CENTER FOR APPLIED CYBERSECURITY RESEARCH
ANNUAL REPORT FY2021
TABLE OF CONTENTS
FROM THE DIRECTOR
4
About CACR
Dear friends of the Center for Applied Cybersecurity Research,
5
The IU cybersecurity community
We will recall 2021 as yet another year with the challenges of COVID-19, hybrid meetings, virtual events, and increasing cybersecurity threats. With these challenges in mind, the CACR team continued to excel, enhancing the practice of cybersecurity for the nation,
6
2021 highlights
the state of Indiana, and Indiana University. I am happy to present CACR’s 2021 Annual
8
Leading the nation in cybersecurity
Trusted CI, the Cybersecurity Center of Excellence for the National Science Foundation
16
Leading Indiana to a more secure future
Report. I include here some examples of CACR’s highlights in this report.
(NSF) led by CACR, has now impacted 547 NSF projects through its webinars, engagements, and other activities. Trusted CI published the Framework Implementation Guide (FIG) for Research Cyberinfrastructure Operators. Since its publication, the document has been downloaded more than 1,000 times and is being put into practice at
18
Leading IU to help drive discovery
some of the nation’s largest research organizations. The CACR-led Research Security Operations Center (ResearchSOC), which builds on the
24
CACR leadership team, staff, and fellows
IU-led OmniSOC, continued increasing the security of the research community with four NSF major facilities as customers. CACR performed security assessments using the Principles-based Assessment for Cybersecurity Toolkit (PACT) for the HathiTrust Research Center at IU and the NOIRLab NSF major facility. The CACR-led IU team completed its Indiana election security project in early 2021–an effort that trained more than 30 county officials across the state in developing and executing cybersecurity incident response plans and playbooks to provide election cybersecurity training in advance of the 2020 elections, with officials from 32 counties participating. The SecureMyResearch service, helping IU researchers with their cybersecurity
Click here for a fully accessible version of this report.
challenges, achieved rapid service adoption, and is providing support for a quarter of all IU faculty.
CACR organized the Security Speaker Series, with talks co-hosted with the Ostrom Workshop, the Kelley School of Business, the Center of Excellence for Women & Technology, the Maurer School of Law, and the Luddy School of Informatics, Computing, and Engineering. In partnership with WonderLab and IU’s Center for Excellence for Women & Technology respectively, CACR held two virtual Security Matters Cybercamps. One for middle and high school students was attended by 20 students from across five states, and one for non-STEM undergrads was attended by 16 students. This report contains details on these accomplishments and others by CACR’s staff. I am very proud of the professional diversity of our staff, each with unique skills and experiences that contribute to its expertise. I also recognize that collaboration with and support of our many partners, Fellows, and supporters are essential for our success. These include the NSF, NSWC Crane, the Department of Homeland Security, IU OVPR, IU OVPIT, an extensive list of IU schools and partner universities, and IU’s researchers and operational cybersecurity staff. As we look to 2022, we see new challenges and opportunities. I am proud of CACR’s accomplishments and confident that our service and leadership will continue to expand to meet those challenges and take advantage of those opportunities.
CACR Senior Project Manager Kelli Shute, CACR Director Von Welch, Indiana Secretary of State Holli Sullivan, and IU VP for IT and CIO Rob Lowden pose in front of Big Red 200
Von Welch Director, CACR Executive Director for Cybersecurity Innovation Associate Vice President, Information Security Indiana University
ABOUT CACR CACR’s mission is to provide people with the knowledge and skills they need to manage cybersecurity risks in complex, challenging environments where standard cybersecurity practices do not suffice. It does so through a combination of thought leadership, applied research, training and education, operational services, and extensive interdisciplinary collaboration. CACR is Indiana University’s flagship center for cybersecurity, serving as
assessing and negotiating data usage terms. To date, SecureMyResearch has
an integrator for research across the university’s different schools and
reached a resounding 460 researcher engagements in 100 departments.
organizations. CACR is distinctive in addressing cybersecurity from a comprehensive, multidisciplinary perspective. CACR draws on IU’s wide range of scholarly expertise in computer science, informatics, accounting and information systems, criminal justice, law, organizational behavior, and public policy, as well as the extensive practical cybersecurity experience of its operational units. CACR is the only university-level holistic cybersecurity center in the country, integrating legal, policy, economic, and behavioral research, along with operational and technical expertise. Recently CACR has played a larger role in the success of the IU research mission and the OmniSOC endeavor. With the support of the Vice President for Research, CACR launched the SecureMyResearch service in 2020. SecureMyResearch builds on CACR’s expertise in leading the NSF Cybersecurity Center of Excellence to provide bespoke consulting to IU’s research community in addressing the cybersecurity challenges of their research. It also serves as a resource to the Office of Research Administration during the pre-award phase of grants and contracts in
4
In 2020, CACR Director Von Welch assumed the role of executive director of the OmniSOC. Since then, OmniSOC’s clientele has expanded beyond its founding Big Ten members to include a number of NSF research institutions and small schools across the United States. This expansion was enabled by the addition of CACR’s virtual cybersecurity services to OmniSOC’s intrusion detection capabilities—key capabilities to make for a holistic cybersecurity service for small organizations. CACR continued to be affiliated with the Pervasive Technology Institute (PTI) at Indiana University and welcomed Dr. Beth Plale as its new executive director in the past year. PTI consists of six centers and two labs and focuses on improving the quality of life in the state of Indiana and the world through novel research, innovation, and service delivery in information technology and informatics. CACR collaborates with PTI to bring its operational cybersecurity expertise and broad community connections as competitive advantages to PTI proposals.
