Trusted CI Completes Engagement with the Environmental Data Initiative

The Environmental Data Initiative (EDI) (NSF DBI-1565103, NSF DEB-1629233) is an NSF-funded project accelerating curation and archival of environmental data with emphasis on data from projects funded by the NSF Division of Environmental Biology. Trusted CI's engagement with EDI began August 2018 and concluded December 2018. The engagement report is available at https://hdl.handle.net/2142/101921.

The engagement focused on Identity and Access Management (IAM) issues associated with the data repository API software PASTA+ (Provenance Aware Synthesis Tracking Architecture - Plus). Authenticated access to the data repository is currently performed by binding username and password to an LDAP server. While the current LDAP authentication implementation is functional, authorization is tightly coupled to the user identifier rather than LDAP groups. EDI staff are interested in moving away from the current LDAP authn/authnz implementation toward a more modern solution, with an emphasis on maintaining the current access control rule schema.

With this goal in mind, Trusted CI staff spent considerable effort in examining the current authn/authz implementation and how it could be updated to use current standards such as OAuth 2.0 / OpenID Connect (OIDC). Trusted CI staff concluded the engagement by presenting four available OAuth2/OIDC providers, as well as two potential group management solutions which could be used for authorization. Step-by-step tutorials were written detailing how to configure each solution as well as sample implementation code in several programming languages.

The need for modern, standards-compliant authentication and authorization systems is common across cyberinfrastructure projects, so the tutorials developed during this engagement have been made available at https://trustedci.org/iam for broader community use.

Cyberinfrastructure Vulnerabilities 2018 Q4 Report

The Cyberinfrastructure Vulnerabilities team provides concise announcements on critical vulnerabilities that affect science cyberinfrastructure (CI) of research and education centers, including those threats which may impact scientific instruments. This service is available to all CI community members by subscribing to Trusted CI’s mailing lists (see below).

We monitor a number of sources for software vulnerabilities of interest. For those issues which warrant alerts to the Trusted CI mailing lists, we also provide guidance on how operators and developers can reduce risks and mitigate threats. We coordinate with XSEDE and the NSF supercomputing centers on drafting and distributing alerts to minimize duplication of effort and benefit from community expertise.Some of the sources we monitor for possible threats to CI include:

• OpenSSL, OpenSSH, and Globus project and security announcements
• US-CERT advisories
• XSEDE announcements
• RHEL/EPEL advisories
• REN-ISAC Alerts and Advisories
• Social media, such as Twitter, and Reddit (/r/netsec and /r/security)
• News sources, such as The Hacker News, Threatpost, The Register, Naked Security, Slashdot, Krebs, SANS Internet Storm Center and Schneier

In 4Q2018 the Cyberinfrastructure Vulnerabilities team issued the following 4 vulnerability alerts to 108 subscribers:

• VMware Vulnerability (CVE-2018-6983)
• Apache Struts 2.3.x RCE Vulnerability When File Uploads Are Enabled
• VMware Vulnerability (CVE-2018-6974)
• Drupal - Multiple Vulnerabilities (SA-CORE-2018-006)

If you wish to subscribe to the Cyberinfrastructure Vulnerability Alerts mailing list you may do so through https://list.iu.edu/sympa/subscribe/cv-announce-l. This mailing list is public and the archives are available at https://list.iu.edu/sympa/arc/cv-announce-l.

If you believe you have information on a cyberinfrastructure vulnerability, let us know by sending us an email at alerts@trustedci.org.

Report on the 2018 NSF Cybersecurity Summit

The 2018 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure, a platform where communities with interest in supporting NSF science projects collaborate to address core cybersecurity challenges, took place August 21st - August 23rd in Alexandria, VA. One hundred seventeen community individuals, representing fifty-five NSF-funded projects, attended the summit. A summary of the event, as well as a detailed account and the culmination of the community members’ collaborative ideas, were captured in Report of the 2018 NSF Cybersecurity Summit for Cyberinfrastructure and Large Facilities, now available at http://hdl.handle.net/2022/22588.

The summit serves as a valuable means for securing NSF scientific cyberinfrastructure (CI) and increasing trust in the science it supports by providing a forum for education, sharing of experiences, and community building. It presents an excellent opportunity to highlight cybersecurity challenges to NSF program officers, leadership, and stakeholders, along with providing basic cybersecurity awareness and education. The summit also presents an opportunity for Trusted CI to gain insight into the needs, concerns, and challenges facing the community.

In the course of the plenary, attendees at the summit, over half having not attended the summit in 2017, discussed and debated cybersecurity best practices. Within that process, future challenges for the NSF community were identified, including:

• NSF Large Facilities and cyberinfrastructure members could benefit from stronger trust communities in order to share sensitive security information. This requires re-evaluating how current trust relationships are established, as well as how information is shared between community members.
• The human factor in security events is still continually overlooked. The community needs to better understand the interaction between humans and security, and to explore the possibility of users taking a larger role in security solutions.
• Cybersecurity needs positive or proactive metrics, as opposed to presenting negative events and the risks associated with the lack of cybersecurity. Historically, the efficacy of security mechanisms has been presented in terms of attacks thwarted, e.g., the firewall has blocked n malicious packets, rather than in terms of positive productivity, e.g., n users accessed the database without complications. 

