NSF Webinar on CICI, other solicitations: March 3rd, 11am-2pm ET

NSF will be hosting a webinar on the recent Cybersecurity Innovation for CyberInfrastructure solicitation as well as other solicitations on March 3rd from 11am-2pm EST. See http://www.nsf.gov/events/event_summ.jsp?cntn_id=137798&org=CISE for more details.

Gemini Observatory-CTSC Engagement a High Point for Both Organizations.

Gemini Observatory and CTSC have wrapped up an intensive engagement that both trudged through the trenches of policy development and literally took CTSC personnel to new heights.  In the late Fall and early Winter of 2015/2016, CTSC and Gemini executed an engagement plan focused on core policy processes and documentation, as well as a close unified look at ICS/SCADA, technical, and physical controls at Gemini North.

The engagement’s policy work focused on initiating a draft Policy Development Protocol, and updating Gemini’s core policy documentation (e.g., beginning a Master Information Security Policy and revising Gemini’s AUP).  CTSC gave feedback on existing documentation, advice on the policy development lifecycle, and guidance on how best to utilize CTSC’s policy templates.  Gemini developed a priority list and timeline for the development/revision and implementation of these and additional policies.

CTSC staff performed a site visit to the Gemini North facility to inform detailed recommendations for improving the physical security and technical security of instrument and industrial control / SCADA systems critical for Gemini’s scientific mission. The visit included inspection tours of the base facility in Hilo, the mid-point facility at Hale Pohaku, and the actual telescope atop Maunakea at 14,000 feet. CTSC interviewed eight Gemini staff members concerning IT support, physical security, ICS/SCADA systems, MS Windows security, web application development, and operational application support. CTSC conducted a physical penetration test of the Base facility, which was thwarted an attentive Gemini staffer. The depth and breadth of this fact-finding mission enabled CTSC to produce a report providing detailed recommendations for enhancements to both physical security and cybersecurity from an on-the-ground point of view.

Gemini’s openness and commitment to this engagement made this a huge learning experience for CTSC.  We were able to closely observe how a facility can effectively incorporate security initiatives into long term project management processes. The site visit enabled fact gathering at a level of detail that allowed CTSC to produce one of its most specific, tailored reports to date.  We’ve learned a great deal from all our Large Facility engagements; this was a truly special hand’s on, collaborative experience.

The CTSC team deeply appreciates the time and effort Tim Minick and Chris Morrison dedicated to this engagement, as well as the welcoming and forthcoming attitudes of all the Gemini staffers who met with our team at Gemini North.

CTSC Collaboration with CICI Projects

NSF has released the 2016 Cybersecurity Innovation for Cyberinfrastructure (CICI) solicitation. As the Cybersecurity Center of Excellence (CCoE) funded under the 2015 CICI solicitation, CTSC is undertaking the following activities on which we invite current and proposed CICI projects to collaborate:

• Situational Awareness: As a CCoE, we will formalize the community notification process we have already begun under CTSC and provide a Cybersecurity Situational Awareness service for the NSF community. We will distribute vulnerability and other cybersecurity information to the NSF community, tailored for cyberinfrastructure, and CICI projects are welcome to disseminate our notifications to their communities and contribute to the information.
• Cybersecurity Program Guide: The Guide to Developing Cybersecurity Programs for NSF Science and Engineering Projects is available to help guide you in working with NSF projects in establishing cybersecurity programs.
• Training: CTSC has developed training materials tailored for the NSF community that we encourage you to use. We can also provide training ourselves as our schedule and travel budget allows.
• Monthly Online Webinars and Chats: As a CCoE, we will host monthly online webinars and chats (similar to the IAM Online series hosted by InCommon). We are happy to invite CICI awardees to present their work.
• Best practices on Reviews and Engagements: For Regional Cybersecurity Collaborations we are happy to share our experiences and lessons learned in collaborating with NSF projects to address their cybersecurity challenges. Lessons to-date can be found in our reports to NSF.

If you have questions on these topics or other suggestions for collaboration with your existing or proposed CICI project, please contact us.

CTSC funded as the NSF Cybersecurity Center of Excellence

We're pleased to announce that CTSC has been funded for the next three years as the NSF Cybersecurity Center of Excellence. Ensuring scientific computing remains trustworthy and uncorrupted is essential in protecting the nation’s science. In its role as a Cybersecurity Center of Excellence, the CTSC will provide readily available cybersecurity services tailored to the NSF science community.

These resources will include leadership and coordination across organizations, and education and training to expand the pool of available cybersecurity expertise.

"NSF-funded cyberinfrastructure presents unique challenges for operational security personnel and impacts other important areas of research affecting society, including ocean sciences, natural hazards, engineering, biology and physics," said Anita Nikolich, cybersecurity program director at the NSF's advanced cyberinfrastructure division. "Organizations that host cyberinfrastructure must find the right balance of security, privacy and usability while maintaining an environment in which data are openly shared. Many research organizations lack expertise in technical and policy security and could benefit from an independent, shared security resource pool."

The CTSC will collaborate directly with NSF-funded research organizations to address their cybersecurity challenges and provide forums for cybersecurity collaboration across organizations. For example, Jim Basney of the National Center for Supercomputing Applications will lead CTSC support activities on the topic of identity and access management for research organizations. The CTSC will also convene an annual NSF Cybersecurity Summit, led by James A. Marsteller, security officer at the Pittsburgh Supercomputing Center, to share experiences, provide training and discuss cybersecurity challenges.

