NSF Cyberinfrastructure Cybersecurity Resources
This page is a collection of Trusted CI and community generated papers and other resources that are of interest to those in the NSF CI community. To suggest content for this page or make corrections, please email firstname.lastname@example.org
Other Cybersecurity Projects
NSF Washington Area Trustworthy Computing Hour (WATCH) seminar series: http://www.nsf.gov/cise/cns/watch/
InCommon IAM (identity and access management) Online: http://www.incommon.org/iamonline/
Trusted CI Monthly Webinar: http://trustedci.org/webinars/
The Great Plains ENCITE webinars often cover cybersecurity topics: http://www.greatplains.net/
NSF Cybersecurity Summits
2009 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/PUB1001.pdf
2008 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/PUB9002.pdf
2007 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CYB0701.pdf (NSF Response)
2005 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CYB0525.pdf (NSF Response)
2004 NSF Cybersecurity Summit Report: http://library.educause.edu/ir/library/pdf/CSD4296.pdf
Project Cybersecurity Documents
GENI: "Managing Identity and Authorization for Community Clouds" Jeff Chase and Prateek Jaipuria Department of Computer Science Duke University. Steve Schwab and Ted Faber, USC/ISI. http://www.cs.duke.edu/%7Echase/geni-trust.pdf
DataONE Cybersecurity Plan. http://mule1.dataone.org/ArchitectureDocs-current/design/security-plan.html
Blue Waters OTP Decision Guide. https://security.ncsa.illinois.edu/201010-ncsa-bw-otp.pdf
OSG Computer Security Plans. Irwin Gaines, Don Petravick, Vikram Andem. 20-Jun-2006. http://osg-docdb.opensciencegrid.org/cgi-bin/ShowDocument?docid=440
Basney, J., Koranda, S., & Welch, V. (2011). "An Analysis of the Benefits and Risks to LIGO When Participating in Identity Federations." LIGO document number: LIGO-G1100964-v2, 2011. https://dcc.ligo.org/public/0070/G1100964/002/LIGOIdentityFederationRiskAnalysis.pdf
Welch, V. (2012). "Globus Online Security Review." Indiana University ScholarWORKS, February 2012. http://hdl.handle.net/2022/14147
Scientific Software Security Innovation Institute Workshops: http://security.ncsa.illinois.edu/s3i2/
CILogon 2010 identity management workshop: http://workshops.cilogon.org/2010
CILogon 2009 identity management workshop: http://www.cilogon.org/fall-2009-workshop
Jim Basney. Identity Management Best Practices: A Trusted CI Blog Series [Online]. November 2011.
"Cybersecurity 2011... and beyond. What Makes a Good Security Plan?" Ardoth Hassler, Seniot IT Advisor, National Science Foundation. Associate VP University Information Services, Georgetown University.
"Best Practices in Cybersecurity that Might be Useful to NSF Large Facilities" Ardoth Hassler, Seniot IT Advisor, National Science Foundation. Associate VP University Information Services, Georgetown University. January 2011.
William Barnett, Von Welch, Alan Walsh and Craig A. Stewart. A Roadmap for Using NSF Cyberinfrastructure with InCommon. March 2011.
Security for Collaboration among Infrastructures (SCI). Collaborative activity working on interoperability between infrastructures, including EGI, OSG, PRACE, wLCG, and XSEDE. http://www.eugridpma.org/sci/
EDUCAUSE Security Discussion Group. Email list mainly used by security staff at higher education institutions. http://www.educause.edu/discuss/discussion-groups-related-educause-programs/security-discussion-group
Higher Education Information Security Council (HEISC): http://www.educause.edu/focus-areas-and-initiatives/policy-and-security/cybersecurity-initiative/about - select materials:
EDUCAUSE Security Awareness campaign: http://www.educause.edu/securityawareness
Online Cybersecurity Training
National Webcast Initiative. A collaborative effort between the U.S. Department of Homeland Security's National Cyber Security Division and the Multi-State Information Sharing and Analysis Center (MS-ISAC), the National Webcast Initiative provides free webcasts on various cybersecurity topics. One-hour webcasts are broadcast approximately every two months, with archives going back to 2010. Topics are general so as to be of interest to a large audience, including policy decision makers and system administrators.
