Call for Participation for the 2023 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure

 October 24th - 26th ✶ Berkeley, CA

https://trustedci.org/summit/

It is our pleasure to announce that the 2023 NSF Cybersecurity Summit is scheduled to take place the week of October 23rd. Starting with two  full days of trainings and workshops that will be held on Tuesday, October 24th and Wednesday, October 25th. Concluding with a full day of plenary sessions occurring on Thursday, October 26th.

The final program is still evolving, but we will maintain the mission to provide a format designed to increase the NSF community’s understanding of cybersecurity strategies that strengthen trustworthy science: what data, processes, and systems are crucial to the scientific mission, what risks they face, and how to protect them.

About the Summit

Since 2004, the annual NSF Cybersecurity Summit has served as a valuable part of the process of securing the NSF scientific cyberinfrastructure by providing the community a forum for education, sharing experiences, building relationships, and establishing best practices.

The NSF cyberinfrastructure ecosystem presents an aggregate of complex cybersecurity needs (e.g., scientific data and instruments, unique computational and storage resources, complex collaborations) as compared to other organizations and sectors. This community has a unique opportunity to develop information security practices tailored to these needs, as well as break new ground on efficient, effective ways to protect information assets while supporting science. The Summit will bring together leaders in NSF cyberinfrastructure and cybersecurity to continue the processes initiated in 2013: building a trusting, collaborative community and seriously addressing that community’s core cybersecurity challenges.

The Summit seeks proposals for plenary presentations, workshops/trainings, BoFs/project meetings, poster session and student program. 

Proposing Content for the Summit

There are many ways to contribute to the Cybersecurity Summit. We are open to proposals for live plenary presentations, focused workshops/trainings, project meetings and birds of a feather(BoFs). More specific information on each of those is available below. Submissions can be made using this online form https://docs.google.com/forms/d/e/1FAIpQLSc8VJjYj2XmzTxhoeBvQaf2LUCWovOCouMO5XQtdHgBjzOZDA/viewform by June 16, 2023. Responses will be announced by July 14, 2023 to ensure adequate planning time for presenters.

We strongly encourage proposals that address the 2022 Summit themes and challenges such as Framework Adoption, Operational Technology, Preparing for AI, Identity and access management, Compliance challenges and Risk assessment. Additionally, proposals that address topics ranked high by the community are also strongly encouraged/prioritized. These include: 

1. Human Factors in Cybersecurity
2. Open Source Software Security
3. Cloud Security
4. AI/ML for Security
5. Trust/Security of AI Tools
6. Information Asset Management
7. Supply Chain Attacks
8. ChatGPT use/banning/enabling for Security
9. Quantum Computing

Proposing a Plenary Presentation

Please submit brief proposals with a 1-2 page abstract focused on NSF Large Facilities’ unmet cybersecurity challenges, lessons learned, and/or significant successes for presentation during the Summit Plenary Session. Plenary talks are limited to 25 minutes in length including time needed for question and answers if desired. 

Please note that the Summit will offer a ‘hybrid’ model for remote attendees to participate and all plenary talks will be recorded and made available after the event. Proposals should only contain information without sharing restrictions. As a guide, all plenary presentations should be TLP:WHITE “information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.” 

Submission deadline: June 16th, 2023
Proposals can be submitted using this online form: https://docs.google.com/forms/d/e/1FAIpQLSc8VJjYj2XmzTxhoeBvQaf2LUCWovOCouMO5XQtdHgBjzOZDA/viewform
Word limit: 1-2 pages
Notification of acceptance: July 14th, 2023

Proposing a Workshop or Training Session

Continuing this year, the Summit will accept proposals for Workshops and Trainings seeking to build communities of practice related to the NSF CyberInfrastructure. Please submit brief proposals with abstract that includes the intended audience, description of what the workshop or training will cover and expected benefits for attendees. Examples may include table top exercises, focused discussions and activities on techniques and skills in a particular field, and collaborative information sharing among security professionals.

Workshops and Trainings will be scheduled to not overlap with the Plenary sessions. They can be of varying length ranging from one hour to a half day (3.5 hours). Workshops can be limited to a specific audience to provide confidentiality. For workshops that intend to limit participation, proposals should include requirements for attendees. For accepted workshops that have admission requirements, members of Trusted CI along with workshop organizers will review workshop registration requests to ensure they meet attendance requirements. Workshop and training organizers may choose to offer either in-person or a hybrid model to include attendees joining remotely via Zoom. Workshop/training organizers are encouraged to offer hybrid sessions to maximize participation. This includes running the Zoom (e.g., monitoring the chat, unmuting remote participants, etc.). 