"Cybersecurity is no longer solely a technical matter -- it's a critical part of any organization’s risk management," said Von Welch, director of IU's Center for Applied Cybersecurity Research. "Addressing the risks to computational science requires a comprehensive understanding of research and the threats it faces. Many of these threats are those faced by any other organization on the Internet, but others are unique to the science community with its collaborative nature and use of high-end information technology and cyberinfrastructure."

An example of a safeguard the CTSC will promote is software assurance, with experienced, respected names in that field such as Barton Miller, a professor at the University of Wisconsin-Madison offering expertise to reduce the risks of vulnerabilities and breaches for researchers.

Additionally, the CTSC will collaborate with the U.S. Department of Energy’s Energy Science Network, or ESnet, to develop a threat profile for open science.

"The Department of Energy and NSF enable scientific discovery in a range of domains critical to our nation's future," said Greg Bell, director for ESnet and division director at the Lawrence Berkeley National Laboratory. "Working together to understand cybersecurity threat models shared by these collaborations is an important step forward for the two agencies, and ESnet is delighted to be collaborating on this effort."


News coverage:

• IU leads $5 million collaborative grant for NSF-funded Cybersecurity Center of Excellence (IU release) (Inside IU)
• UW-Madison part of $5 million grant to safeguard NSF research (UW-Madison release)
• $5-million Collaborative Grant Establishes NSF-funded Cybersecurity Center of Excellence (PSC release)
• $5M Collaborative Grant Establishes NSF-Funded Cybersecurity Center of Excellence (http://myinforms.com/)
• IU to Lead $5M Cybersecurity Center (insideindianabusiness.com)
• Center for Trustworthy Scientific Cyberinfrastructure to provide Cybersecurity Services Tailored to NSF Community (Scientific Computing)
• Indiana University gets $5M to lead cybersecurity center (Lexington Herald Leader)
• Indiana University gets $5M to lead cybersecurity center (Herald Times)
• Indiana University To Lead Cybersecurity Collaboration (WFYI)
• Pittsburgh Supercomputing Center part of group receiving $5M National Science Foundation grant (Pittsburgh Business Times)
• IU Receives $5 Million For Cybersecurity (Indiana Public Media)
• NSF on Twitter
• IU nets $5M grant for NSF cybersecurity initiative (ecampusnews.com)
• NCSA CyberSecurity Team Awarded NSF Grants (HPCWire)
• UW Included In Cybersecurity Grant To Protect Scientific Data (Wisconsin Public Radio)
• NSF Awards $5M to Establish Cyber Center; Anita Nikolich Comments (executivegov.com)
• NSF Gives $5 Million Boost to Cybersecurity Research (sourceforge.net)

CTSC Risk Assessment of NEON

The National Ecological Observatory Network (NEON) is a nationwide network of ecological sensors and observation facilities sponsored by the National Science Foundation (NSF) to gather and synthesize data on the impacts of climate change, land use change, and invasive species on natural resources and biodiversity. NEON collects data from over 80 land and water based sites across the United States and standardizes this data for use by scientists.

CTSC, in collaboration with the NEON team, performed a cybersecurity risk assessment on the NEON network of sensors and data servers. The results of this assessment will be used to develop a cybersecurity plan for the NEON project. The engagement commenced in March 2015 and was completed in August 2015. CTSC personnel conducted this review using CTSC assessment methodologies designed to fit the scope and objectives of the review. CTSC personnel interacted closely with NEON personnel to perform this engagement.

The goals for the collaboration with NEON were to:

• generate a list of threats, vulnerabilities, estimates for likelihood, and impacts;
• review and prioritize these lists into risks; and
• generate a high level cybersecurity plan for NEON's Airborne Observation Platform (AOP) and CyberInfrastruture (CI).

The engagement began with a CyberCheckup to get a rough assessment of the status of NEON cybersecurity. NEON staff reviewed "Securing Commodity IT in Scientific CI Projects" to see how well the recommended controls were applied to NEON's systems. The areas reviewed included policies and procedures, host protection, network security, physical security, and monitoring and logging. The results of this quick survey led to a more detailed Risk Assessment and Security Planning effort.

The formal Risk Assessment of NEON identified issues which are being addressed through NEON policies and implementation of formal operational processes and procedures. Other issues can be addressed by utilizing software solutions such as monitoring and vulnerability scanning software.

Working closely with the NEON team, CTSC concluded the risk assessment, transferred the skill of performing future iterations of the risk assessment, and assisted the NEON team in documenting recommended cybersecurity controls that, when implemented, will mitigate the current level of risks for NEON. Considering that full operation of the NEON network is planned by 2017, an effective security strategy is critical to protecting and isolating data from external and internal threats.

Help us select dates for the 2016 NSF Cybersecurity Summit!

http://doodle.com/poll/3xq7aguvytg2vvnm

CTSC is working to identify a three day period in August 2016 for the next NSF Cybersecurity Summit. We've heard the community's feedback and are trying to secure a Tuesday-Thursday event at our preferred venue to help folks avoid weekend travel. As of today, we have three options available to us. We'll keep this poll open for one week. 

 If you anticipate trying to attend the 2016 summit, please let us know your preferences!

(Feel free to identify yourself, your project, or your favorite superhero when you vote.  One vote per individual please.)

CTSC Year 3 Report Published

CTSC's Year 3 report, covering activities from October of 2014 through September of 2015, has been accepted by NSF and is available online at http://trustedci.org/reports.