Exemplars of CACR work
About the Indiana University cybersecurity community
National
Trusted CI Leadership for the NSF cybersecurity ecosystem ResearchSOC Cybersecurity services for the nation’s greatest research PACT The Principles-based Assessment for Cybersecurity Toolkit for assessing the toughest cybersecurity problems
Indiana University has taken a leadership position addressing difficult cybersecurity challenges through its unique operational, research, academic, and workforce development initiatives. CACR is a proud member of the university’s cybersecurity community, which includes the OmniSOC security operations center for higher education
PATh Advancing the nation’s campuses and science
and research, the CACR-led NSF Cybersecurity Center of
communities by bringing together the Center for High
Excellence (Trusted CI), and Research Security Operations
Throughput Computing and the Open Science Grid
Center (ResearchSOC). These organizations’ information security activities alone deliver about $7.3 million in annual
State
Election security Preparation for e lection officials in all 92 Indiana counties for cybersecurity incidents related to the 2020 general election and beyond Security Matters cybercamps Day camps for K8+ focusing on all things cybersecurity
income—$4.4 million in the form of grant income and $2.9 million from OmniSOC and ResearchSOC services. The impact does not stop there, as the cybersecurity community is also home to invaluable organizations such as the Global Research Network Operations Center (GlobalNOC), Maurer School of Law, Kelley School of Business, Research and Education Networks Information
Indiana University
Executive director for cybersecurity innovation (EDCI)
and Analysis Center (REN-ISAC), the IU University
Leveraging IU’s cybersecurity strengths to address challenges
Information Policy Office, the IU University Information
faced across the nation and expanding the role of CACR
Security Office, the Ostrom Workshop, and the Luddy
SecureMyResearch Reducing the cybersecurity burden on researchers while enhancing research data security at IU
School of Informatics, Computing, and Engineering. It is these programs, and their extensive collaborations, that have made IU an acknowledged “quiet powerhouse”
HIPAA compliance Providing oversight of HIPAA compliance for
in cybersecurity for higher education and research.
OVPIT systems
Led by Rob Lowden, vice president for information
ASSERT: AI-enabled cybersecurity Leading a team evaluating a
technology and CIO, IU operates one of the most advanced
research prototype application (Ahmet Okutan and S. Jay Yang
cyberinfrastructures of any university in the world.
at Rochester Institute of Technology) for IU’s OmniSOC security operations center
leading.iu.edu 5
2021 HIGHLIGHTS
6
CACR’s SecureMyResearch achieved rapid service adoption and is providing support for a quarter of all IU faculty and counting.
CACR staff provided consulting to researchers in the Office of Research Administration on Department of Defense contracts that involve Controlled Unclassified Information (CUI).
CACR partnered with OmniSOC to introduce virtual cybersecurity services to OmniSOC member institutions.
Along with CyberCorps, CACR awarded an NSF supplement grant that will help IU train the next generation of AI and cybersecurity professionals via the Scholarship for Service program.
Along with Trusted CI, CACR hosted the first public annual NSF Cybersecurity Summit with more than 325 registrants.
The CACR Speaker Series hosted nine sessions with an average attendance of 45.
CACR conducted Principles-based Assessment for Cybersecurity Toolkit assessments for HathiTrust Research Center and NOIRLab.
In partnership with other universities, CACR led a workshop that aimed to produce a multicampus data collection and sharing infrastructure.
KEY NUMBERS
NSF major facilities served by ResearchSOC
in lifetime regional economic impact
researchers in IU research departments
served by SecureMyResearch
in lifetime award dollars
MORE THAN
1,000
downloads of the Trusted CI Framework Implementation Guide 7
LEADING THE NATION IN CYBERSECURITY CACR continued its ongoing leadership in protecting the cybersecurity of more than $8 billion in NSF-funded research. CACR is the lead organization for Trusted CI, in collaboration with the National Center for Supercomputing Applications, the Pittsburgh Supercomputing Center, Lawrence Berkeley National Laboratory (Berkeley Lab), the University of South Alabama, and the University of Wisconsin–Madison. CACR also leads the ResearchSOC, collaborating with the Pittsburgh Supercomputing Center, Duke University, and the University of California San Diego, and has a strong partnership with the OmniSOC, the shared security operations center for higher education and research.
