A Science DMZ in Every Pot? Von Welch, Director Center for Applied Cybersecurity Research Pervasive Technology Institute A Science DMZ in Every Pot? National Research Platform Workshop August 8th, 2017 INDIANA UNIVERSITY

SECTION TITLE GOES HERE IF NECESSARY Who am I? Director, IU Center for Applied Cybersecurity Research cacr.iu.edu Director, NSF Cybersecurity Center of Excellence trustedci.org I work with a lot a lot of science projects on cybersecurity challenges and think a lot about how cybersecurity and science interact. I engage with scientists, science facilitators, and infosec folks to enable science.

SECTION TITLE GOES HERE IF NECESSARY My Main Points Networks to support science on campuses well exists: Science DMZs Scaling is blocked by social problems.

What would it take, from an information security perspective, to have networks suitable for science on every campus?

Science DMZs: Networks for Science Typical enterprise network is lots of small flows. Typical science network is a few large flows. Science DMZs optimize for the latter. http://www.es.net/assets/pubs_presos/sc13sciDMZ-final.pdf

https://academic.oup.com/jamia/article/23/6/1199/2399316/The-Medical-Science-DMZ#

So, What’s the Problem?

The use of dedicated systems for data transfer “A Science DMZ integrates four key concepts into a unified whole that together serve as a foundation for this model.  These include: A network architecture explicitly designed for high-performance applications, where the science network is distinct from the general- purpose network The use of dedicated systems for data transfer Performance measurement and network testing systems that are regularly used to characterize the network and are available for troubleshooting Security policies and enforcement mechanisms that are tailored for high performance science environments” https://fasterdata.es.net/science-dmz/

The Research Computing Facilitator says… “Science DMZs are great! They optimize the network for large science flows, removing the friction, and make data movement fast!”

The Information Security Officer hears… “We get rid of the firewall and…” https://www.linkedin.com/pulse/how-speak-call-center-la-charlie-browns-teacher-hans-fleischer

So, What’s the Solution? https://commons.wikimedia.org/wiki/File:RosettaStone.png

We need to shift the conversation Cybersecurity is too often ONLY about the technology or compliance. This makes it rigid and inflexible.

Shifted conversation The goal of cybersecurity is to support a mission by managing risks to IT. Research and Science is part of mission in the same way things in Enterprise are part of mission.

Cast in this light… An enterprise network with cybersecurity to support the enterprise applications, services, data, network flows, etc. and… A science network with cybersecurity to support science applications, services, data, network flows, etc. makes sense.

To Scale we need the right people to say it This is hard, most CIOs and CISOs learn enterprise first. “Social Peer-to-peer” is the most effective social mechanism to foster acceptance. Need to identify the infosec early adopters (who may already have adopted) and get early success stories out from them to their peers.

cacr.iu.edu / trustedci.org Thank you. Von Welch vwelch@iu.edu cacr.iu.edu / trustedci.org We thank the National Science Foundation (grant 1547272) for supporting our work.