Trusted CI Webinar Series: Planning for 2020, review of 2019

The 2019 season of the Trusted CI Webinar series has concluded and we are looking forward to the presentations scheduled in the next year.

The following topics and speakers have been booked in 2020 so far:
(Webinars are scheduled the 4th Monday of the month at 11am Eastern time.)

• February 24: FABRIC: Adaptive programmaBle networked Research Infrastructure for Computer science
• March 23: End-to-End Performance and Security Driven Federated Data-Intensive Workflow Management
• April 27: Secure Data Architecture: Assured Mission Delivery Network Framework for Secure Scientific Collaboration
• May 18: The Tommie Science Network
• June 22: The Engagement and Performance Operations Center (EPOC)
• August 24:  Researcher Passport
• October 26: RDP: Enforcing `Security and Privacy Policies to Protect Research Data
• December: Data Integrity, with Trusted CI

We are in the process of booking the remaining spots.  See our call for presentations for more information.

In case you missed them, here are the webinars from 2019:

• January: The Research Security Operations Center (ResearchSOC) with Von Welch and RSOC leadership team (Video)(Slides)
• February: Anticipatory Cyber Defense via Predictive Analytics, Machine Learning and Simulation by Shanchieh (Jay) Yang (Video)(Slides)
• March: The NSF CC-DNI SecureCloud Project: Autonomic Cybersecurity for Zero Trust Cloud Computing with Casimer DeCusatis (Video)(Slides)
• April: REED+: A cybersecurity framework for research data at Purdue University with Preston Smith (Video)(Slides)
• May: Deployable Internet Routing Security with Amir Herzberg (Video)(Slides)
  June: The Trusted CI Framework: Toward Practical, Comprehensive Cybersecurity Programs with the Trusted CI team (Video)(Slides)
• July: Ancile: Enhancing Privacy for Ubiquitous Computing with Use-Based Policy with Jason Waterman (Video)(Slides)
• August: Integrity Protection for Scientific Workflow Data: Motivation and Initial Experiences with Anirban Mandal and Mats Rynge (Video)(Slides)
• September: Jupyter Security at LLNL with Thomas Mendoza (Video)(Slides)
• October: Trends in Global Privacy: GDPR One Year Later with Scott Russell (Video)(Slides)
• December: DDoS Defense in Depth for DNS: Project Overview and Early Results with John Heidemann and colleagues (Video)(Slides)

Join CTSC's announcements mailing list for information about upcoming events. Our complete catalog of webinars and other presentations are available on our YouTube channel.

Trusted CI visits US ARF vessels

The United States Academic Research Fleet (ARF) consists of 18 research vessels organized by University-National Oceanographic Laboratory System (UNOLS). These ships belong to different classes of vessels, from large Global Class vessels to smaller Coastal Class vessels. These ships are owned by NSF and the US Navy; and also by operating institutions. As a part of the Trusted CI engagement with ARF, the five member Trusted CI engagement team traveled to various places where the ships were docked to better understand and observe issues that affect the security of their cyberinfrastructure. Since it was not possible for Trusted CI to visit all the 18 ships, the team decided to see one ship from each vessel class and also took advantage of opportunities that coincided with other travel in order to reduce costs. The observations captured by the team during these trips will be used in their final report to ARF and its stakeholders.

R/V Sikuliaq
Date of Visit: 8th Oct’ 2019
Class: Global Class
Owner: NSF
Operating Institution: 
University of Alaska Fairbanks

R/V Robert Gordon Sproul
Date of Visit: 14th Oct’ 2019
Class: Coastal Class
Owner: University of California
Operating Institution: 
Scripps Institution of Oceanography

R/V Neil Armstrong
Date of Visit: 7th Nov’ 2019
Class: Ocean Class
Owner: Navy
Operating Institution:
Woods Hole Oceanographic Institution

R/V Endeavor
Date of Visit: 8th Nov’ 2019
Class: Ocean Class
Owner: NSF
Operating Institution:
University of Rhode Island













The team would like to thank all of the vessels’ captains, crews, operating institutions and ARF staff for facilitating our visit to the ships. These visits have played a major role in helping us to make recommendations to improve the cybersecurity of the fleet.

Trusted CI Incident Response Report 2019-10-02_01

As I discussed during my presentation at the NSF Cybersecurity Summit in October, Trusted CI inadvertently exposed an embargoed engagee report earlier this year. Our first time doing incident response as a project also revealed some weaknesses in our response planning that could have been problematic for a more serious incident.

With the approval of the impacted engagee, we are now making our internal report on the incident and our plans to improve public. Please find the URL to the report at the bottom of this blog post.

The community’s trust in us is paramount and we hope this transparency helps you maintain that trust in us. We welcome questions and suggestions.

Von Welch, Trusted CI Director


Trusted CI Incident Response Report 2019-10-02_01
Available at http://hdl.handle.net/2022/24845

Report Summary

A Trusted CI engagement report with the Singularity team at Sylabs was inadvertently published prematurely due to miscommunication within the Trusted CI team. A secondary leak was discovered in the resume of a Trusted CI team member and weaknesses were discovered in the incident response process of Trusted CI. This report describes these events and the steps Trusted CI took in responding. An analysis of those events follows along with a set of planned remediations by Trusted CI to avoid a future incident and strengthen Trusted CI’s incident response processes.