The Vera C. Rubin Observatory, a program of NSF’s NOIRLab, under the lights of the Milky Way. NOIRLab is an early adopter of the Trusted CI Framework. Photo: Rubin Observatory/NSF/AURA/B. Quint
8
Now in its tenth year of service and third award, Trusted CI has been at the forefront of the NSF research community in building a set of technical, policy, and cultural best practices necessary to ensure the security of that infrastructure and the trustworthy nature of the science it produces. Trusted CI has now impacted 547 NSF projects through its webinars, engagements, and other activities. The Trusted CI Framework is one of the center’s flagship products and is the focus of several initiatives. The Framework sets out a reasonable minimum standard for cybersecurity programs. It consists of 16 “Musts” that represent the baseline for programmatic competency in cybersecurity and focuses on supporting organizational missions, governance, and resources, complementing existing frameworks that have a heavier focus on controls and the technological side of cybersecurity. 2021 was a big year for the Trusted CI Framework.
Framework Implementation Guide Trusted CI published the Framework Implementation Guide (FIG) for Research Cyberinfrastructure Operators. The FIG is an audience-specific deep dive for implementing the Framework’s 16 Musts. Since its publication, the document has been downloaded more than 1,000 times. In December, NSF
The TrustedCI Framework is built on four
updated its Research Infrastructure Guide to align with the Framework and directly references the FIG
pillars: Mission alignment, Governance,
as a cybersecurity resource for research infrastructure operators.
Resources, and Controls.
Adopting the Framework Trusted CI published updated tools and templates to help adopters align to the Framework, including a new template for a cybersecurity program strategic plan. Additionally, the center conducted an engagement with NSF’s NOIRLab, an early Framework adopter, focused on aligning to the Framework. Based on the success of this engagement, the center developed a new “cohort” engagement approach, allowing the team to scale Framework adoption and implementation among multiple NSF organizations simultaneously. The Framework and FIG have successfully reached institutions both within and beyond the NSF community, including institutions such as the National Defense University, the U.S. Coast Guard, the Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC), the Cybersecurity and Infrastructure Security Agency, and the government of the U.S. Virgin Islands.
View the Trusted CI Annual Report go.iu.edu/4gYx 9
“Based on [CACR’s] recommendations, we have decided to revisit our cybersecurity strategy from the top down. . . . Thanks for all your efforts and in helping us take a different perspective.” Rich Ceci, senior vice president for technology and projects, Port of Virginia
OmniSOC: higher education’s only collaborative multi-state institution security operations center The OmniSOC is the shared security operations center for higher education and research. OmniSOC rapidly delivers only critical, actionable, high-quality alerts 24/7, allowing cybersecurity staff to focus on what’s important, at substantial cost savings, from a trusted leader in the higher education cybersecurity community. As the increasingly challenging demands of the cybersecurity landscape and the shortage of trained personnel have increased, CACR has responded to the community’s needs. In partnership with OmniSOC, CACR has provided virtual cybersecurity teams, ranging from a part-time security engineer to a full cybersecurity staff. OmniSOC member clients range from R1 universities to regional research and education networks to NSF facilities.
PACT: Addressing the toughest cybersecurity problems Principles-based Assessment for Cybersecurity Toolkit (PACT) cybersecurity assessments focus on mission success, not checklist compliance. When conducting a PACT assessment for a partner organization, CACR analyzes the organization as a whole, understanding that cybersecurity can be a burden or an enabler. The team delivers actionable recommendations for operational personnel and lays out strategic priorities for leadership. CACR partners use the assessment reports to guide their cybersecurity activities for years. In 2021, CACR conducted two PACT assessments: an in-depth assessment of cybersecurity programmatics at NOIRLab as well as a programmatic and The Port of Virginia on the Elizabeth River, Norfolk, Virginia
10
technical assessment of the HathiTrust Research Center.
2021 PACT ASSESSMENTS “Trusted CI has given us a framework, appropriate to our environment, with which to An in-depth assessment of cybersecurity programmatics at the
build our cybersecurity program. It allows us
National Optical-Infrared Astronomy Research Laboratory (NOIRLab), the preeminent U.S. national center for ground-based, nighttime optical and
to do this in a manner that balances scientific
infrared astronomy, using the Trusted CI Framework as the standard.
productivity against organizational risk in a cost effective manner.” John Maclean, NOIRLab director of Center Operations Services
A programmatic and technical assessment of the HathiTrust Research Center (HTRC), a collaborative research center launched jointly by Indiana University and the University of Illinois, along with HathiTrust, to help researchers solve technical challenges face when dealing with massive amounts of digital text.