Submission deadline: June 16th, 2023
Proposals can be submitted using this online form: https://docs.google.com/forms/d/e/1FAIpQLSc8VJjYj2XmzTxhoeBvQaf2LUCWovOCouMO5XQtdHgBjzOZDA/viewform
Word limit: 1-2 pages
Notification of Acceptance: July 14th, 2023

Birds of a Feather and Project Specific Meeting Proposals

New this year we will be offering Summit attendees to propose Birds of a Feather (BoFs) and Project Specific Meetings. 

Birds of a Feather (BoFs): Informal gatherings of like-minded individuals who wish to discuss a certain topic can be 1-2 hours in length. Proposers of BoF sessions should serve as discussion leaders to explore and address challenges for a specific topic. BoF Proposals should be no more than one page in length and include the proposed topic and description, the activity’s intended audience, and its expected benefits.

Project Specific Meetings: The Summit organizers recognize that the summit attracts many people who work remotely on projects with distributed staff (ACCESS, ESNet, OSG, Zeek, Jupyter).  Attending a conference presents an opportunity for people who work collectively on a shared project to meet in person. This year we have a number of meeting rooms available for projects to hold working sessions. To request a meeting room, please provide a name and description of the project, number of expected participants and meeting duration (1-2 hours suggested). Requests will be reviewed and scheduled based on room availability. 

Submission deadline: June 16th, 2023
Proposals can be submitted using this online form: https://docs.google.com/forms/d/e/1FAIpQLSc8VJjYj2XmzTxhoeBvQaf2LUCWovOCouMO5XQtdHgBjzOZDA/viewform
Word Limit: 1-2 page description
Notification of Acceptance: July 14th, 2023

Poster Proposals

Also new this year we will be offering individuals to present posters in an informal setting. This is an opportunity to disseminate your work with Summit attendees, receive helpful insights and engage others who are interested in the same subject or focus of your work.

To propose a poster, please provide your name, poster title along with an abstract. Details on shipping posters will be provided upon acceptance.

Submission deadline: June 16th, 2023
Proposals can be submitted using this online form: https://docs.google.com/forms/d/e/1FAIpQLSc8VJjYj2XmzTxhoeBvQaf2LUCWovOCouMO5XQtdHgBjzOZDA/viewform
Word Limit: 1-2 page description
Notification of Acceptance: July 14th, 2023

Student Program

To support workforce development, the Summit organizers invite several students to attend the Summit in-person. Both undergraduate and graduate students may apply. No specific major or course of study is required, as long as the student is interested in learning and applying cybersecurity innovations to scientific endeavors.

To be considered, students must submit an application form (link below), answering questions about their field of study and interest in cybersecurity. Up to 10 student applicants will receive invitations from the Program Committee to attend the Summit in-person. Attendance includes students’ participation in a poster session.

Travel and hotel accommodations will be provided. Students whose applications are declined are welcome to attend the Summit remotely.

The deadline for applications is Monday, August 28th at 12 am CDT, with notification of acceptance to be sent by Friday September 8th.

Please discuss attendance with your instructors prior to attending.

We cannot select applications to attend in-person from students who live outside the United States.

Student Application to attend the Summit:
https://forms.gle/wxCRYpD94mCbQ4Rb6
Send questions to students@trustedci.org
Submission deadline: Monday, August 28th at 12 am CDT
Notification of Acceptance: Friday, September 8th

Notes for First-Time Presenters

The Summit organizers want to encourage those who have not presented at previous Summits to share their experiences, expertise, and insights with the NSF cybersecurity community. You don’t need to be perfectly polished, you just need to have something to share about your project or facility's experience with information security. Feedback from past Summits show that there is a great deal of interest in “lessons learned” type presentations from projects who’ve faced cybersecurity challenges and had to rethink some things afterwards. We’ve put together a page of tips and ideas for new presenters, including proposal and presentation tips as well as suggested topics. More direct coaching is available upon request.

Additional Call for Participation (CFP) Guidance

The Summit organizers wish to encourage and support participation from throughout the wider NSF community. To further that mission, we’ve provided some information (below) to aid in the preparation of CFP responses. Please don’t hesitate to direct questions to CFP@trustedci.org.

What to Present

The CFP presents an opportunity for the community to make progress on shared challenges identified in prior summits. The organizers especially appreciate proposals that drive this home; however, not every presentation or activity has to be centered around just that topic. Please submit any idea that you think may be relevant to our audience but note that proposals that address community challenges from prior years will be given higher preference. 

We strongly encourage proposals that address the 2022 Summit findings and topics identified of high interest as outlined above.

