedci.org/2020-trustworthy-data for details.

Wednesday, July 1, 2020

2020 NSF Cybersecurity Summit CFP extended to July 13

2020 NSF Cybersecurity Summit Call for Participation (CFP) has been extended, deadline is COB on Monday July 13th. 


Call for Participation (CFP)

Program content for the summit is driven by our community. We invite proposals for presentations, breakout and training sessions, as well as nominations for student scholarships. The deadline for CFP submissions is July 13th To learn more about the CFP, please visit: https://trustedci.org/cfp-2020