Methodology The PACT methodology is collaborative and non-invasive. It was developed by CACR subject matter experts for the United States Navy and has been successfully applied in diverse operational environments. The methodology is based heavily on assessments conducted in 13 prior engagements through the NSF Cybersecurity Center of Excellence and the Navy. It has been proven by two congressionally funded, DoD-sponsored pilots, most recently at the Port of Virginia in collaboration with the United States Coast Guard. This latter assessment led to continued engagement with the Coast Guard, including an engagement with Rear Admiral Lower Half John Mauger and
“Kudos to whole CACR team for such a wellorganized report with many thorough analysis and insightful recommendations. HTRC leadership team is totally impressed and deeply grateful. Thank you!” Dr. Yu (Marie) Ma, associate director of Cyberinfrastructure and Operations for HTRC, Indiana University
a presentation to the membership of the MTS-ISAC. CACR has introduced assessment and programmatics work to Cybersecurity and Infrastructure Security Agency personnel and congressional staffers, Senator Braun’s staffers, and numerous DoD and Defense Industrial Base stakeholders.
11
Inside the Large Hadron Collider, Geneva, Switzerland
ResearchSOC: Delivering cybersecurity services to the nation’s greatest research In 2021, ResearchSOC grew to serve four NSF major
OSG, IRIS-HEP, and PATh
facilities, two of which have
The Open Science Grid (OSG), the Institute for
moved from grant-funded
Research and Innovation in Software for High
service to self-funded service. ResearchSOC has built upon its 24/7 monitoring
Energy Physics (IRIS-HEP), and the Partnership
and threat hunting, managed honeypot, and vulnerability scanning services
to Advance Throughput Computing (PATh) are a
with new capabilities, including incident response support, virtual CISOs,
projects that have turned to CACR to provide a single security team across
Research and development continue for new ways to serve NSF major facilities
the projects while supporting the tight integration of services. PATh brings
and other science organizations throughout 2022 and beyond.
together the Center for High Throughput Computing and the OSG to
Launched in October 2018, ResearchSOC is unique in the world: it is the only organization with the mission to provide operational cybersecurity services to NSFfunded facilities and projects, while at the same time seeking to further research in cybersecurity. Funded by a $5 million award from the NSF, ResearchSOC helps make scientific computing resilient to cyberattacks and capable of supporting trustworthy, productive research. CACR leads this collaborative effort that brings together existing cybersecurity services and expertise from Indiana University, including the OmniSOC and REN-ISAC; Duke University; the Pittsburgh Supercomputing Center; and the University of California San Diego.
12
set of three closely related research computing
virtual cybersecurity teams, engineering support, and CISO advisory services.
advance the nation’s campuses and science communities through the use of distributed high throughput computing. The OSG facilitates access to distributed high throughput computing for research in the United States and worldwide. IRIS-H EP serves as an active center for software R&D and transforms the operational services required to ensure the success of the Large Hadron Collider.
Custos
Providing research cybersecurity as a service
The Custos project, a collaboration within PTI and led by PTI’s Cyberinfrastructure
Leveraging its experience in providing virtual cybersecurity leadership, expertise,
Integration Research Center (CIRC), provides an innovative integration of
and consulting for scientific research projects, CACR expanded its portfolio
major security capabilities needed by science gateways. These include identity
of research “cybersecurity as a service” clients, providing cybersecurity
management, secrets management for third-party resource integration, and
leadership and consulting services to these projects, with CACR team members
group and sharing management for securely controlling permissions and
serving as the projects’ chief information security officers or as cybersecurity
broader access to the digital object science gateways.
consultants providing input on best practices.
IRIS
Cybersecurity for Leadership (C4L) CACR continued its partnership with Renaissance
Targeted to both non-cybersecurity and cybersecurity leaders, the
Computing Institute (RENCI) on the Integrity
Cybersecurity for Leadership (C4L) curriculum begins with a half-day
Introspection for Scientific Workflows (IRIS)
bootcamp that provides practical tools to help organizational leaders play
project. IRIS automatically detects, diagnoses,
an effective role in cybersecurity oversight.
and pinpoints the source of unintentional integrity anomalies in scientific workflows executing on distributed computing infrastructure. CACR is supporting IRIS through expert guidance on cybersecurity and privacy challenges. RENCI is a partnership between the University of North Carolina–Chapel Hill, Duke University, and the city of Durham, North Carolina. RENCI leads a project allowing scientists to share and analyze data across institutional boundaries. The three-year project was funded by a $3 million NSF grant.
ImPACT CACR is contributing its cybersecurity expertise to a three-year, $3 million project funded by the NSF. The Infrastructure for Privacy-assured CompuTations (ImPACT) project, led by RENCI, will allow researchers to focus more fully on science by building a technology infrastructure that supports best practices in moving data, managing data ensuring security, and preserving privacy.