How to Build a CFP Response

The proposal you submit will be used in two ways: to tell the organizers about what you plan to present and to be included in the summit findings as a sort of after-action report. It should include:

1. Session Format: Plenary (Lecture, Panel, Open Format) or workshop
2. An executive summary/abstract (short description of the topic and content).
3. Who the presenter(s) is/are.
4. Either an abstract of the topic or a narrative you’d like to share with the community. (For activities that are not plenary sessions, this may be replaced with a description of the planned activity and the activity’s intended audience.)
5. Contact information (preferably email) for the presenter(s) in case the organizers have any questions. This can be in a separate note in the email body instead of the proposal itself if presenter(s) don’t wish it to be published.
6. Expected length of the session/activity. All plenary sessions will be limited to 25 minutes, Workshops and Trainings can range from one to 3.5 hours. BoFs and Project specific meetings are suggested to run 1-2 hours.
7. Intended audience and expected benefits of the proposal

Our community has expressed in the past that many find it helpful if they can download a copy of a presentation’s slides. Therefore we will require all presenters to submit their slides in advance of the summit. 

The easiest way to get help/feedback from the organizing committee prior to submitting your final proposal is to create a Google Doc containing your proposal and sending an edit link to CFP@trustedci.org. 

Tips for Presenting

There are many different presentation formats that can work well depending on the topic. Consider the following:

1. Lecture format: The presenter(s) talk to the audience and show slides to support their dialogue, then do a short Q&A session at the end of the presentation.
2. Panel format: 3-5 persons answer questions offered by a moderator on a specific topic or set of topics, then do a short Q&A with the audience. This tends to work out best when the panel contains people with very different backgrounds or viewpoints, and the moderator is good at keeping folks to the topic and time constraints.
3. Open Forum format: 2-3 persons answer questions offered by the audience. Works best if there is an extra person gathering questions and presenting them, and if the speakers can keep things succinct so that the presentation keeps moving and many questions get answered.
4. Hands-on format(workshops/trainings): The presenter(s) walk the audience through a demo or tutorial as the audience follows along on their computers (or on paper, if the topic supports it).  If you are doing a training that will have many hands-on activities, consider having more than one presenter, or a presenter plus a helper or two who can go around the room and help participants who get stuck, allowing the group as a whole to move on.

Trusted CI Webinar: Senior Citizens Striking Back at Scammers, May 22nd @11am EST

Anita Nikolich is presenting the talk, Senior Citizens Striking Back at Scammers, May 22nd at 11am (Eastern).

Please register here.

Thousands of people fall for online scams every year. Anyone can be scammed, but older adults in the US are the most targeted population in the world. By far. Those over age 60 lost over $3 Billion last year—and that’s just the ones who reported it. One of the fastest growing scams aimed at seniors is romance scams, especially those involving cryptocurrency, which is largely impossible for US law enforcement to prosecute. Websites and education programs to inform seniors about scams exist, but they’re not interactive and engaging and often treat seniors like they are clueless. Our project – Deception Awareness and Resilience Training (DART) is building a fun, spy themed mobile video game for senior citizens that will be released this summer. This talk will give some background on how the latest scams work, especially ones based around cryptocurrency, and show you how we’ve assembled a multidisciplinary team, including a professional game development company, to arm seniors to defend themselves against scammers!

Speaker Bio:

Anita Nikolich is a Research Scientist and the Director of Research and Technology Innovation at the University of Illinois's School of Information Sciences and Director of Research at Inca Digital, a digital asset analytics company. She is Co-PI of the NSF-funded FABRIC Midscale Research Infrastructure, Co-PI of an NSF-funded Convergence Accelerator project, Deception Awareness and Resilience Training (DART) and PI on a DARPA funded SBIR, Mapping the Impact of Digital Financial Assets (MIDFA).

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Registration Open for ’23 NSF Research Infrastructure Workshop

Trusted CI invites cybersecurity staff from NSF Major Facilities and NSF Mid-Scale Facilities to join us at the 2023 NSF Research Infrastructure Workshop, hosted by NSF’s Large Facilities Office (LFO). The Research Infrastructure Workshop (RIW) is a collaborative forum for all the NSF research infrastructure projects.

The workshop is a hybrid format and will be held Tuesday through Friday, June 27th - 30th at the Washington Marriott at Metro Center. 

Registration is currently open.

There will be many opportunities to join discussions on cyberinfrastructure and cybersecurity. A few highlights include:

• A dedicated Cybersecurity track on Day 2, which will cover the Trusted CI Framework, operational cybersecurity with ResearchSOC, and Regulated Research Community of Practice (RRCoP). Also, Robert Beverly (NSF) will provide introductory remarks for the Cybersecurity track.
  
• Trusted CI Director, Jim Basney, and Roland Roberts presenting, “Overview of Cybersecurity at Research Infrastructure: Balancing the Need to Be Secure and Also Open,” during the plenary session on Day 3.
• Tony Beasley (NRAO) presenting "Lessons from the 2022 Ransomware Attack on ALMA" during the plenary session on Day 3.
  
