NSF Cyberinfrastructure Cybersecurity Resources
Trusted CI offers a wealth of community-generated papers and resources of interest to the NSF CI community in the following categories.
Best Practices
Communities
NSF Cybersecurity Summits
Online Cybersecurity Training
Project Cybersecurity Documents
Ransomware mitigation
Science DMZ Security
Security Awareness
Webinars/Online Talks
Workshops
To suggest content for this page or make corrections, please email info@trustedci.org
Best Practices
Jim Basney. Identity Management Best Practices: A Trusted CI Blog Series [Online]. November 2011.
"Cybersecurity 2011... and beyond. What Makes a Good Security Plan?" Ardoth Hassler, Senior IT Advisor, National Science Foundation. Associate VP University Information Services, Georgetown University.
"Best Practices in Cybersecurity that Might be Useful to NSF Large Facilities" Ardoth Hassler, Senior IT Advisor, National Science Foundation. Associate VP University Information Services, Georgetown University. January 2011.
William Barnett, Von Welch, Alan Walsh and Craig A. Stewart. A Roadmap for Using NSF Cyberinfrastructure with InCommon. March 2011.
Communities
ESnet’s CI Engineering Group
Mailing list (join) to discuss relevant CI topics - which may include networking, computation, software, science engagement, security, data movement, etc.
Semi-weekly CI engineering calls on Fridays @ 2pm ET - If there is a talk, there will be an announcement that week. More information, along with helpful dates/reminders and lists of past talks, are available on their website. The calls are also published on YouTube
Security for Collaboration among Infrastructures (SCI). Collaborative activity working on interoperability between infrastructures, including EGI, OSG, PRACE, wLCG, and XSEDE. http://www.eugridpma.org/sci/
EDUCAUSE Security Discussion Group. Email list mainly used by security staff at higher education institutions. http://www.educause.edu/discuss/discussion-groups-related-educause-programs/security-discussion-group
Higher Education Information Security Council (HEISC): http://www.educause.edu/focus-areas-and-initiatives/policy-and-security/cybersecurity-initiative/about - select materials:
The Research and Education Networks (REN-ISAC) and see also their Resources webpage
The Cybersecurity in Application, Research, and Education (CARE) Lab, Temple University
U.S. Academic Research Fleet Maritime Cybersecurity Resources
NSF Cybersecurity Summits
2009 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/PUB1001.pdf
2008 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/PUB9002.pdf
2007 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CYB0701.pdf (NSF Response)
2005 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CYB0525.pdf (NSF Response)
2004 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CSD4296.pdf
Stakkato (aka FBI Major Case 216) was a motivating factor in initiating the Cybersecurity Summits.
Online Cybersecurity Training
Cyberinfrastructure Lab. The Cyberinfrastructure Lab at the University of South Carolina (CI Lab @ USC) is a virtual platform deployed for cybertraining purposes. Current training labs include network tools and protocols (e.g., Mininet, Netem, TCP congestion control), perfSONAR, Zeek / Bro, and others.
National Webcast Initiative. A collaborative effort between the U.S. Department of Homeland Security's National Cyber Security Division and the Multi-State Information Sharing and Analysis Center (MS-ISAC), the National Webcast Initiative provides free webcasts on various cybersecurity topics. One-hour webcasts are broadcast approximately every two months, with archives going back to 2010. Topics are general so as to be of interest to a large audience, including policy decision makers and system administrators.
SANS Webcasts and Archives. The SANS Institute is a private company that specializes in internet security training. SANS specializes in training and certification, but also offers free daily webcasts on various security topics presented by security experts and industry representatives. Archived webcasts dating back to 2009 are accessible by registering for a free account. Topics range from the general to the specific, so any person involved in cybersecurity, from managers to developers, should be able to find a webcast of interest.
Open Security Training. Rather than providing webcasts, the Open Security Training site offers training materials for computer security classes on multiple topics. The training materials are developed by security experts and submitted to the site for use by other educators. There are approximately 20 courses ranging from beginner to advanced, some containing videos, most containing lab exercises. The beginner lessons typically give an overview of a subject and are targeted to people new to cybersecurity. The advanced lessons are typically detailed and specific to one topic of cybersecurity and thus more applicable to developers and system administrators.
Software Engineering Institute at Carnegie Mellon CERT podcasts. The CERT program strives to detect and resolve computer security incidents. Carnegie Mellon provides a series of podcasts for business leaders who want to learn more about enterprise-wide security efforts. Podcast categories include risk management and security education and training. The free audio podcasts typically include a transcript and additional notes.
Texas A&M Engineering Extension Service (TEEX) Domestic Preparedness. This site primarily offers DHS/FEMA certification training for emergency services, but also provides several free online courses related to information security and risk management. Classes offer continuing education credit, and can be taken by the general public. The majority of courses are general in nature to be of interest to any individual involved in cybersecurity. However, there are a few courses specific to developing secure software.
Information Assurance Support Environment (IASE) Training. While specializing in "information assurance", the IASE offers free security training ranging from general (e.g., social networking, phishing) to specific (intrusions detection system analysis). Courses typically run between 30 and 90 minutes and can be completed in a browser (i.e., online), or can be ordered on CD for offline training. Topics are wide-ranging to be of interest to any individual involved in cybersecurity.