Drawn from years of experience across multiple projects, the C4L Bootcamp focuses on key cybersecurity program enablers of mission alignment, governance, resourcing, and controls based on the Trusted CI Framework. The training includes explicit detail on what leaders must do (and avoid) to evolve the cybersecurity program and organization’s culture. Additionally, the training introduces organizations to CACR’s Information Security Practice Principles as a tool to assist leaders with decision making, communication, and strategy. In 2020, CACR piloted C4L with the U.S. Virgin Islands. In early 2021, the team conducted a second and final pilot with Look Listen, a marketing firm. Additionally, CACR advertised C4L to a broad range of stakeholders through presentations, briefings, and announcements coordinated with IU’s AVP for Business Partnerships. In November—through the Indiana Economic Development Corp (IEDC) and Chief Executive Group—Craig Jackson and Scott Russell presented a portion of the C4L Bootcamp as a masterclass for smart manufacturing executives.
13
Facilitating AI for cybersecurity research CACR led a team piloting evaluation of a research prototype application designed to highlight collections of indicators, such as alerts, which represent attacker behavior during different types of cyberattacks, including novel attacker behavior. The ASSERT application, a collaboration with Ahmet Okutan and S. Jay Yang at Rochester Institute of Technology, uses theoretical-based measures to perform unsupervised learning from intrusion alerts across platforms. Over time, the system learns to build attack models, which may prove valuable for identifying attacks, determining their potential impact, and predicting future attacker behaviors. CACR worked closely with OmniSOC to validate the methodology and test the research prototype for use at OmniSOC for applicability to SOC workflows. The project used only data OmniSOC aggregated from IU as an exploration of machine learning approaches.
Leading the national conversation CACR continued its leadership role in providing forums to further the exchange of knowledge and ideas through hosting/co-hosting or conducting workshops at key community events. Even though 2021 continued with a strong virtual emphasis due to the pandemic, attendance and participation remained strong.
NSF Summit on Cybersecurity and Cyberinfrastructure In its role as the lead organization for Trusted CI, CACR hosted a virtual version of the annual NSF Cybersecurity Summit. Opened up to the public for the first time, the summit drew more than 325 registrants.
OmniSOC Lead Security Engineer Han Thazin Tun and CACR Principal Security Analyst Emily Adams represent IU at Women in Cybersecurity 2021 in Denver, Colorado
Engaging with Women in Cybersecurity (WiCyS) Led by CACR, Indiana University became a strategic partner of Women in Cybersecurity (WiCyS) in 2021 as part of its efforts to drive inclusion and diversity in the cybersecurity workforce. The strategic partnership augments IU’s ongoing support of the WiCyS annual conference, activities collectively supported by CACR, OVPIT, the Luddy School of Informatics, Computing, and Engineering, OmniSOC, the REN-ISAC, and the local IU WiCyS Student Chapter.
CISE Community Research Infrastructure Workshop In collaboration with colleagues at University of Virginia and George Washington University and with funding from the National Science Foundation, CACR co-led a workshop exploring how multi-campus data collection and sharing infrastructure could enable research by machinelearning cybersecurity and privacy researchers. This workshop explored use cases, sustainability and privacy, and operational cybersecurity concerns.
14
Trusted CI at PEARC21 participation Members of Trusted CI virtually presented a workshop on trustworthy scientific cyberinfrastructure and led a tutorial on security log analysis at the Practice and Experience in Advanced Research Computing (PEARC) conference.
Cybersecurity engagement in a research environment workshop In December, ResearchSOC held a free workshop addressing the challenges of providing cybersecurity for research projects in higher education. The “Cybersecurity Engagement in a Research Environment” workshop was led by CACR’s partners at the University of California San Diego. It was a training and development opportunity for researcher-facing cybersecurity professionals who are responsible for applying standard security operations to the heterogeneous research ecosystem to develop research-specific cybersecurity approaches at their home institutions. Forty higher education security professionals attended the three-day virtual event.
Trusted CI webinars In 2021, Trusted CI hosted 11 talks with 449 total attendees and more than 777 total views. In May, Trusted CI announced a podcast version of its webinar series that is now available on most podcast applications.
ResearchSOC webinars Throughout the year, ResearchSOC sponsored five webinars addressing key cybersecurity operational issues such as Framework implementation, vulnerability management, STINGAR and threat intelligence, Google Drive security, and ransomware.
Top: Michelle Mazurek participates in a Trusted CI webinar, “Investigating Secure Development In Practice: A Human-Centered Perspective.” Bottom: Ken Goodwin discusses vulnerability management during a ResearchSOC webinar.
15
LEADING INDIANA TO A MORE SECURE FUTURE In 2021, CACR continued to increase engagement and bring value to the Hoosier state. Introduced in Indiana’s Executive Council on Cybersecurity’s State of Cyber Report, CACR initiatives proved to be an integral piece in advancing the state’s leadership in cybersecurity. CACR is also a driver for economic growth in South Central Indiana and contributes to southeast Indiana’s job growth, both directly and indirectly.
Downtown Indianapolis along the White River
16
Securing the Hoosier vote The CACR-led IU team completed its election security project in early 2021–an effort that trained more than 30 county officials in developing and executing cybersecurity incident response plans and playbooks. Over the course of this initiative, the team disseminated materials and held bootcamps around the state for developing incident response plans. They also conducted training on media interaction. The effort was in collaboration with the Indiana Secretary of State and included students through the IU Cybersecurity Clinic.
