The Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure October 15-17, 2019 Catamaran - San Diego, CA https://trustedci.org/2019-nsf-cybersecurity-summit/ Acknowledgements The Summit would not have been possible without the commitment and dedicated work of many individuals. The organizers wish to thank all those who attended the Summit. Special gratitude goes to all who responded to the CFP, spoke, provided training, and actively participated, including the 2019 Program Committee (highlighted in Section 3), without whom the event would not have been as successful. Our sincere thanks goes to the National Science Foundation and Indiana University’s Center for Applied Cybersecurity Research for making this community event possible. This event was supported in part by the National Science Foundation under Grant Number 1547272. Any opinions, findings, and conclusions or recommendations expressed at the event or in this report are those of the authors and do not necessarily reflect the views of the National Science Foundation. About this Report This document is the product of Trusted CI: The NSF Cybersecurity Center of Excellence and was supported by the National Science Foundation under the grant - ACI-1547272. Citing this Report Please cite as: Andrew Adams, Kay Avila, Kathy Benninger, Jeannette Dopheide, Mark Krenz, James Marsteller, and John Zage. Report of the 2019 NSF Cybersecurity Summit for Cyberinfrastructure and Large Facilities: http://hdl.handle.net/2142/105533. License This work is made available under a Creative Commons Attribution-ShareAlike 4.0 International license (https://creativecommons.org/licenses/by-sa/4.0/). For the latest information on the Summit, please see: https://trustedci.org/summit/ Title: Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure 1 Distribution: Public Table of Contents Executive Summary 4 1 Summit Session Summaries 6 1.1 Presentations 6 1.2 Panels 13 1.3 Lightning Talks 14 1.4 Table Talks 17 1.5 Project Showcase 18 2 Common Themes and Challenges 18 3 The Organizing and Program Committees 20 4 The Call for Participation 20 5 Summit Attendees 22 5.1 Summary of Attendees 22 5.2 NSF Project Representation 22 5.3 Inclusiveness 26 5.4 Attendee Evaluations 27 6 Conclusion 28 Appendix A: Findings from Past Summits 30 2018 Observations 31 2017 Recommendations 31 2016 Recommendations 32 2015 Recommendations 32 2014 Recommendations 33 2013 Recommendations 34 Title: Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure 2 Distribution: Public Appendix B: Summit Agenda 36 Appendix C: Descriptions of Workshops and Training Sessions 41 Concurrent Morning Sessions 42 Concurrent Afternoon Sessions 46 Appendix D: Bios for Speakers, Program Committee, and Organizers 49 Appendix E: Student Participation 66 Student Bios 68 Students’ Final Thoughts on Attending the Summit 70 Appendix F: Attendee Survey Summary Report 72 Appendix G: Training Evaluation Summary Report 79 Title: Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure 3 Distribution: Public Executive Summary The 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure, now in its seventh consecutive year, once again provided a valuable forum for NSF scientists, researchers, and security experts to collaborate on addressing core cybersecurity challenges. Trusted CI organizes the annual Summit with the goals of advancing cybersecurity awareness and practice and increasing trust in the integrity of research results produced using cyberinfrastructure. Responding to the constantly changing state of cybersecurity challenges can be difficult for any organization, whether commercial, academic, or governmental. The Summit serves as a valuable tool toward securing NSF scientific cyberinfrastructure (CI) through the opportunities it provides for attendees to meet with colleagues, share experiences, benchmark and debate cybersecurity best practices, identify common challenges, and receive practical, relevant training. Moreover, the Summit presents an excellent opportunity for the science, research, and security communities to highlight cybersecurity challenges to NSF program officers, leadership, and stakeholders, as well as provide basic cybersecurity awareness and education. Finally, the Summit presents an opportunity for the Trusted CI team to gain insight into the needs, concerns, and challenges facing the community. The 2019 Summit was held at the Catamaran Resort Hotel, San Diego, CA, October 15th through October 17th. The Summit’s call for participation (CFP1) yielded a total of 44 responses, more than could be accommodated in the program schedule. The full program schedule comprised 13 plenary talks, ten training sessions, four panel