SecurityTube Videos on Cybersecurity. SecurityTube is a sort of YouTube for computer security. Videos produced by SecurityTube staff focus on web security and "hack of the day", while community-submitted videos tackle various computer security topics. The search engine lists several videos related to cybersecurity (linked above), and the cybersecurity tag lists about 40 videos. There are also several "megaprimers" on topics such as pentesting and buffer overflow. Topics tend to be specific to system administrators and software developers.
Coursera Security Online Courses. Coursera partners with top universities and organizations to offer free online courses across a wide range of topics. Courses are typically 4 to 10 weeks in length and require a time commitment of 6-10 hours per week. The courses related to computer security (linked above) are typically more general than "cybersecurity". As the courses are lengthy and detailed, the target audience are individuals interested in mastering the material covered in the courses.
US-CERT Publications. The United States Computer Emergency Readiness Team (US-CERT) is part of the Department of Homeland Security. While it's primary mission is to respond to incidents and provide technical assistance to information systems operators, the site has a selection of technical publications related to cybersecurity. Materials tend to fall into two categories: (a) general computer security issues to interest to all individuals, and (b) technical publications meant for system and network administrators.
Computer Security Resource Center (CSRC) of the Computer Security Division (CSD). The CSD is a division of the National Institute of Standards and Technology (NIST) and provides resources in the form of publications for proposed standards for securing computer and information systems. Searching for "cybersecurity" brings up several publications, including the developing Cybersecurity Framework. The proposed standards are useful for understanding the future of cybersecurity, both from a high-level overview, and from a detailed-level implementation proposal.
National Initiative for Cybersecurity Careers and Studies (NICCS). The NICSS offers a search engine for various cybersecurity training resources and courses offered by companies specializing in security training and certification. While the majority of the training is not free, the search engine gives a good idea of the types of training resources offered by industry experts.
Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio (UTSA). The CIAS primarily offers cybersecurity training events ranging from one-hour lectures to multi-day courses. However, they also provide an Online Library of materials which can be used by outside parties. These materials typically provide overviews of various aspects of computer security, and thus are useful for managers wanting to learn more about cybersecurity.
The University of North Dakota Online's Cyber Security Education and Training Resources for Veterans. This guide aims to assist veterans and service members interested in a career in cybersecurity by providing vital information and advice about the industry to help them succeed in their new career path.
The Zeek Network Security Monitor YouTube Channel. Zeek (formerly known as Bro) Network Security Monitor offers a YouTube channel on which users can review videos covering a number of topics related to network security. Access to this channel and its content is free, and gives a good amount of information on how to successfully defend your network.
Project Cybersecurity Documents
The Open Science Grid Security Plan V2. http://osg-docdb.opensciencegrid.org/cgi-bin/ShowDocument?docid=389
GENI: "Managing Identity and Authorization for Community Clouds" Jeff Chase and Prateek Jaipuria Department of Computer Science Duke University. Steve Schwab and Ted Faber, USC/ISI. http://www.cs.duke.edu/%7Echase/geni-trust.pdf
DataONE Cybersecurity Plan. http://mule1.dataone.org/ArchitectureDocs-current/design/security-plan.html
Blue Waters OTP Decision Guide. https://security.ncsa.illinois.edu/201010-ncsa-bw-otp.pdf
OSG Computer Security Plans. Irwin Gaines, Don Petravick, Vikram Andem. 20-Jun-2006. http://osg-docdb.opensciencegrid.org/cgi-bin/ShowDocument?docid=440
Basney, J., Koranda, S., & Welch, V. (2011). "An Analysis of the Benefits and Risks to LIGO When Participating in Identity Federations." LIGO document number: LIGO-G1100964-v2, 2011. https://dcc.ligo.org/public/0070/G1100964/002/LIGOIdentityFederationRiskAnalysis.pdf
Welch, V. (2012). "Globus Online Security Review." Indiana University ScholarWORKS, February 2012. http://hdl.handle.net/2022/14147
Ransomware Mitigation
Science DMZ Security
Science DMZ: Secure High Performance Data Transfer, a 2022 guidance report written by Trusted CI in collaboration with University of Arkansas
Science DMZ Security from ESnet
Science DMZ Security from the Network Startup Resource Center
Security Awareness
EDUCAUSE Security Awareness campaign: http://www.educause.edu/securityawareness
Webinars/Online Talks
NSF Washington Area Trustworthy Computing Hour (WATCH) seminar series: http://www.nsf.gov/cise/cns/watch/
InCommon IAM (identity and access management) Online: http://www.incommon.org/iamonline/
Trusted CI Monthly Webinar: http://trustedci.org/webinars/
The Great Plains ENCITE webinars often cover cybersecurity topics: http://www.greatplains.net/
Workshops
CyberRISK Workshop for Minority Serving Institutions (MSIs): https://sites.duke.edu/cyberrisk/resources/
2010 Scientific Software Security Innovation Institute Workshop: http://hdl.handle.net/2142/107146
2011 Scientific Software Security Innovation Institute Workshop: http://hdl.handle.net/2142/107147
CILogon 2010 identity management workshop: http://workshops.cilogon.org/2010
CILogon 2009 identity management workshop: http://www.cilogon.org/fall-2009-workshop