Partnering with Indiana Economic Development Corp (IEDC) Indiana businesses are struggling with cybersecurity, and business leaders need sufficient cybersecurity knowledge to make sound decisions regarding cybersecurity priorities and investment. Through the IEDC and Chief Executive Group, CACR presented masterclasses for business leaders in 2021 and will continue to provide training specifically aimed at helping senior executives understand fundamental cybersecurity concepts, so that they can communicate, strategize, and make decisions.
CACR and NSWC Crane: An ongoing partnership CACR and NSWC Crane continue to work to improve capabilities in areas such as software assurance and trusted artificial intelligence. CACR established a working relationship with Crane’s new liaison to Indiana University, Alison Smith. In October, Program Director Craig Jackson presented a well-received session titled “Practical Cybersecurity” to the Department of Defense and Defense Industrial Base stakeholders. This presentation introduced CACR’s PACT assessments and C4L training.
Conducting Security Matters Cybercamps In June 2021 and in partnership with Wonderlab in Bloomington, Indiana, CACR held a virtual Security Matters Cybercamp for middle and high school students. The five-day camp session topics included network security, cryptography, data forensics, website vulnerabilities, and more and was attended
Top: The CACR-led IU team completed its election security project in early 2021 Bottom: An in-person Security Matters Cybercamp from a previous year
by 20 students from across 5 states. CACR also co-hosted a one-day in-person and virtual Security Collaboration Matters Cybercamp for college students with Indiana University’s Center of Excellence for Women & Technology.
17
LEADING IU TO HELP DRIVE DISCOVERY 2021 saw CACR providing new opportunities and facilitating key projects to further the university’s research mission while serving as a key force in achieving IU’s strategic objectives. SecureMyResearch’s rapid impact Securing research data has grown to be a major challenge for IU researchers and departments, especially meeting new and stricter regulatory cybersecurity requirements in grants, contracts, and data use agreements. To help researchers and other stakeholders who support research, in August 2020 IU launched SecureMyResearch, a service co-sponsored by the Offices of the Vice President for Information Technology (OVPIT) and the Vice President for Research (OVPR). SecureMyResearch marks the culmination of a decade-long effort that began with aligning IU’s research systems with HIPAA for biomedical research and leveraging them to create solutions for researchers. The service now plays a vital role in securing IU’s creative and research data. SecureMyResearch began with a vision to accelerate research at IU by reducing the cybersecurity and compliance burden on researchers. Metrics and testimonials from numerous engagements in 2021 show that this vision is now a reality. Securing research data is critical for IU researchers
18
2021 HIGHLIGHTS
Handled 211 service tickets covering nearly every research scenario.
Facilitated more than $130 million in sponsored research.
Invited to join the Social Sciences Research Commons (SSRC).
Achieved rapid service adoption. Assisted 460 researchers (equivalent to roughly 25% of all IU faculty) in 100 departments (70% of all IU academic departments and centers).
Became an integral resource for the Neurosurgery Clinical Research Services (NCRS).
Invited to be a key component in research software risk assessment for IRB submissions.
Became a critical resource for the Office of the Vice President for Research in resolving cybersecurity terms in grants, contracts, and data use agreements.
Helped researchers negotiate highly challenging Dept. of Defense (DOD) contract terms and conditions.
Expanded coverage beyond traditional, compliance-driven cybersecurity to areas such as physics, computer science, earth and atmospheric sciences, and social sciences. Performed outreach by preemptively reaching out to faculty and staff and giving presentations at faculty meetings and in departments. Provided holistic support by securing entire research workflows.
Established long-term relationships with more than 20 IU stakeholders that support research:
19
The Impact of SecureMyResearch “Reaching a landmark 460 researcher engagements in 100 departments in 2021 far exceeded our initial expectations, but it was just the tip of the iceberg. We ended up not only resolving individual issues but also establishing long-term relationships. Once researchers worked with us, they came back repeatedly when they encountered issues. We also became integrated into their research workflows, fulfilling another service hope. Our goal for 2022 is to continue the growth trend and serve even more researchers and increase collaborations with research support centers on campus.” Anurag Shankar, manager of the SecureMyResearch service at CACR
20
Anurag Shankar
“Thank you very much for helping us to navigate the challenges from the cybersecurity requirements presented in a site agreement between IU and two partners. I honestly don’t know how we would have resolved this matter without the service you offered.”
“I want to thank you again for your time and expertise with providing us with information about how best to ensure security for clinical and teaching encounters during the continued challenges of COVID. The suggestions and clarifications you provided were really helpful.”
