NCSA wiki will be offline Friday, Apr 19, 2024, from 1700 hours until Sun, Apr 21, 2024 in order to upgrade Confluence.
Blue Waters Supercomputer
Blue Waters is the largest and fastest system ever developed for the National Science Foundation. It has served thousands of engineers, scientists and educators across the nation over the past few years, in particular, those who scientists with unique jobs that can't be served by other systems. With tens of thousands of nodes and 450 Gbps of external WAN connectivity on an open network, Blue Waters presents a unique set of challenges to secure.
NCSA CyberSecurity team worked to redesign security from the ground up with this new system and the National Petascale Computing Facility during the 5 years going up to full operations. Using risk based methods to develop a new security program and architecture, we have achieved the gold standard of security in the community of NSF cyberinfrastructure being the first system to require two-factor authentication, designing and deploying one of the first 100Gbps network monitoring infrastructures with the Bro IDS, and testing many other security technologies at unprecedented scale.
Bro Network Security Monitor
NCSA and the International Computer Science Institute co-develop the Bro NSM with the work at NCSA being led by CyberSecurity's Adam Slagell. Bro provides a comprehensive platform for network traffic analysis, with a particular focus on semantic security monitoring at scale. While often compared to classic intrusion detection/prevention systems, Bro takes a quite different approach by providing users with a flexible framework that facilitates customized, in-depth monitoring far beyond the capabilities of traditional systems. With initial versions in operational deployment during the mid ‘90s already, Bro finds itself grounded in more than 20 years of research. For more information, see the Bro Overview and our promotional document, Why Choose Bro?
Center Cyber-protection
Cybersecurity at NCSA provides for the protection of the center's digital assets and those of key partners through the many services we provide. We have a 24/7 incident response team that performs full digital forensics and coordinates with law enforcement and other institutions. Preventative security is provided by our vulnerability management program, risk assessments & security architecting, automatic blocking, and more. We run over 60 servers to provide the monitoring, logging and other security services, including one of the largest production Bro clusters in the world. The CyberSecurity division is also responsible for training staff, notifying reliant parties of new vulnerabilities, creating policies and much more security awareness work. Finally, we participate in several organizations and maintain collaborations with XSEDE, CERN, and others in the community.
Center for Trustworthy Scientific Cyberinfrastructure
The activities of the Center for Trustworthy Scientific Cyberinfrastructure (CTSC) include one-on-one engagements with NSF projects to address their cybersecurity challenges; education, outreach, and training to raise the state of security practice across the scientific enterprise; and leadership on bringing the best and most relevant cybersecurity research to bear on the NSF cyberinfrastructure research community.
CILogon
The CILogon project enables use of federated identities by science projects. The project develops open source software that implements security standards including OAuth, SAML, and X.509. CILogon is an InCommon federation research and scholarship service provider that enables federated access to Globus, OSG, LIGO, XSEDE, and other cyberinfrastructure.
FeduShare
The FeduShare project is developing a user-managed collaboration framework to enable federated access to cyberinfrastructure, including remote shell (SSH) login to campus clusters.
Software Assurance Marketplace
The Software Assurance Marketplace (SWAMP) provides a no-cost, high-performance, centralized cloud computing platform that includes an array of open-source and commercial software security testing tools, as well as a comprehensive results viewer to simplify vulnerability remediation. A first in the industry, the SWAMP also offers a library of applications with known vulnerabilities, enabling tool developers to improve the effectiveness of their own static and dynamic testing tools. Created to advance the state of cybersecurity, protect critical infrastructures, and improve the resilience of open-source software, the SWAMP integrates security into the software development life cycle and keeps all user activities completely confidential.
XSEDE Federation
XSEDE is a federation of service providers and virtual organizations that have come together to bring high-performance computing to scientists at research institutions across the U.S. The mission of XSEDE is to enhance the productivity of scientists and engineers by providing them with new and innovative capabilities and thus facilitate scientific discovery while enabling transformational science/engineering and innovative educational programs.
The XSEDE project is led out of NCSA, and the security operations team in particular is co-led by NCSA CyberSecurity director Adam Slagell and Jim Marsteller at PSC. Jim Basney of NCSA's CyberSecurity division is also the security lead for XSEDE's Software Development and Integration division, driving many of the IdM and security projects like the single-sign-on hub and Duo two-factor authentication integration.
AttackTagger
AttackTagger is a sophisticated log analysis tool designed to find potentially malicious activity, such as credential theft. AttackTagger will integrate with existing security software so as to be easily deployable within existing security ecosystems and consume a wide variety of system and network security logs. AttackTagger accomplishes advanced pattern matching by utilizing a Factor Graph model--capturing sequential relation among events and enables integration of the external knowledge, e.g., expert knowledge or a user profile. The cyber-infrastructure that supports science research faces the daunting challenge of defending against cyber attacks. Modest to medium research project teams have little cyber security expertise to defend against the increasingly diverse, advanced and constantly evolving attacks. Even larger facilities that have with security expertise are often overwhelmed with the amount of security log data they need to analyze in order to identify attackers and attacks, which is the first step to defending against them. AttackTagger can scale to be able to address the dramatic increase in security log data, and detect emerging threat patterns in today's constantly evolving security landscape.
Science DMZ Actionable Intelligence Appliance (SDAIA)
SDAIA aims to secure cyber-infrastructure and provide the cybersecurity research community with a rich, real-world intelligence source upon which to test their theories, tools, and techniques. Our efforts are in response to recent NSF investment and efforts by ESnet that have spurred a rapid growth of open high performance networks or so-called Science DMZ deployments. Science DMZs support big data and access to high-performance computation through very high bandwidth networks in an open environment that presents new challenges to the traditional university security stance. SDAIA will provide a holistic approach that will address the special Science DMZ architecture through a new kind of virtual security appliance that will benefit from external, shared intelligence to protect the site, and further provide intelligence to the wider community of both DMZ operators and cybersecurity researchers. This appliance will leverage existing technologies; be easy to deploy, configure, and maintain; integrate with common Science DMZ services, and be built upon free and open source software for affordability and flexibility.