• Partner project CI Compass are presenting, “Overview of CI Compass and the Relevance of AI in Cyberinfrastructure,” during the plenary session on Day 1.
• And, a dedicated Cyberinfrastructure track on Day 1 covering "Models of Data Governance" and "Expanding use of AI in Research Infrastructure applications."

The drafted agenda is available (pdf) on RIW’s event site. The event includes a poster session, welcome reception, and a tour of the National Air and Space Museum.

Join Trusted CI's announcements mailing list for information about upcoming events. 

Trusted CI Webinar: Cybersecurity Operations for the NSF ACCESS Cyberinfrastructure, April 24th @11am EST

PSC's Derek Simmel is presenting the talk, Cybersecurity Operations for the NSF ACCESS Cyberinfrastructure, April 24th at 11am (Eastern).

Please register here.

On September 1, 2022, the U.S. National Science Foundation (NSF) ACCESS Cyberinfrastructure started production operations, ushering in a new era following two decades of cooperative cyberinfrastructure partnerships among several leading centers for High Performance Computing (HPC) at U.S. universities and research institutions under the NSF TeraGrid and XSEDE projects. The NSF ACCESS Cyberinfrastucture is composed of five funded projects, including an ACCESS Coordination Office and four tracks representing (1) resource allocations, (2) user support and training, (3) operations, including cybersecurity, data management and networking, and (4) monitoring and measurement services. ACCESS Resource Provider (RP) sites include several NSF-funded HPC systems deployed at U.S. universities and research facilities nationwide, on which computing time and storage are allocated on a peer-reviewed basis managed through the ACCESS project.

In this webinar, we will describe the functions and activities of the ACCESS Cybersecurity Operations Group, and summarize the progress, challenges, and lessons learned in its first year. Topics will include authentication and identity management (AIM), cybersecurity communications and readiness, policy development, and future directions.

Speaker Bio:

Derek Simmel's career in Cybersecurity and HPC spans over four decades. Derek joined the technical staff of the CERT Coordination Center at Carnegie Mellon University's Software Engineering Institute in 1995. He brought his experience to the Pittsburgh Supercomputing Center (PSC) in 2001. Derek is currently a co-PI for the U.S. National Science Foundation (NSF) ACCESS COre National Ecosystem for CyberinfrasTructure (CONECT) project, and leads Cybersecurity Operations for ACCESS. He also provides infrastructure design, cybersecurity and scientific workflow support for PSC's NSF-funded Bridges-2 system, and PSC's NIH-funded Brain Image Library, HuBMAP, and ANTON projects. Since 2011, Derek has chaired The Americas Grid Policy Management Authority (TAGPMA), one of three PMAs that comprise the Interoperable Global Trust Foundation (IGTF). He has served on the Technical Steering Committee for the Linux Foundation OpenHPC project since 2016, and on the Governing Board for OpenHPC since 2019.

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

SAVE THE DATE: Announcing the 2023 NSF Cybersecurity Summit, Oct 24-26, 2023 in Berkeley, CA

Please mark your calendars for the 2023 NSF Cybersecurity Summit  planned for 3 full days, October 24-26 at the Lawrence Berkeley National Laboratory, in Berkeley, CA.

Trusted CI is welcoming other groups to schedule events the week of October 23rd around the Summit that may be of interest to our community. For planning purposes you may want to reserve the full week to attend these meetings. More details will be shared as planning progresses.

Stay tuned for more information by following the Trusted CI Blog or our Announcement email list for more updates.

On behalf of Trusted CI

Announcing the 2023 Trusted CI Open Science Cybersecurity Fellows

Trusted CI, the NSF Cybersecurity Center of Excellence, is excited to announce the Trusted CI Open Science Cybersecurity Fellows. Seven individuals with professional interests in cybersecurity have been selected from a nationally competitive pool. During the year of their Fellowship, they will receive recognition and cybersecurity professional development including training and travel funding to cybersecurity related events.

The 2023 Trusted CI Open Science Cybersecurity Fellows are:

Ramazan S. Aygun

Director of Center for Research Computing at Kennesaw State University

Ramazan S. Aygun is the Director of Center for Research Computing at Kennesaw State University and Associate Professor of Computer Science with joint appointment at the School of Data Science and Analytics.  He has published more than 130 refereed international journal papers, conference papers and book chapters in various aspects of data science including big data computing, machine learning, multimedia forensics, data mining, data modeling, data communications, data compression, data presentation, data retrieval, data indexing, data querying, and data fusion. His most recent work includes trustworthy machine learning and developing fair and explainable machine learning models by studying possible bias in the datasets. He is recently leading NSF funded project titled “CC* Data Storage: High Volume Data Storage Infrastructure for Scientific Research and Education at Kennesaw State University Shared as Open Science Data Federation Data Origin.” Dr. Aygun served as a program co-chair of IEEE International Symposium on Multimedia in 2012 and 2018. He has also served on the organization and program committees of more than 60 conferences and workshops. He is also serving as an Associate Editor of IEEE Transactions on Multimedia. He is a co-author of the book titled Data Analytics for Protein Crystallization.

