Internet2 Update CSG at Yale University May 2017 PRESENTED BY: Florence D. Hudson, Senior Vice President and Chief Innovation Officer, Internet2

Internet2 Update Topics TIER – Kick the tires! Please… Update on IoT Systems Risk Management and TIPPSS since Virginia Tech / Internet2 presentation on TIPPSS for IoT at Duke CSG meeting Deliverables from IoT systems risk managment task force ITANA/Internet2 Enterprise IoT working group NTIA working groups Cybersecurity research Transition To Practice (TTP) acceleration Questions / Answers

TIER Development Process Community Workshop use cases/ requirements Community Developed Specifications Internet2 Contracted Software Development Internet2 Automated Testing Campus Functional Review &Testing TIER Development Process Iterative dev, test, review Assumes collaboration & tight integration with campus teams

Looking for TIER Tire Kickers Next Steps www.internet2.edu/media/cms_page_media/3614/Testing-and-adopting-TIER.pdf Operations Environment TIER Development Cycle Reviewing TIER and Providing Feedback Starting Discussions on Campus Input/questions email tier-adopters@internet2.edu

Trust, Identity, Privacy, Protection, Safety & Security TIPPSS - Trust, Identity, Privacy, Protection, Safety & Security – challenges for Internet of Things devices – update since Duke CSG Hacking an IoT device can have implications across multiple fronts: Trust, Identity, Privacy, Protection, Safety & Security Financial Physical Data Reputation

Initiatives to address TIPPSS challenges IoT Systems Risk Management Task Force – Deliverables at April 2017 Global Summit “Finding IoT devices connected to your campus network using Shodan, Censys” brochure “IoT Vendor Management Considerations for Higher Education” document All on Internet2 CINO wiki Joint ITANA/Internet2 Enterprise Managed IoT working group – Began 1Q17 – Join us U.S. National Telecommunications & Information Administration working groups - ongoing Microsoft Campus Connections Summit Initiatives – Cybersecurity learning hub - Began 1Q17 Collaborative Innovation Community CINC UP activities - ongoing Monthly CINC UP calls on pertinent topics, e.g., Blockchain, network segmentation for IoT Cybersecurity Research Transition To Practice Acceleration workshops/matchmaking - ongoing US NSF Early Concept Grant for Exploratory Research Join us on the path forward…email CINO@Internet2.edu

Full document available: Internet2 IoT Systems Risk Management Task Force: Recommends Initial Exposure Baselining via Shodan & Censys.io tools. Full document available: http://bit.ly/ShodanCensys

Internet2 IoT Systems Risk Management Task Force: Developed IoT Systems Vendor Management Considerations Document. This document is intended to provide different organizations within Higher Education institutions with items to consider as they engage with IoT systems vendors at the different phases of selection, procurement, deployment and management. IoT systems are selected, acquired and deployed by higher ed institutions through multiple paths. The historical acquisition approach of selection, acquisition, deployment and management of traditional enterprise IT systems through central IT is not sufficient for IoT systems. Questions to consider in organizational approaches to IoT systems and vendor management. Who will monitor and manage the device? Is there a data feed to the device? Who will create and support it? Who will secure it? Are there trust, identity, privacy, protection, safety and/or security considerations? Is there a patch and upgrade plan? Who will do the patching? Who manages the plan? Are there interdependencies between any of these IoT systems? Who manages that? Is there a separate network segment for the IoT devices? Is it air gapped? Full document available: http://bit.ly/IoTsysvendreq

Joint ITANA/Internet2 Enterprise IoT working group to determine and document: Where can the enterprise help to manage IoT? Who does management? Facilities Campus IT Purchasing Where and how to put management? The IP network? Data link layer controls? REST API’s What’s the business model? Governance Funding

U. S. National Telecommunications & Information Administration, U. S U.S. National Telecommunications & Information Administration, U.S. Department of Commerce Efforts Multistakeholder Process for IoT Security Upgradability and Patching Technical Capabilities and Patching Expectations Working Group Capabilities Group - Components of An Update Existing Standards, Tools, and Initiatives Working Group - IoT Standards Catalog Communicating Upgradability and Improving Transparency Working Group Incentives, Barriers, and Adoption Working Group Internet2 university, regional, CINO participants https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security

NSF EAGER: Cybersecurity Transition To Practice (TTP) Acceleration. Challenge Accelerate Transition To Practice (TTP) of NSF-funded later-stage cybersecurity research into R&E environments Scientific Impact Increase awareness of cybersecurity research & capabilities Accelerate cybersecurity TTP in the near- to mid-term to make cyberspace safer Identify cybersecurity needs to inform future NSF solicitations Solution Identify & assess NSF cybersecurity research inventory Interview researchers & practitioners Leverage Internet2 community to enable “matchmaking” Deploy webinars, portal, in-person events for researcher/IT matchmaking Identify cybersecurity needs/gaps Broader Impact Enable partnership for NSF TTP with other Federal agency programs to accelerate & streamline TTP pipeline Enable more diverse R&E pipeline partnering with Society of Women Engineers and others GOAL: Accelerate Transition To Practice (TTP) of NSF funded later stage cybersecurity research into operational Research & Education (R&E) environments through applied research pilot deployments Key Elements: Enable Internet2 to serve as a “matchmaker” between academic cybersecurity researchers and IT operational staff in the R&E community Increase awareness of cybersecurity research and capabilities for the R&E community Encourage and enable pilot deployments of later stage cybersecurity research by operational users in operational environments Accelerate cybersecurity transition to practice Develop insights and a framework to enable a sustainable Transition To Practice program Approach: Develop inventory of NSF cybersecurity awards and PI’s Identify research projects with potential for applied testing Identify potential users of the cybersecurity research Interview cybersecurity researchers, practitioners, universities, agencies Identify success stories, best practices, learnings, potential synergies, & collaborations Identify cybersecurity infrastructure needs/gaps from R&E users & leaders Create matchmaking events between researchers and operational users Develop materials, people/institutional network for matchmaking enablement Webinars, one-on-one matchmaking, in-person workshops/showcases JOIN US: SHOWCASE YOUR RESEARCH ON WEBINARS, INTERNET2 GLOBAL SUMMIT Contact us: cino@Internet2.edu Engage the extended R&E pipeline for broader impact Utilize virtual organization/online portal to enable future matchmaking Explore development of an end-to-end cybersecurity innovation and deployment pipeline including working with other agencies, enabling a sustainable cybersecurity TTP program Award Number: 1650445 Internet2 PI: Florence Hudson, SVP/Chief Innovation Officer

To join these efforts…email Questions & Answers… To join these efforts…email fhudson@Internet2.edu Or CINO@Internet2.edu @FloInternet2