Introducing the Law and Policy Student Affiliate Program

The CACR-Maurer Student Affiliate program is a collaboration between the IU Center for Applied Cybersecurity Research (CACR), which leads Trusted CI, and the IU Maurer School of Law, wherein law students with a demonstrated interest in privacy and cybersecurity are given an opportunity to work on real world legal problems. The student affiliates work directly with Scott Russell, who is a Senior Policy Analyst at CACR, Trusted CI team member, and a Maurer graduate, and contribute to law and policy guidance materials produced by Trusted CI.

Previous student affiliates have conducted research relating to Controlled Unclassified Information, the EU General Data Protection Regulation, the California Consumer Privacy Act, US Export Control Laws and Regulations, the DoD Cybersecurity Maturity Model Certification, and Artificial Intelligence & Ethics. Materials developed by these student affiliates have directly contributed to guidance materials Trusted CI has created for the NSF science community, including webinars, live presentations, trainings, blog posts, internal whitepapers, and memorandi. 

For the Fall 2020 semester, there will be one student affiliate: Madeline Blaney. Madeline is a second year law student at Maurer and the President of the Maurer Cybersecurity and Privacy Law Association. 

The program is managed by Maurer professor Joseph Tomain, who also manages the Maurer Graduate Certificate in Cybersecurity Law and Policy and the Graduate Certificate in Information Privacy Law and Policy. Student affiliates receive 1 credit hour for participating in the program. Participation in the student affiliate program is typically reserved for students pursuing a Maurer Graduate Certificate in Cybersecurity Law and Policy but is also open to non-certificate students with sufficient background in privacy and cybersecurity law. This is CACR’s fourth semester with student affiliates, building on a long history of collaboration between CACR and Maurer.

CTSC Set to Work with HUBzero

HUBzero, a NSF funded, open source software platform for building powerful Web sites and Science Gateways that support scientific discovery, learning, and collaboration, has requested CTSC expertise in help securing their operational processes.

As HUBzero moves forward, strengthening its software assurance process and its expansion into AWS in order to improve hub instantiation time, adaptability, and to accommodate more projects through lower-cost hub offerings, CTSC will engage with HUBzero to maintain a high level of operational security around hubs, and improve the quality of the underlying HUBzero framework and their content management system (CMS).

CTSC is excited to work with HUBzero in achieving the goals set forth within the engagement, including: developing a Master Information Security Policy and Procedures document in order to define and communicate a coherent, effective security strategy across all of HUBzero's new organizational structure, drafting a Software Assurance and Testing Policy for HUBzero’s developed and/or maintained software, generating a risk-aware workflow for HUBZero’s R&D process, facilitating on-site training to HUBzero staff for secure software engineering, and providing teleconferencing consultation to support HUBzero in their migration to AWS cloud services.

The engagement is scheduled to run until the end of the year.  Upon completion, it is CTSC’s expectation that the processes developed, as well as the insights gained in this engagement will benefit HUBzero directly, improving the quality of the platform for the science that relies upon it.  Additional benefits reaped during the six month period should provide models for dealing with similar challenges now and in the future across many other cyberinfrastructure projects.

Illicit Bitcoin Mining: Prevention, Detection, and Response

Bitcoin mining and NSF computational resources have been in the news lately with the NSF OIG report for March 2014 (p. 29-30) reporting on a user of NSF-funded supercomputers using them illicitly to mine for over $8,000 in bitcoins. A similar story emerged regarding a student at Harvard. Additionally, a report from Iowa State reports intruders using a computer illicitly for bitcoin mining. (For more details about bitcoin mining, see the NSF-funded research from UCSD.)

Assuming you have made the decision to disallow bitcoin mining, addressing unauthorized bitcoin mining is a multi-phase process.

Educating your users that bitcoin mining isn’t allowed is a good first step. Make sure you have a clear acceptable use policy (AUP) that states what computing systems can and cannot be used for. For example, the IceCube AUP states that their resources “are intended to provide computing resources for analysis, processing and filtering, and simulation activities for the IceCube project.” Another, stronger approach is to explicitly ban bitcoin and other crypto-currency mining (for example, see the Heroku AUP).

Second, your users may still misbehave, or you may have unauthorized users compromise your system, so consider implementing rules for an intrusion detection system to detect the mining. Since bitcoin mining requires network traffic, monitoring network traffic can be effective. For example, bro_bitcoin is a module for Bro to detect bitcoin mining on the network.

Finally, consider procedures for what happens if you detect bitcoin mining and successfully mined bitcoins. This is an emerging area and there are no standard practices yet. However, an incident response plan should support effective response to this case, including who should be notified and involved given the fungible nature of bitcoins.