Phuong Cao

Research Scientist at the Cybersecurity Division at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign 

Phuong Cao is a Research Scientist at the Cybersecurity Division at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign. His research mission is to secure cyberinfrastructure, in particular high performance scientific computing, e.g., Blue Waters supercomputer. He has a broad interest in security, with a multidisciplinary focus on Internet-scale measurements of operational systems, deep measurement driven analytics using probabilistic graphical models, ML/AI-driven honeypot for early attack response, and machine assisted proofs of federated authentication protocols. Prior to joining NCSA, he has had hands-on experience in the network security industry, including reverse engineering of polymorphic computer viruses, responding to globally distributed denial of service attacks (Akamai’s CDN, LinkedIn), securing the Watson Health Cloud (IBM z Systems), and formal verification of smart contracts and OAuth protocols (Microsoft).

Nick Harrison

Information Security Officer for the North Carolina Community College System

Nick Harrison is an Information Security Officer for the North Carolina Community College System, where he helps staff and faculty provide secure technical solutions for the next generation of the nation's workforce. Prior to joining the Community College system, Nick was the Director of Advanced Cyberinfrastructure Services at the Renaissance Computing Institute. He has over twenty years of IT experience in higher education and enjoys learning about cloud and virtualization technologies.

 

Lori Sussman

Assistant Professor of Technology and Cybersecurity at the University of Southern Maine.

Lori Sussman, Ed.D., is an Assistant Professor of Technology and Cybersecurity at the University of Southern Maine. She was part of the fourth class at the United States Military Academy to admit women and is a West Point graduate. Lori retired from the U.S. Army as a highly decorated colonel. Her military leadership experiences include 15th Regimental Signal Brigade Commander, 2nd Infantry Division Battalion Commander/CIO/G-6, Presidential Communications Officer, Joint Staff J-6 Executive Officer, and Assistant to the Army Chief of the Staff, as well as numerous demanding tactical assignments. Upon leaving service, Dr. Sussman worked in large and small companies, notably Cisco Systems and Hewlett Packard Enterprise (HPE). She is also an entrepreneur, having created several consulting businesses. In these varied roles, Dr. Sussman has managed a spectrum of highly complex organizations engaged in developing, integrating, deploying, and sustaining state-of-the-art technology and security solutions for clients. The Epsilon Pi Tau Technology Honor Society Awarded Dr. Sussman with the Warner Minilecture Award in 2020 and 2021 for her research about Cybersecurity Ambassadors. These individual awards followed recognition by the National Cyberwatch Center as the 2021 Most Innovative Cybersecurity Education Initiative. In 2021, Governor Mills named Dr. Sussman one of eleven veteran aides-de-camp. Her research areas include cybersecurity education, cybersecurity training and awareness, gender equity in technology and cybersecurity, and technology and cybersecurity leadership.

Dr. Gary Rogers

HPC Systems Administrator for the National Institute for Computational Sciences (NCIS) at the University of Tennessee

Dr. Gary Rogers earned his PhD in Computer Science from the University of Tennessee, while starting his career at the National Institute for Computational Sciences. He has over 18 years of HPC experience, many of those as an HPC administrator on some of the fastest supercomputers in the world. He played a key role in the national cyberinfrastructure projects, XSEDE and XSEDE 2.0, as the manager of the System and Operations Support group. He also participated in the XSEDE 2.0 Cybersecurity group, as well as the XSEDE Development Coordination Council. His current interests include developing and deploying secure compute platforms on which sensitive data can be analyzed, while reducing the barrier of entry for researchers to access and use such a platform. He holds an MS in Computer Science from the University of Tennessee, as well as a BS in Computer Science from the University of the South (Sewanee).  

David White

Parks, Recreation, and Tourism Management research professor at Clemson University

David White is a Parks, Recreation, and Tourism Management research professor at Clemson University. He is a Geographic Information Systems (GIS) expert with over twenty-five years in mapping, analytics, and spatial data collection. His most recent work uses mobility data to study visitation behavior in parks and protected areas. Additionally, his research has included several projects developing enterprise data and information systems requiring spatial data visualization and analytics. He holds a Ph.D. in Marine Science from the University of South Carolina.