Trusted CI Webinar December 9th at 11am ET: DDIDD: Project Overview and Early Results

USC's John Heidemann is presenting the talk, "DDoS Defense in Depth for DNS (DDIDD): Project Overview and Early Results" on December 9th at 11am (Eastern).

Please register here. Be sure to check spam/junk folder for registration confirmation email.

The DDIDD Project (DDoS Defense in Depth for DNS) is applying existing and developing new defenses against Distributed-Denial-of-Service attacks for operational DNS infrastructure. We are building a defense-in-depth approach to mitigate Distributed Denial-of-Service attacks for DNS servers, with approaches to filter spoofed traffic, identify known-good traffic when possible, and employ cloud-based scaling to handle the largest attacks. We are working with USC's B-Root team to test our approaches as a case study, and are making approaches open source as they become available. This talk will summarize the project and our overall approach, provide details about some of our early filters and filter selection, and describe where we plan to go in the remaining year.

John Heidemann is a principal scientist at the University of Southern California/Information Sciences Institute (USC/ISI) and a research professor at USC in Computer Science. At ISI he leads the ANT (Analysis of Network Traffic) Lab, studying how to observe and analyze Internet topology and traffic to improve network reliability, security, protocols, and critical services. He is a senior member of ACM and fellow of IEEE.

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."

Apply by January 17th, 2020 for the Trusted CI 2020 Fellows Program!

Trusted CI’s inaugural 2019 cohort of Fellows was an amazing success with six Fellows from research technologies, astrophysics, criminal justice, network and combinatorial optimization, and computer engineering. We are now pleased to announce the call for applications for our 2020 Trusted CI Fellows. Another cohort of six fellows will receive training from and work closely with Trusted CI to expand their own understanding of trustworthy science and further empower the NSF community to secure its own research.

The deadline for applications is January 17th, 2020. We’ll be hosting a special Trusted CI webinar on the Fellow application process on December 17th at 10am Eastern time. For more information and to apply, please visit https://trustedci.org/fellows/apply

Register for the webinar here: https://iu.zoom.us/webinar/register/WN_nEfmD78RR1ScWDIrpoCaTg

New at the NSF Cybersecurity Summit this year: Jupyter Security Training

Matthias Bussonnier - Photo by Emily Sterneman

 This year at the NSF Cybersecurity Summit, Trusted CI expanded upon its training session offerings with a Jupyter security training/workshop on the first day (afternoon session). This training was led by Matthias Bussonnier (Jupyter Developer Team, UC Merced), Rick Wagner (Globus), Mark Krenz (Trusted CI), and Ishan Abhinit (Trusted CI). Twenty-one people attended the workshop, making it one of the more popular training sessions at the summit this year.

The session started with an around-the-room introduction of attendees and their experiences using Jupyter, including what they knew about Jupyter security and what they were hoping to get out of the workshop. Most attendees had little-to-no experience with Jupyter and were curious to learn more about  deploying and securing Jupyter. This was especially valuable information to Matthias to better help the development team understand the different scientific communities using Jupyter. The room seemed to be balanced between attendees from Information Technology and Research, which is a sign that Jupyter is more and more used and deployed at scale in various institutions.

The next 30 minutes were devoted to helping the audience understand Jupyter and its software landscape: notebooks, notebook server, IPython, JupyterHub, etc. This included an overview of Jupyter architecture, nomenclature where things run and how they communicate, the Threat Model, examples of attacks, and how to secure an installation.

This was followed by a hands-on exercise where Rick demonstrated how to access a remote Notebook Server and set up a JupyterHub instance using a default configuration. Then attendees learned to observe and secure components and their interactions one by one. Rick and Matthias ended the session by answering the questions attendees had asked at the beginning, defining Jupyter security best practices, and giving an overview of what can be done to improve security in the Jupyter Community. The slides from the workshop are available here. The group will be looking for ways to provide this training at future events.

According to Matthias, this was the first ever security focused training workshop on Jupyter; and the feedback from the first group of attendees will inform the shape this training will take in future iteration.

Trusted CI activities at SC19

Members of Trusted CI will be attending SC19 (November 17-22) in Denver. SC is the International Conference for High Performance Computing, Networking, Storage, and Analysis. The conference includes a technical program of talks, tutorials, exhibitions, posters, birds of a feather, awards, etc. Below is a list of Trusted CI member activities, booth assignments of Trusted CI organizations, and activities of our partner projects. Stop by and see us!

Trusted CI Member Activities:

• Barton Miller & Elisa Heymann are presenting a training, "Secure coding practices and automated assessment tools" (description) (preview)
• Barton Miller is also presenting a paper, "Diogenes: Looking for an Honest CPU/GPU Performance Measurement Tool"
• Von Welch is presenting at the IU booth 643 Tuesday at 11am
• Trusted CI Advisory Committee meeting Tuesday
• Jim Basney at the NCSA booth 714 Wednesday at 10am
• Dana Brunson is participating in a panel and a BOF, both on research computing
• Florence Hudson is participating in a panel on computation and health, and in a BOF on HPC education, outreach, and training

Trusted CI Organization Booths at SC19:

• Indiana University: Booth 643
• NCSA: Booth 714
• PSC: Booth 825
• Internet2: Booth 1281
• UW Madison: Booth 272
• Berkeley Lab: Booth 925

SC Activities of our partner projects that may interest you:

• Science Gateways Community Institute
• Open Science Grid
• XSEDE
• Software Sustainability Institute
• Internet2
• ResearchSOC