cybersecurity for science
TRANSCRIPT
Cybersecurity for Science!
Von Welch!Indiana University!
Director, CACR !PI and Director, CTSC!
Advancing Research Computing on Campuses: Best Practices Workshop!Keynote"
March 18th, 2015"
Center for Trustworthy Scientific Cyberinfrastructure"
TrustedCI.org!!
Increase the NSF community’s understanding of cybersecurity for science, and advance its implementation.!
!!
Three-year project funded by NSF ACI.!!
Cybersecurity Historically!
Firewalls, IDS,
encryption, logs, passwords, etc.!
!Not a language that inspires the
science community "
(or many others).!
Contemporary Cybersecurity!
Cybersecurity supports the
organization’s mission by
managing risks to science.!
For science projects, mission = science!
Trustworthy Science!
Integrity of data and
computation are critical to maintaining the trust of scientists
and the public in CI.!!
Scientists have been managing the ultimate insider threat, Bias,
for a long time.!
Do No Harm!
CI represents some impressive cyber-
facilities.!!
Being used as a tool to harm others would be
very damaging to one’s reputation.!
Collaboration:""
Trust is key!
Identity Matters to Science…!
Scott Koranda/LIGO -‐ Oct’11
Specific Concerns!
Many science domains, communities, and
projects have particular concerns.!
!The risks related to
confidentiality, integrity, and availability vary
greatly, and go by their own nomenclature.!
Cyberinfrastructure!
Scientific Community"
Multiple Universities
and/or Research
Orgs"
Regional R&E and
Commercial Services"
Open Source and Scientific
Software"
R&E Networks,"
IRNCs,"Science DMZs"
… Services, Risks, Policies"
Requirements, Risks"
Cyberinfrastructure
PCs/Mobile
HPC
HTC
HPSS
Instruments
Science Data
Servers
Portals
Commodity Unique
Satellite Links
HPN
Science DMZ Cloud
Data Subjects
Putting it all together…
Cybersecurity for Science:"A Hybrid Approach!
Foundation of baseline security practices.
Risk management tailored to science risks, CI and desired maturity levels.
All with sufficient guidance and examples so projects can implement without undo distraction from their science mission.!
Risk Management For Science
So, what are we doing about
the weather?
CTSC Activities!
Engagements!LIGO, SciGAP, IceCube, Pegasus, CC-NIE peer reviews, DKIST, LTERNO, DataONE, SEAD, CyberGIS, HUBzero, Globus, LSST, OOI, NEON."
Education and Training!Guide to Developing Cybersecurity Programs for NSF Science and Engineering Projects, Securing Commodity IT in Scientific CI Projects, Baseline Controls and Best Practices, Training for CI professionals."
Leadership!Organized 2013, 2014 & 2015 Cybersecurity Summits for Large Facilities and CI, vulnerability awareness, Cybersecurity for Large Facilities Manual."
Match Making!
We match projects to exisDng
cybersecurity resources and technologies.
Peer Reviews!
CTSC-‐coordinated pair of CC-‐NIE awardees in 2014, another pair planned for 2015. Process would allow for scalability to more projects than any center could engage.
Image credit: Kevin Thompson/NSF
Cybersecurity Program Guide!
Baseline pracDces and risk management, tailored for science projects with guidance and templates.
Please Join Us!!
!2015 NSF Cybersecurity Summit for !
Large Facilities and Cyberinfrastructure.!!
August 17-19, 2015. Arlington, VA!!!
Details and CFP coming soon at trustedci.org!
CAMPUS CYBERSECURITY FOR RESEARCH?!
Cyber- security
Research
Personal Health Information
State of Affairs today…!
Campus Cybersecurity for Science?!
Some CoTS campus cybersecurity services can be useful to projects – e.g. web app scanning. Understanding the language and risks of science takes Dme – can we get security offices that Dme? Support science with federated IdM – release aUributes to Research & Scholarship (R&S).
In conclusion…!
Cybersecurity for science is about managing risks for science -‐ it takes listening and translaDon. CTSC is leading the NSF community in increasing its understanding of cybersecurity for science, and advancing its implementaDon. Let’s figure out how we can work together.
trustedci.org @trustedci