Along with the plenary, which consisted of two days of presentations, panels, and keynotes that focused on the security of cyberinfrastructure projects and Large Facilities, a full day of training was held on the first day. The summit’s training day featured focused workshops, including a full day workshop by the WISE (Wise Information Security for collaborating E-infrastructures) Community (https://wise-community.org/).

Based on the received summit evaluations and feedback, the attendees expressed overwhelmingly positive and constructive feedback. Stay tuned for more information regarding future summits.

What Do Research Computing and Information Security Leaders Have in Common?

In September, Trusted CI and Internet2 co-hosted the “Enabling Trustworthy Campus Cyberinfrastructure for Science” workshop at the University of Maryland. This workshop brought together 37 invited leaders in research computing and information security from 18 institutions to explore challenges that exist between research computing and information security groups.

A blog post on the outcomes of that workshop is now available on the Internet2 blog: https://www.internet2.edu/blogs/detail/16960

Save the Date:2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure-Oct 15-17, 2019

Please mark your calendar for the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure, planned for October 15-17, 2019, in San Diego, CA.

Stay tuned for more information by following the Trusted CI Blog (http://blog.trustedci.org/) & Twitter feed:  https://twitter.com/trustedci/

Information on prior summits is available at http://trustedci.org/summit/.

CCoE Webinar Series: Looking toward 2019, review of 2018

The 2018 season of the Trusted CI Webinar series has concluded and we are looking forward to the presentations scheduled in the next year.

The following topics and speakers have been booked in 2019:
(Webinars are scheduled the 4th Monday of the month at 11am Eastern time.)

• January 28th: The Research Security Operations Center (ResearchSOC with Von Welch and RSOC leadership team
• March 25th: SecureCloud with Casimer DeCusatis
• April 22nd:  Supporting Controlled Unclassified Information with a Campus Awareness and Risk Management Framework with Justin Yang and colleagues
• May 27th: Robust and Secure Internet Infrastructure for Scientific Collaboration with Amir Herzberg
• June 24th: The Trusted CI Framework: An Architecture for Cybersecurity Programs with Trusted CI
• July 22nd: Campus Infrastructure for Microscale, Privacy-Conscious, Data-Driven Planning with Jason Waterman
• August 26th: Pegasus and IRIS with Anirban Mandal
• December 9th: The DDIDD project with John Heidemann and colleagues

We still have openings for the months of February, September, and October.  See our call for presentations for more information.

In case you missed them, here are the webinars from 2018:

• February: SMARTDATA Blockchain with Murat Kantarcioglu (Video)(Slides) 
• March: Data Quality & Security Evaluation Framework Dev. with Leon Reznik & Igor Khokhlov (Video)(Slides)
• April: Toward Security-Managed Virtual Science Networks with Jeff Chase and Paul Ruth (Video)(Slides)
• May: General Data Protection Regulation (GDPR) with Scott Russell (Video)(Slides)
• June: Security Program at LSST with Alex Withers (Video)(Slides) 
• July: Trustworthy Computing for Scientific Workflows with Mayank Varia and Andrei Lapets (Video)(Slides)
• August: NIST 800-171 Compliance Program at University of Connecticut with Jason Pufahl (Video)(Slides)
• September: SCI Trust Framework with David Kelsey (Video)(Slides)
• October: Urgent Problems and (Mostly) Open Solutions with Jeff Spies (Video)(Slides)
• December: December ’18: Best Practices for Academic Cloud Service Providers with Rion Dooley (Video)(Slides)

Join CTSC's announcements mailing list for information about upcoming events. Our complete catalog of webinars and other presentations are available on our YouTube channel.

Trusted CI Webinar December 10th at 11am ET: Security Best Practices for Academic Cloud Service Providers with Rion Dooley

Rion Dooley is presenting the talk "Security Best Practices for Academic Cloud Service Providers" on Monday December 10th at 11am (Eastern).

Please register here. Be sure to check spam/junk folder for registration confirmation email.

A “cloud resource” provides a hosted, self-service means for users to run virtual machines or containers such that they can have a custom software stack and isolation from other users. Virtual machines or container images can be curated and provided by the cloud resource operator, provided by the user, or provided by third parties.

Operating a cloud resource involves addressing security requirements of multiple stakeholders: those of the resource operator and those of the resource user.  These parties may have different incentives related to security as well as different levels of acumen. Operators may at times run images whose trustworthiness is not established and grant users privileged access within their running image that would be uncommon on non-virtualized computing resources.  Moreover, users, with their elevated privileges, can misconfigure services, expose sensitive data or choose protocols/solutions that offer less security for the sake of installation or operating costs. These factors can lead to an environment that, by its nature, is difficult to secure.

A community consisting of The Agave Platform, Cornell University Center for Advanced Computing, CyVerse, Jetstream and Trusted CI collaborated in authoring a set of Security Best Practices for developing in, and operating an academic cloud resource.  

In this webinar, we will discuss the nine use cases they deemed most important to academic cloud services.

This webinar will be relevant to cloud users, evangelists, and providers. All are encouraged to join and contribute to the conversation.

The full white paper is available online at http://hdl.handle.net/2022/22123.

Speaker Bio:
Rion Dooley is the Director of Platform Services and Solutions at Data Machines Corp. He has 15 years experience integrating emerging tech with HCP environments to build solutions that make it easier to conduct open, digital science. His prior research includes projects in the areas of cloud computing and security. He serves as PI for the Agave Project, and is active in the Open Source community.

Presentations are recorded and include time for questions with the audience.

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."