Carolyn York, administrator, Neurosurgery Clinical Research Services, IU School of Medicine (IUSM)
Emily Delbridge, professor, Dept. of Family Medicine, IUSM
“Your help in relation to [our] study will have a cascading effect of making it possible to enable enterprise-level backups for our secure server, which hosts other research projects as well.” Emily Meanwell, clinical associate professor, Dept. of Sociology, and director, Social Science Research
“I would have been hopelessly lost without the assistance from you and your colleagues; and this comes from a reasonably tech savvy hard-core computer programmer.” Nicholas Port, associate professor, School of Optometry, IU Bloomington
Commons, IU Bloomington
“SecureMyResearch has been an invaluable resource for Research Contracting in ORA. We have utilized their expertise on a regular basis. We are receiving more and more contracts–both funded projects and data use agreements–that incorporate various third-party cybersecurity requirements, and the team is always available and willing to help us to think through the projects and find a way to comply.”
“The HIPAA office at IU would like it known that over the last year, SecureMyResearch has been pivotal in increasing the security posture of research at IU. The HIPAA office frequently refers researchers to the SecureMyResearch consulting services.” Jason Bozarth, university HIPAA security officer
Katie Morris, director of research contracting, IU Office of Research Administration (ORA) 21
2021 CACR SPEAKER SERIES Enabling secure health and defense research CACR provided consulting to researchers and the Office of Research Administration on Department of Defense contracts that involve Controlled Unclassified Information (CUI) and DFARS 252.204-7012 and CMMC regulatory requirements. Additionally, CACR oversees HIPAA compliance for IU’s central research and enterprise systems. CACR continued working and improving numerous UITS systems, using a rigorous institutional approval process CACR helped to develop. The process leverages the NIST Risk Management Framework (RMF) and NIST 800-53 controls for comprehensivness and provides a single, reusable process for HIPAA and FISMA. CACR continued to facilitate the HIPAA compliance effort for UITS.
Continuing to meet the challenges of the pandemic Challenges continue to persist with the pandemic, and university group meetings that are conducted online are still subject to Zoombombing (a crude practice that disrupts and maliciously interferes with a Zoom meeting). CACR led a collaborative outreach effort in response to multiple high-profile Zoombombing incidents at IU, providing proactive training for groups hosting publicly posted meetings. Direct outreach was provided to 21 groups at IU, including student groups and schools/departments. Efforts this year focused on providing consultation, training, and resources to Student Affairs offices and departmental Zoom support personnel at all IU campuses. This allowed for training and resources to be directly supplied at points-of-origin to student groups which are common targets of Zoombombing attacks.
Providing for-credit opportunities for Maurer students Initiated in 2018 as a collaboration between CACR and the IU Maurer School of Law, the CACRMaurer Student Affiliates program provides law students pursuing the Maurer Cybersecurity Certificate opportunities to work with CACR’s legal experts for a semester, receiving one credit. The students’ research topics impact cybersecurity and/or privacy law and develop deliverables (e.g., memos, whitepapers, presentations). Topics have included the California Consumer Privacy Act (CCPA); export control law as applied to research science; and privacy concerns relating to artificial intelligence.
22
The Speaker Series brings cybersecurity experts from across the nation to present their current research and real-world experiences to IU faculty, staff, and students. This year’s series continued virtually, and average attendance held firm at 45 attendees. These presentations can yield some exciting collaborations that bring together faculty researchers, students, and even professionals from the private sector. The Speaker Series exposes IU faculty and students to a variety of applied cybersecurity challenges and collaboration opportunities.
Co-hosts for the 2021 Speaker Series included: Hamilton Lugar School of Global and International Studies: Feb. 25, Sept. 2; Luddy School of Informatics, Computing, and Engineering: Feb. 25, April 8, Sept. 2; Kelley School of Business: March 25; Maurer School of Law: Oct. 21; Ostrom Workshop: Nov. 11
23
CACR LEADERSHIP TEAM, STAFF, AND FELLOWS CACR’s chief asset is its knowledgeable and dedicated
Administrative Director
administration, staff, fellows, and students. CACR prides
more than two decades of
itself on the professional diversity of its staff, each
Leslee Bohland has experience in management and accounting.
with unique skills and experiences that contribute to its expertise. CACR staff is made up of people from all disciplines, including computer science, informatics, accounting and information systems, criminal justice, law, organizational behavior, and public policy.
CACR Director, IU Executive
Program Director Craig
Director for Cybersecurity
Jackson focuses on
Innovation, and Associate
information security program
Vice President for Information
development and governance,
Security Von Welch has more
cybersecurity assessment
than a decade of experience
design and conduct, legal
developing, deploying, and
and regulatory impact on
providing cybersecurity for
information security and
private and public sector
cyber resilience, evidence-
high performance computing
based security, and innovative
and distributed computing
defenses.
systems.
24
Chief Security Analyst
Senior Security Analyst
Mark Krenz focuses on
Anurag Shankar provides
cybersecurity operations,
leadership in regulatory
research, and education. He
compliance (HIPAA, FISMA,
has more than two decades
and DFARS) and cybersecurity
of experience in system and
risk management. He has over
network administration and
two decades of experience in
serves as the CISO for the
providing research computing
ResearchSOC and deputy
services and building HIPAA-
CISO of Trusted CI.
compliant solutions for biomedical researchers.