Andrew Ferbert

Platform Services manager at the San Diego Supercomputer Center (SDSC) at UC San Diego (UCSD).

Andrew Ferbert is the Platform Services manager at the San Diego Supercomputer Center (SDSC) at UC San Diego (UCSD). Andrew’s primary responsibility is supporting SDSC and UCSD researchers through managed systems, operational support, and production systems integration. Throughout his career at SDSC, Andrew has never shied away from challenges and has worked in a variety of roles including desktop support, datacenter physical security, systems administration within HIPAA and FISMA projects, and working on projects with various branches of the United States Armed Force.

Trusted CI Webinar: The Internet2 Routing Integrity Initiative, March 27th @11am EST

Steve Wallace is presenting the talk, The Internet2 Routing Integrity Initiative, March 27th at 11am (Eastern).

Please register here.

The Internet2 Routing Integrity Initiative aims to improve the research and education (R&E) community’s adoption of best practices that strengthen the resilience and reliability of data movement across the R&E network ecosystem to support our shared missions. Routing integrity is an end-to-end challenge that requires the participation of the entire Internet2-networked community and beyond. This presentation will cover the pillars of the Routing Integrity Program and review resources you can use better to understand your organization's adoption of these practices:

• Measurement and Reporting
• Education
• Global Coordination
• Outreach and Advocacy
• Adoption of Best Practices

Speaker Bio:

As Internet2’s Director of Routing Integrity, Steve Wallace promotes the adoption and improvement of routing security and integrity throughout the Internet2 community. He has been an active community member for over 24 years, having started as the engineer responsible for the team that built Abilene, Internet2's first network.

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Call for Trusted CI Framework Cohort Participation - Response due 24 March 2023

 

The Framework Cohort is a six month, group engagement aimed at facilitating adoption and implementation of the Trusted CI Framework among NSF Major Facilities, Mid-scales, and research cyberinfrastructure (CI) providers. During the engagement, members of the cohort will work closely with Trusted CI toward implementing the Trusted CI Framework at their facility, emerging with a validated assessment of their cybersecurity program and a strategic plan detailing their path to fully implement each Framework Must. Cohort members will participate in six monthly workshops (lasting three hours each) and spend no more than eight hours each month outside of the workshops on cohort assignments. The fourth cohort will meet from July 2023 through December 2023.

 Since January 2022, almost 70 percent of NSF’s Major Facilities (MFs) have completed a cohort engagement or are currently participating in a cohort. These MFs include ARF, GAGE, IceCube, LIGO, NEON, NOIRLab, NRAO, NSO, OOI, SAGE and USAP. Additionally, NSF’s Mid-scales FABRIC, Network for Advanced NMR (NAN) and Deep Soil Ecotron (DSE); and the Corporation for Educational Network Initiatives in California (CENIC) and Giant Magellan Telescope (GMTO) are cohort participants. 

NSF Major Facilities and Mid-scales  providers wishing to participate in the next Framework cohort engagement should respond to the call by completing the form at the bottom of this page: https://www.trustedci.org/call-for-trusted-ci-framework-cohort  Your response is appreciated by Friday, March 24, 2023.

Advancing the Cybersecurity of NSF Major Facilities and National Research Cyberinfrastructure: Trusted CI’s Framework Cohort Achievements in 2022

Trusted CI’s second Framework Cohort, “Bravo”, successfully completed the six-month program of training and workshop engagement focused on learning and applying the Trusted CI Framework. Cohort members entered the engagement with a commitment to adopting the Framework at their sites. They then worked closely with Trusted CI to gather site information and create validated self-assessments of their facility’s cybersecurity programs based on the Framework. In addition, each site emerged with a draft Cybersecurity Program Strategic Plan (CPSP) identifying priorities and directions for further refining their cybersecurity programs. Bravo cohort included the following NSF Major Facilities (MFs) and research cyberinfrastructure providers:

• Corporation for Education Network Initiatives in California (CENIC)
• FABRIC  
• National Ecological Observatory Network (NEON)
• Seismological Facilities for the Advancement of Geoscience (SAGE)

The foundation of the cohort program is the Trusted CI Framework. The Framework was created as a minimum standard for cybersecurity programs. In contrast to cybersecurity guidance focused narrowly on cybersecurity controls, the Trusted CI Framework provides a more holistic and mission-focused standard for managing cybersecurity. For these organizations, the cohort was their first formal training in the Trusted CI Framework “Pillars” and “Musts” and how to apply these fundamental principles to assess their cybersecurity programs.