SANS Webcasts and Archives. The SANS Institute is a private company that specializes in internet security training. SANS specializes in training and certification, but also offers free daily webcasts on various security topics presented by security experts and industry representatives. Archived webcasts dating back to 2009 are accessible by registering for a free account. Topics range from the general to the specific, so any person involved in cybersecurity, from managers to developers, should be able to find a webcast of interest.
Open Security Training. Rather than providing webcasts, the Open Security Training site offers training materials for computer security classes on multiple topics. The training materials are developed by security experts and submitted to the site for use by other educators. There are approximately 20 courses ranging from beginner to advanced, some containing videos, most containing lab exercises. The beginner lessons typically give an overview of a subject and are targeted to people new to cybersecurity. The advanced lessons are typically detailed and specific to one topic of cybersecurity and thus more applicable to developers and system administrators.
Software Engineering Institute at Carnegie Mellon CERT podcasts. The CERT program strives to detect and resolve computer security incidents. Carnegie Mellon provides a series of podcasts for business leaders who want to learn more about enterprise-wide security efforts. Podcast categories include risk management and security education and training. The free audio podcasts typically include a transcript and additional notes.
Texas A&M Engineering Extension Service (TEEX) Domestic Preparedness. This site primarily offers DHS/FEMA certification training for emergency services, but also provides several free online courses related to information security and risk management. Classes offer continuing education credit, and can be taken by the general public. The majority of courses are general in nature to be of interest to any individual involved in cybersecurity. However, there are a few courses specific to developing secure software.
Information Assurance Support Environment (IASE) Training. While specializing in "information assurance", the IASE offers free security training ranging from general (e.g., social networking, phishing) to specific (intrusions detection system analysis). Courses typically run between 30 and 90 minutes and can be completed in a browser (i.e., online), or can be ordered on CD for offline training. Topics are wide-ranging to be of interest to any individual involved in cybersecurity.
SecurityTube Videos on Cybersecurity. SecurityTube is a sort of YouTube for computer security. Videos produced by SecurityTube staff focus on web security and "hack of the day", while community-submitted videos tackle various computer security topics. The search engine lists several videos related to cybersecurity (linked above), and the cybersecurity tag lists about 40 videos. There are also several "megaprimers" on topics such as pentesting and buffer overflow. Topics tend to be specific to system administrators and software developers.
Coursera Security Online Courses. Coursera partners with top universities and organizations to offer free online courses across a wide range of topics. Courses are typically 4 to 10 weeks in length and require a time commitment of 6-10 hours per week. The courses related to computer security (linked above) are typically more general than "cybersecurity". As the courses are lengthy and detailed, the target audience are individuals interested in mastering the material covered in the courses.
US-CERT Publications. The United States Computer Emergency Readiness Team (US-CERT) is part of the Department of Homeland Security. While it's primary mission is to respond to incidents and provide technical assistance to information systems operators, the site has a selection of technical publications related to cybersecurity. Materials tend to fall into two categories: (a) general computer security issues to interest to all individuals, and (b) technical publications meant for system and network administrators.
Computer Security Resource Center (CSRC) of the Computer Security Division (CSD). The CSD is a division of the National Institute of Standards and Technology (NIST) and provides resources in the form of publications for proposed standards for securing computer and information systems. Searching for "cybersecurity" brings up several publications, including the developing Cybersecurity Framework. The proposed standards are useful for understanding the future of cybersecurity, both from a high-level overview, and from a detailed-level implementation proposal.
National Initiative for Cybersecurity Careers and Studies (NICCS). The NICSS offers a search engine for various cybersecurity training resources and courses offered by companies specializing in security training and certification. While the majority of the training is not free, the search engine gives a good idea of the types of training resources offered by industry experts.
Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio (UTSA). The CIAS primarily offers cybersecurity training events ranging from one-hour lectures to multi-day courses. However, they also provide an Online Library of materials which can be used by outside parties. These materials typically provide overviews of various aspects of computer security, and thus are useful for managers wanting to learn more about cybersecurity.
The Bro Network Security Monitor YouTube Channel. The Bro Network Security Monitor offers a YouTube channel on which users can review videos covering a number of topics related to network security. Access to this channel and its content is free, and gives a good amount of information on how to successfully defend your network.