Senior Project Manager Kelli
Chief Security Analyst Susan
Shute serves as executive
Sons focuses on secure
director of Trusted CI and
software engineering, ICS/
supports ResearchSOC and
SCADA security, operational
CACR’s election security
security practice for
engagement with the state of
research and development
Indiana. She has more than 15
organizations, and security
years of experience leading
for legacy technologies in
project teams, primarily in the
high-stakes applications. She
private sector.
serves as deputy director of the ResearchSOC.
25
26
CACR staff
Trusted CI Fellows 2021
CACR staff help manage the daily operations of the center. CACR staff
The Trusted CI Fellows program empowers members of the scientific
includes administrative, management, and external relations support, as well
community with basic knowledge of cybersecurity and the understanding of
as security and policy analysts.
Trusted CI’s services, and then has them serve as cybersecurity liaisons to their respective communities.
Ishan Abhinit
Asst. Deputy-CISO & Senior Security Analyst
Emily K. Adams
Principal Security Analyst
Dr. Elie Alhajjar
Army Cyber Institute
Brian Chase
Security Analyst
Michael Kyle
University of Delaware
Diana Cimmer
Events & Communications Manager
Deb McCaffrey
Michigan Medicine
Adrian Crenshaw
Senior Security Analyst
Amiya Maji
Purdue University
Austin Cushenberry
IT Support Specialist
Shuyuan Metcalf
Florida State University
Josh Drake
Senior Security Analyst
Matthew Peterson
Oregon State University
Will Drake
Senior Security Analyst (CACR CISO)
Mauricio Tavares
FABRIC and FAB
Tom Edelberg
Research Associate
Richard Wagner
University of California San Diego
Aditya Kanuparthi
IT Support Specialist
Ryan Kiser
Senior Security Analyst
Tori Richardson
Senior Administrative Assistant
Ranson Ricks
Senior Project Manager
Scott Russell
Senior Policy Analyst
Mike Simpson
Principal Security Analyst
Todd Stone
Business Development Director
Fellows and key liaisons
Explore the IU Cybersecurity Community
CACR has more than a dozen Fellows. Each one brings unique insights and
IU Office of the Associate Vice President for Information Security
connections to the center, allowing it to capitalize on the interdisciplinary strengths of IU and the broader community. Fellows represent a wide range of perspectives that include law, policy, ethics, and informatics. Mark Bruhn
IU former Associate Vice President for Assurance and Public Safety
L. Jean Camp
IU Luddy School of Informatics, Computing, and Engineering
Fred H. Cate
IU Maurer School of Law
Damir Cavar
IU College of Arts and Sciences, Department of Linguistics
Robert Cowles
Brightlite Information Security
Rachel Dockery
IU Maurer School of Law
Arjan Durressi
Department of Computer and Information Science, IUPUI
David P. Fidler
IU Maurer School of Law
Grayson Harbour
Faegre Baker Daniels LLP, Indianapolis
Daniel Hickey
IU School of Education
Apu Kapadia
IU Luddy School of Informatics, Computing, and Engineering
Asaf Lubin
IU Maurer School of Law
Nicholas Multari
Pacific Northwest National Lab, Washington
Steven Myers
Formerly of IU Luddy School of Informatics, Computing, and Engineering
Scott Orr
School of Engineering and Technology, IUPUI
Sagar Samtani
IU Kelley School of Business
Scott J. Shackelford
IU Kelley School of Business
Robert Templeman
Naval Surface Warfare Center Crane
Joseph Tomain
IU Maurer School of Law
XiaoFeng Wang
IU Luddy School of Informatics, Computing, and Engineering
Xukai Zou
Department of Computer and Information Science, IUPUI
informationsecurity.iu.edu GlobalNOC globalnoc.iu.edu Hamilton Lugar School of Global and International Studies hls.indiana.edu IU Cybersecurity Risk Management Program cyberrisk.iu.edu Kelley School of Business kelley.iu.edu Luddy School of Informatics, Computing, and Engineering luddy.indiana.edu Maurer School of Law law.indiana.edu OmniSOC omnisoc.iu.edu Ostrom Workshop ostromworkshop.indiana.edu REN-ISAC ren-isac.net
leading.iu.edu 27
2719 E. Tenth Street, Suite 231, Bloomington, IN 47408 (812) 856-0458 | cacr@iu.edu
cacr.iu.edu Primary support for CACR comes from the IU Office of the Vice President for Information Technology, the IU Office of the Vice President for Research, and the National Science Foundation. Additional support for activities in this report was provided by the Indiana Secretary of State, the Regenstrief Institute, and HathiTrust Research Center. We also acknowledge and thank the many organizations who support CACR through contracts and sub-awards.