Concurrent with leading Bravo, Trusted CI continued engagement with the inaugural “Alpha” cohort through the end of 2022. Alpha cohort followed up on the success of the first half of the year by focusing on implementation challenges each cohort member was currently facing. Each of the monthly workshops was led by a different cohort member, with the workshop focused on addressing a specific cybersecurity challenge that the facility was facing. The Trusted CI Framework team is exploring ideas to continue the productive engagement with the cohort alumni.

In January 2023 Trusted CI began a third Framework cohort engagement (“Charlie”). Charlie cohort includes the following organizations:

• Academic Research Fleet (ARF)
• Deep Soil Ecotron (DSE)
• Giant Magellan Telescope (GMTO)
• IceCube Neutrino Observatory (IceCube)
• Network for Advanced NMR (NAN)
• US Antarctic Program (USAP)

Trusted CI is excited to be working with these new sites to advance their understanding and implementation of cybersecurity programs and best practices!

For more information, please contact us at info@trustedci.org.

Trusted CI Webinar: Using the Trusted CI Framework to Create the CFDE Cybersecurity Program, Feb 27th @11am EST

Rick Wagner is presenting the talk, Using the Trusted CI Framework to Create the CFDE Cybersecurity Program, February 27th at 11am (Eastern).

Please register here.

The NIH Common Fund Data Ecosystem (CFDE) aims to enable the broad use of Common Fund (CF) data sets to accelerate discovery. CF programs generate a wide range of diverse and valuable data sets designed to be used by the research community. However, these data sets reside in different locations, and it is challenging or even impossible to work with multiple data sets in an accessible and user-friendly way. To help remedy this problem, the CFDE has created an online discovery portal that helps make CF data sets FAIR (Findable, Accessible, Interoperable, and Reusable) and enables researchers to search across CF data sets to ask scientific and clinical questions from a single access point. The CFDE Coordinating Center oversees CFDE activities and works closely with participating data coordinating centers from other CF programs on an initial subset of data sets, with plans to expand to additional CF data sets. As the security officer for the CFDE Coordinating Center, Rick used the Trusted CI Framework to focus cybersecurity efforts on protecting the trust amongst the CFDE participants. This mission-driven approach significantly clarified the CFDE's cybersecurity planning.

Speaker Bio:

Rick Wagner is a Principal Research Systems Integration Engineer at UCSD. Rick began his career using cyberinfrastructure as a tool for research in astrophysics, working on problems in cosmology and supersonic turbulence. His research was largely done on campus, NSF, and DOE computing resources, the same kinds of systems he later managed for SDSC. Rick took a break from UCSD to work for Globus at the University of Chicago, helping researchers with data management solutions. Now Rick is part of the Research IT team, helping to design solution for projects that cut across the campus and beyond it. He is also trying to smooth the boundary between cybersecurity and research, and was a 2021 Trusted CI Fellow.

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Registration Open for 3rd HPC Security Workshop at NIST NCCoE

Trusted CI is participating in the 3rd HPC Security Workshop, hosted by NIST’s National Cybersecurity Center of Excellence (NCCoE). The goal of the workshop is to gather community feedback, share the work of the HPC security working group, and to plan future tasks.

The in-person workshop will be held Wednesday through Thursday, March 15th - 16th in Rockville, MD. Registration is currently open.

The workshop will begin Wednesday morning with a keynote from NSF Program Officer Rob Beverly. Next, members of NCSA, PSC, and NCAR will present on their experiences as HPC operators. Later in the afternoon Trusted CI Director, Jim Basney will be presenting with colleagues on cybersecurity framework development, implementation, and assessment.

On Thursday, Erik Deumens, member of Trusted CI partner Regulated Research Community of Practice (RRCoP), will be participating in a presentation on HPC security research. Later, Trusted CI Deputy Director Sean Peisert will present the final keynote on secure data sharing in HPC environments.

The full agenda is available on NIST’s website.

Join Trusted CI's announcements mailing list for information about upcoming events.

Announcing the 2023 Trusted CI Annual Challenge: Building Security Into NSF Major Facilities By Design

The Trusted CI Annual Challenge is a year-long project focusing on a cybersecurity topic of importance for scientific computing environments.  In its first year, the Trusted CI Annual Challenge focused on improving trustworthy data for open science.  In its second year, the Annual Challenge focused on software assurance in scientific computing.  In its third year, 2022, the Annual Challenge focused on the security of operational technology in science.  

The 2022 Annual Challenge on the Security of Operational Technology in NSF Scientific Research reinforced the notion that NSF Major Facilities, once constructed, can deploy operational technology that can have an operational lifetime of 15-30 years.  However, there are typically no cybersecurity requirements during acquisition and design.  In the 2023 Annual Challenge, Trusted CI staff will engage with NSF Major Facilities undergoing construction or refreshes in a hands-on way to build security into those Facilities from the outset.  Trusted CI will directly support the planning for facility refreshes and construction with respect to operational technology and will particularly focus on the academic maritime domain, including supporting the acceptance testing of the NSF-funded Research Class Research Vessels (RCRVs) at Oregon State University, supporting the U.S. Antarctic Program (USAP)’s design of the Antarctic Research Vessel (ARV), and Scripps Institution of Oceanography’s design of the California Coastal Research Vessel (CCRV).