discussions, three “table talks”, and seven “lightning talks” (new in 2019). As with previous summits, the first day’s sessions consisted of training and focused workshops, including a full day WISE (Wise Information Security for collaborating E-infrastructures) Community2 training event. Of note among this year’s training sessions was the first ever security-focused training workshop on Project Jupyter, which exists to develop open-source software, open-standards, and services for interactive computing across dozens of programming languages. Feedback from the first group of attendees will inform the shape this training will take in future presentations. The second and third days’ sessions were composed of plenary presentations, panels, and lightning talks that focused on the security of cyberinfrastructure projects and Large Facilities. 1 https://trustedci.org/cfp2019 2 https://wise-community.org/ Title: Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure 4 Distribution: Public Summit plenary attendance was 143, up from 117 attendees last year. These attendees represented 84 NSF projects, including 12 of the 20 NSF Large Facilities. 46% of the attendees actively participated in either planning, presenting, co-authoring a CFP submission, or leading a lunch table talk. The attendees expressed overwhelmingly positive and constructive feedback. A list of observations and challenges along with notations of the presentations highlighting each of these issues is presented in Section 2 of this report, with the following summary key findings derived from this year’s Summit: ● Community member interaction and knowledge share remain a key to success. The value in developing and strengthening researcher / cybersecurity professional relationships was emphasized. ● Workforce development continues to be important, with demonstrable success resulting from hands-on training opportunities. ● The community values the availability of centralized cybersecurity resources. ● Measuring the effectiveness or impact of cybersecurity implementation, i.e., determining appropriate metrics to use, is a challenging, but important, area of investigation. ● Access control and credential management are extremely important to the community. The recommendation to use federated and/or external providers and industry standard protocols as much as possible was presented in several sessions. ● Social engineering remains a significant threat to cybersecurity. ● AI and ML can provide valuable cyberinfrastructure services, but have an inherent vulnerability in the potential for incorporating misinformation into models. ● Ensuring and maintaining data integrity is becoming an increasingly important issue. ● As the number of organizations handling PII and medical data increases, implementation of HIPAA compliance is becoming more widespread. Title: Report of the 2019 NSF Cybersecurity Summit for Large Facilities and Cyberinfrastructure 5 Distribution: Public 1 Summit Session Summaries Biographies of speakers are included in Appendix D. Slides from the talks can be found at https://trustedci.org/2019-presentations. 1.1 Presentations Keynote: Advancing Cybersecurity as an Evidence-based Discipline - Stefan Savage There is a disconnect between security researchers and operators. Cybersecurity attacks are much easier to measure than the effectiveness of defenses against these attacks. Consequently, the return on investments in cybersecurity countermeasures is difficult to calculate. One possibility to solve issues of measurability and metrics in relation to implementing effective cybersecurity practices is to make cybersecurity more like health care, with evidence-based actions. Examples of evidence-based actions include looking at the security outcomes (e.g., was a machine compromised or not? Were credentials stolen or not?) and viewing the human factors of security such as the impact of economics on implementing attacks. Collaborating with industrial partners and government can also provide broader insights. Key points: ● SPAM filtering is not working for things people want ● No empirical evidence for best practices, but having good empirical data implies good security ● Measuring security isn’t impossible, it’s just hard Cyberinfrastructure Center of Excellence PILOT - Establishing Effective Practices for Large Facilities - Ewa Deelman The Cyberinfrastructure Center of Excellence (CI CoE) Pilot is a recently launched NSF-funded project that aims to: 1) create and establish effective practices and innovative solutions for cyberinfrastructure (CI) challenges prevalent among existing facilities; and 2) assist in CI construction and design for developing facilities. The