Globus and CTSC engagement: data sharing

CTSC and Globus recently completed an engagement in which CTSC took a close look at the Globus data sharing feature. As many in the NSF community already know, Globus provides both services and applications that try to make it easier for scientists to focus on their science. One key Globus service is data management, especially the movement of files between two endpoints, e.g. between two users’ personal computers, between a user’s computer and a large institutional storage site, or between two other endpoints. In addition to an explicit data copy between endpoints, Globus also has a data sharing feature in which a user can make an entire folder accessible (read/write) to other Globus users. CTSC performed an assessment of this particular feature of Globus. The assessment covered a review of the design, architecture, and high-level implementation of the sharing feature. It was not a code review; however, the CTSC team did perform a source code installation of a Globus Connect Server, with the sharing feature enabled, and analyzed how credentials were being handled and how log files were being generated. While the assessment did not reveal any high security risks for the data sharing feature, CTSC did make a number of recommendations to address low-to-medium risks. These recommendations included improving the documentation, for both system administrators and users, and improving the logging and monitoring of sharing activity.
An ongoing challenge in such assessments of software features is the lack of clear process for doing the assessment, as the question is more one of “is this doing the right thing” without clear definition of what “the right thing” is (a challenge we also tackled in our engagement with Pegasus WMS). For this engagement we utilized a modified set of principles originally put forth by Saltzer and Schroeder in 1975 on the protection of information systems, to help guide our assessment. We think utilizing the principles helped significantly and plan to continue exploring their use in future engagements.
For more information, please see the Globus-CTSC Engagement final report, available at http://hdl.handle.net/2022/19165.
We want to thank the Globus team, especially Rachana Ananthakrishnan, Mike Link, and Steve Tuecke, for their helpful collaboration on this engagement.
See how CTSC might engage with you and your NSF project at http://trustedci.org/howwehelp/.

Join CTSC! Analyst position open at IU CACR

IU/CACR has a position open for a analyst to join the CTSC team. This is an opportunity to join a team of smart, talented folks working on securing NSF computational science. Please apply via the prior link or contact Von Welch if interested.

Shutting down trustedci.groupsite.com June 1st, 2015

For the past couple of years, we've operated trustedci.groupsite.com as forum for conversations and announcements about CTSC and cybersecurity for CI.  Based on the feedback we've gotten, it seems trustedci.groupsite.com isn't clicking with people as a way for communication. Since creating it, we've also established a set of email lists for discussions about cybersecurity and CI at http://trustedci.org/ctsc-email-lists/.

Since it's costing a small, but non-trivial amount of money to operate the trustedci.groupsite.com service, we're going to shut it down on June 1, 2015.

We hope you'll subscribe to one or more of the email lists at http://trustedci.org/ctsc-email-lists/. If you have other suggestions for how you'd like to communicate with CTSC or your peers working on cybersecurity for CI, please let us know.

Von, for the CTSC team

2014 NSF Summit Report Published

The Report of the 2014 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure is available for download at http://trustedci.org/2014summit/. Many thanks to our colleagues who helped us document this community event and those who contributed white papers.

We'll be using the findings and recommendations, in part, to drive planning for the 2015 summit, to be held at the Westin Arlington Gateway, August 17 - 19.

Security for Software Cyberinfrastructure

NSF's CIF21 Software Vision (NSF 12-113) recognizes that "software is a critical and pervasive component of cyberinfrastructure for science, engineering, and education" and that cyberinfrastructure (CI) software "must be reliable, robust, and secure." What are community best practices for developing reliable, robust, and secure software, and what unique challenges do NSF CI software development projects face?

CTSC will be exploring this topic over the coming months by supplementing CTSC’s existing training materials on secure coding practices with guides that cover additional security topics throughout the software development lifecycle, such as:

• identifying security objectives and addressing security threats during the software design phase to avoid patching for security issues later in the process
• software release engineering to support the integrity and maintenance of deployed software, including security hygiene for developers to safeguard credentials and revoke credentials if compromised
• vulnerability handling processes and software update mechanisms to address software vulnerabilities when they occur
• software maintenance and dependency management for keeping up-to-date on security standards and fixes

We welcome your input and questions as we develop materials (and gather pointers to existing materials) on these topics. Please join the discussion on the CTSC Security Discussion email list.

Cybersecurity at SC14

CTSC team members will participating in a variety of activities at SC14 open to any attendee.

On Tuesday from 2-4pm in Von Welch is organizing a MAGIC meeting in room 204 focusing on international issues in identity management. Speakers include Ann West on “InCommon and International Interfederation”, Harold Teunissen providing an update on identity management in the EU, Tom Barton on “Federated Security Incident Response”, and Nick Jones providing an update on identity management in New Zealand.

On Tuesday from 4-4:30pm, Von Welch will be in the Indiana University booth (1339) presenting on "Cybersecurity for Science."

On Wednesday from 3-4pm and Thursday from 1-2pm, join Adam Slagell and Jim Basney in the NCSA booth (1621) for an informal discussion of cybersecurity at NCSA, including the activities of the Bro Network Security Monitor and CILogon federated identity management projects.

Feel free to contact any CTSC team member directly to chat as well.

New CTSC Cybersecurity Plan published

About a year ago, CTSC published it's own cybersecurity plan. As part of that plan, the plan itself receives an annual review. That review has been completed and version 2.0 of the plan and supporting documents have been published on CTSC's website. The supporting documents include an analysis via Attack Trees, a System Characterization, and a Threat Assessment.

While all these document receives some updates, the updates in the main version 2.9 Policies and Procedures document were:

• Minor changes for clarity.
• Added clause that Google accounts used to access Google drive are used exclusively by a CTSC staff member.
• Added Section 6 on Revocation of Access
• Changed “private” information to “engagement-related” information.
• Labeling of sensitive information only required “whenever feasible.”
• Removed requirement for encryption of sensitive data at rest due to complexity of implementation in a group setting.
• Added annual review of Google account and domain in which CTSC documents reside.

We've learned a lot about developing cybersecurity plans for NSF CI projects over the past two years and when we revise the plan again in 2015, we will use our Guide to Developing Cybersecurity Programs for NSF Science and Engineering Projects as the basis.