This year’s Annual Challenge is supported by a stellar team of Trusted CI staff, including Andrew Adams (Pittsburgh Supercomputing Center), Daniel Gunter (Berkeley Lab), Ryan Kiser (Indiana University), Mark Krenz (Indiana University), Michael Simpson (Indiana University), John Zage (University of Illinois, Urbana-Champaign), and Sean Peisert (Berkeley Lab; 2023 Annual Challenge Project Lead).

Cyberinfrastructure Vulnerabilities 2022 Annual Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is freely available by subscribing to Trusted CI's mailing list (see below).

We monitor a number of sources for vulnerabilities, then determine which ones are of critical interest to the CI community. While there are many cybersecurity issues reported in the news, we strive to alert on issues that affect the CI community in particular. These issues are identified using the following criteria:

• the affected technology's or software's pervasiveness in the CI community
• the technology's or software's importance to the CI community
• the type and severity of a potential threat, e.g., remote code execution (RCE)
• the threat's ability to be triggered remotely
• the threat's ability to affect critical core functions
• the availability of mitigations

For issues that warrant alerts to the Trusted CI mailing list, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with ACCESS, Open Science Grid (OSG), the NSF supercomputing centers, and the ResearchSOC on drafting and distributing alerts to minimize duplication of effort and maximize benefit from community expertise. Sources we monitor for possible threats to CI include the following:

• OpenSSL and OpenSSH
• US-CERT advisories
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/cybersecurity)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs on Security, SANS Internet Storm Center, and Schneier on Security

In 2022 the Cyberinfrastructure Vulnerabilities team discussed 41 vulnerabilities and issued 29 alerts to 192 subscribers.

You can subscribe to Trusted CI's Cyberinfrastructure Vulnerability Alerts mailing list by sending email to cv-announce+subscribe@trustedci.org . This mailing list is public and its archives are available at https://groups.google.com/a/trustedci.org/g/cv-announce .

If you have information on a cyberinfrastructure vulnerability, let us know by sending email to alerts@trustedci.org .

Trusted CI Webinar: Improving the Security of Open-Source Software Infrastructure, January 23rd @11am EST

Gedare Bloom is presenting the talk, Improving the Security of Open-Source Software Infrastructure, January 23rd at 11am (Eastern).

Please register here.

Remote monitoring and control of industrial control systems are protected using firewalls and user passwords. Cyberattacks that get past firewalls have unfettered access to command industrial control systems with potential to harm digital assets, environmental resources, and humans in proximity to the compromised system. In this talk, I will discuss our approach to prevent and mitigate such harms in scientific industrial control systems by enhancing the security of open-source cyberinfrastructure: the open-source Real-Time Executive for Multiprocessor Systems (RTEMS) real-time operating system and the Experimental Physics and Industrial Control System (EPICS) software and networks. The RTEMS and EPICS software projects are widely used cyberinfrastructure for controlling scientific instruments. This talk will discuss security problems that we have explored with these communities, and examine the salient challenges and opportunities presented by working with open-source communities on their cybersecurity needs.

Speaker Bio:

Gedare Bloom received his Ph.D. in computer science from The George Washington University in 2013. He joined the University of Colorado Colorado Springs as an Assistant Professor of Computer Science in 2019 and Associate Professor in 2022. He was an Assistant Professor of Computer Science at Howard University from 2015-2019. His research expertise is computer system security with emphasis on real-time embedded systems. He has published over sixty peer reviewed articles, serves as a program committee member and technical referee for flagship conferences and journals, and is an associate editor for the IEEE Transactions on Vehicular Technology.

Since 2011 Dr. Bloom has been a maintainer for the RTEMS open-source hard real-time operating system, which is used in robotics frameworks, unmanned vehicles, satellites and space probes, automotive, defense, building automation, medical devices, industrial controllers, and more. Some of his key contributions to RTEMS include the first 64-bit architectural port of RTEMS, design and implementation of a modern thread scheduling infrastructure, support for running RTEMS as a paravirtualized guest for avionics hypervisors, and implementation of POSIX services required to be compliant with the FACE avionics standard. Additionally, he mentors and guides students around the world through learning about and developing with RTEMS. He co-authored the textbook “Real-Time Systems Development with RTEMS and Multicore Processors” published by CRC Press in 2020.

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."