Promoting Research Based Security Collaborations in SURA Institutions

Project Goals: The goals of the project are to gather data, test concepts, and then develop products which are aimed at:

1) a substantial increase in security research funding to SURA institutions; and

2) the identification and dissemination of best practices in securing the IT infrastructures of SURA universities.

Rationale: University security officers and faculty security researchers and security educators could enhance their effectiveness by forming partnerships with each other on their own campuses and at other institutions. Faculty researchers, for example, need testing grounds for their innovations, security educators need to be kept up to date on current security research and practice, and security officers need to bring a research methodology to their campus projects so that they can use the tools of the scientific method as they invest millions of dollars in making their campuses more secure. It is ironic that faculty security educators are teaching classes and workshops to people from outside the campus on good security practice at the same time as security officers struggle with how to educate the university’s faculty, staff and students about good security practice.

The members of each of these groups need to be talking to the members of the other two groups on their own campuses and they need to be current with what is happening in security research, education, and operations on other campuses.

Research grant proposals would be strengthened through partnerships between two or more of these groups on their own campuses and at other universities. Campuses could be made more secure through similar partnerships. And most institutions could save money and time if they knew more about “best practices” in security at other institutions.

Project Activities:

1. Conduct a security survey of the SURA institutions. Use the data to: a.) identify faculty currently engaged in cybersecurity research; b.) identify faculty currently engaged in cybersecurity education; c.) identify the chief security officer at each university; d.) begin to identify best practices in cybersecurity operations at each university.

2. Organize a conference that brings together interested cybersecurity research faculty, cybersecurity education faculty and chief security officers with representatives of the agencies funding cybersecurity research and with selected vendors interested in engaging in research partnerships. At this event: a.) participants would learn about funding opportunities; b.) participants would have the opportunity to initiate discussions on inter-institutional partnerships and inter-functional partnerships; c.) participants would explore the actions SURA might take to facilitate the award of research grants in cybersecurity to SURA institutions or to a consortium of SURA institutions

3. Develop and deliver three products:

1.) an online directory of security resources, including security researchers, security educators, and security officers at SURA institutions.

2.) a database of SURA institution’s best practices in various aspects of university security .

3.) a white paper based on the discussions at the conference that will propose partnerships and strategies to increase security research funding at SURA institutions and will increase the security of SURA institutions.

Project Timeline:

July 2003 Form project committee

August 2003 Preliminary conference planning Hire graduate assistant

September 2003 Reserve dates on calendar of funding agency and SURA Reserve facilities

October 2003 Design and get approval for the security survey Flesh out conference program

November 2003 Conduct survey

December 2003 Survey follow ups Based on survey results, invite the appropriate parties

January 2004 Begin to identify best practices March, 2004 Hold conference week of March 8th-14th Design prototype of best practices website

April 2004 Circulate for comment draft of online directory Circulate for comment draft of best practices website

May 2004 Circulate for comment draft of white paper

June 2004 Publish white paper Best practices web site now operational Online directory now operational

Project Budget: a.) SURA Funded:

$25,000 One (1) graduate student. Stipend plus tuition remission

$ 3,700 Mailings and printing

$ 5,000 Meeting Support Staff

Subtotal: $33,700 b.) CIPP Funded:

$24,000 Transportation 30 people subsidized at $800 each for travel (faculty, SURA staff, WG chair, invited experts)

$ 4,200 Food 50 people (20 pay-their-own-travel) for breakfast, lunch, dinner for two days at SURA per diem rates ($42/day)

$ 1,800 Miscellaneous

Subtotal: $30,000 c.) GMU Instructional Foundation Funded:

$ 9,000 Lodging 30 people @ $150 a night for two nights

$1,000 Miscellaneous

Subtotal: $10,000

Total: $73,700 In-Kind Contributions:

SURA staff will develop and maintain the web sites described in the proposal assuming that the outcomes of the project will provide the web site design and content. SURA will also participate in project and conference planning, implementation, and assessment.

CIPP will participate in project and conference planning, implementation, and assessment. CIPP will provide staff to assist in the writing of the white paper.

GMU will provide staff time to the project, particularly in project leadership, pro-bono conference facilities, television production of some conference events, and network access and facilities for conference attendees.