NRAO and Trusted CI Complete Comprehensive Cybersecurity Program Assessment

Trusted CI and the National Radio Astronomy Observatory (an NSF Large Facility supported in part by NSF Award # 1647378) have completed a successful engagement focused on assessing and facilitating the continued maturation of NRAO’s information security program.  On an accelerated schedule to dovetail with NRAO’s budgetary cycle, we completed an intensive fact-finding phase and delivered a draft copy of a recommendations report providing specific, prioritized actions that NRAO could take to bolster their security program.  Before the engagement execution ended, NRAO used our recommendations to gain initial approval for a budgetary proposal to their executive team, proposing the internal restructuring of their team, hiring a new full-time security position, investing in tools to improve network visibility, and identifying key assets that require additional protection.

David Halstead, Chief Information Officer for NRAO, states,

The Trusted CI engagement allowed Information Services to take a holistic view of the risk and threat landscape facing the observatory’s CI instead of the more traditional audits which largely ignore the research infrastructure and focus on the financial systems.

Engagement Process

Fact-Finding. Trusted CI gathered information using a variety of methods, including dynamic question and answer sessions with NRAO staff and through review of over one hundred public and private documents obtained from publicly accessible websites and from NRAO’s internal document repository.  NRAO also completed our rigorous survey assessing the current state of their cyberinfrastructure.  During this phase of the engagement, we held seven one-hour conference calls together, focused mainly on building Trusted CI’s understanding of NRAO’s security program.

Site Visit. The Trusted CI and NRAO teams also met for a period of three days onsite in Charlottesville, Virginia, giving us an opportunity to interact face-to-face.  During that time, we performed a physical walkthrough of NRAO’s onsite computing infrastructure, interviewed personnel with security functions, and held detailed discussions on the current status of the security program as well as possible opportunities for maturation.  When a passing blizzard forced NRAO to close its doors for one of those days, the teams refused to be slowed down and instead met virtually, maximizing the amount of time we could dedicate to working together.

Recommendations Report. The subsequent report that Trusted CI delivered to NRAO first included a set of foundational recommendations.  Recommendations were marked ‘foundational’ if they appeared feasible to begin in the next six months; called for architectural, philosophical, or major resource additions or reallocations; and were expected to generate strong outcomes, particularly in facilitating other impactful actions.  We organized other recommendations by estimated benefit and cost to implement.  Grounded in best practices and community standards, these recommendations frequently referenced the Center for Internet Security (CIS) Controls and the Australian Signal Directorate’s Essential Eight, two evidence-based control sets, as well as Trusted CI’s four pillar framework for developing cybersecurity programs for open science.

Deep Dives. After delivering the final report, we used the remainder of our engagement time to facilitate phone and email discussions focused on implementing these recommendations.  Dr. Jim Basney and Ryan Kiser, Trusted CI subject matter experts in federated identity management and application authorization respectively, each joined for a conference call focused on his area of expertise in order to share insights and answer questions posed by NRAO.  Other topics of conversation included inventory and asset management, network visibility, and Trusted CI’s process and tools for self-assessing gaps and actions under the CIS Controls v7.

Reflections and Acknowledgements

NRAO’s effort and openness were critical to the success of this engagement.  Their willingness to share information, including providing access to NRAO’s internal documents, allowed us to tailor our recommendations to their specific level of maturation in each area.  We would like to thank all of the NRAO staff who spent time talking with us and responding to our questions, especially our primary engagees David Halstead and Pat Murphy, as well as Chris Clark, Karyn Roberts, Derek Hart, Josh Malone, Matthew McCleary, Ferzen Manglicmot, Wolfgang Baudler, Warren Richardson, and Guilhem Werbelow.

NRAO’s commitment extended beyond participation and into implementation, as evidenced by how quickly the organization created a plan based on Trusted CI’s recommendations and moved to enact it.  We are excited to see this engagement already having a major impact on the funding, structure, and visibility of their security program.

We would also like to thank Steven Berukoff and Tony Hays from the Daniel K. Inouye Solar Telescope (DKIST) project for permitting us to share one of their internal network diagrams with NRAO.  Steven and Tony had presented this diagram to us during a prior Trusted CI engagement and agreed to let us share it with NRAO.  Their example of “documentation done well” assisted in facilitating a discussion on the kinds of network documentation most useful from a security and operations support standpoint.

Through interacting with NRAO and learning about their cybersecurity needs, the Trusted CI team continued to refine our understanding of the unique challenges and opportunities involved with securely supporting science.  We look forward to continuing to engage, advise, and grow with the community in this evolving landscape.  For more information on how to work with us, please visit our engagements page.

[This article was edited on 2020-07-14 to replace "application whitelisting" with "application authorization."]

NRAO and Trusted CI Launch Engagement

Trusted CI is pleased to announce the start of an engagement with the National Radio Astronomy Observatory (NRAO), an NSF Large Facility supported in part by NSF Award # 1647378. This engagement is expected to continue through the end of June. Our shared goal for this engagement is to assess and facilitate the continued maturation of NRAO’s information security program, as well as to positively impact its adaptiveness and longevity. We will accomplish this by evaluating their existing policies, practices, and documentation, and providing recommendations for opportunities to strengthen these within the overarching framework of the four pillars of cybersecurity: mission, governance, resources, and controls.

Initially established in 1956, the National Radio Astronomy Observatory is operated under cooperative agreement by Associated Universities, Inc. (AUI). NRAO provides state-of-the-art radio telescope facilities for use by the international scientific community, open to all astronomers regardless of institutional or national affiliation. NRAO also provides both formal and informal programs in education and public outreach for teachers, students, the general public, and the media. Their instruments include the Jansky Very Large Array in New Mexico and the North American component of the Atacama Large Millimeter/submillimeter Array in Chile.

With its latest renewal, NRAO’s mandate is to improve not only the accessibility of its scientific instruments, but also the accessibility of its multi-petabytes of archived observational data for re-processing and re-use beyond the initial intent and audience. NRAO’s revised mission seeks to extend beyond the traditional radio astronomy community into the fields of general scientific endeavor looking at complex molecules in space, real-time events, and the explanation of origins of life, planets, solar systems, galaxies, and the universe.