Re: NSF Data Management Plans

[Steve Brukbacher <sab2 () UWM EDU>]

Hi Joe,
Thanks for the very thoughtful response.  You gave me a lot to think 
about and to discuss with our group.  The goal for us right now is to 
figure out what we'll need to provide for researchers so they are able 
to comply with the NSF's data sharing requirements.  They are/will be 
requiring "data management plans" in order to gain NSF funding for 
research. This is being driven by the open government directive (NSF's 
plan for complying with this is documented here)

http://www.nsf.gov/pubs/2010/nsf10049/nsf10049.pdf

My challenge right now, and I suspect the challenge of many other higher 
ed security professionals, is evident on p. 4. where they state that the 
goal is to make data as widely available as possible.  However, we know 
that there are criteria for data security and privacy on a number of 
levels. I haven't seen much mention by the NSF regarding the need to be 
sensitive to privacy needs while complying with the open government 
directive.  We've also not been able to get a solid answer from them in 
form of a template or the questions that need to be answered in one of 
these plans, although I'm told that there is an immediate need for this 
information.

My main focus will be a simple one: security standards and compliance 
requirements such as those in HIPAA, for example, still apply in 
addition to the need for broader data publication.

Related to this, Educause is hosting an Educause Live session based on 
work being done at Princeton

http://net.educause.edu/content.asp?SECTION_ID=554

--
Steve Brukbacher, CISSP
Information Security Officer
University of Wisconsin Milwaukee
www.security.uwm.edu
Direct Phone: 414.229.2224
Security Office: 414.229.1100

On 8/5/10 4:31 PM, Joe St Sauver wrote:
> Steve Brukbacher<sab2 () UWM EDU>  mentioned (in connection with new required
> NSF data sharing plans):
>
> #The changes are designed to address trends and needs in the modern era
> #of data-driven science. "Science is becoming data-intensive and
> #collaborative," notes Ed Seidel, acting assistant director for NSF's
> #Mathematical and Physical Sciences directorate. "Researchers from
> #numerous disciplines need to work together to attack complex problems;
> #openly sharing data will pave the way for researchers to communicate and
> #collaborate more effectively."
> #
> #We're looking at how to assist researchers with this.  Has anyone
> #established any security strategies related to this new requirement?
>
> I could see a number of different aspects to that question. Are you
> primarily concerned about:
>
> -- research dataset provenence and integrity (in a nutshell, how do I
>     know that the dataset I think I just retrieved is the one that I
>     think it is, and that it hasn't been accidentally or intentionally
>     altered since it was created? Yes, you could checksum the file, but
>     is that enough?)
>
> -- dataset documentation (getting a dump of a dataset doesn't do much
>     good if you don't know how the data was collected and coded,
>     including any inherent limitations to the data, etc. -- in the bad
>     old days when I was providing statistical research support for
>     faculty members and grad students, I have to admit that I
>     occaisionally saw datasets received from offsite that suffered from
>     woefully incomplete and insufficient documentation (presumably
>     because some researchers are like bad programmers, deferring
>     documentation until they "get a couple of minutes," only to never
>     have that quiet time actually turn up).
>
> -- or was it more a matter of insuring you simultaneously protect any
>     sensitive data elements (such as human subjects data) while also
>     meeting the NSF's new open access requirements (e.g., questions
>     about how to handle data anonymization schemes, access control
>     and logging, or related sorts of things)?
>
> -- other sites might be interested in monitoring data assets for
>     abuse and misuse (conceptually imagine a dataset released
>     for non-profit research use (only), which subsequently gets
>     commercially exploited without permission) -- obviously it
>     can be tricky to find and prove these sort of things, although
>     reportedly some information providers have been known to "salt"
>     things like maps with harmless but non-existent features
>     they've made up -- if you have the bad luck to blindly copy
>     the fictitious feature, well, they arguably have you dead to
>     rights
>
> -- potentially some research data might be export controlled, and
>     some sites might want to insure that they don't inadvertently
>     allow proscribed foreign nationals access to export controlled
>     information
>
> -- librarians and archivists take a unique long term view, worrying
>     about accessibility and usability of information assets decades or
>     even centuries in the future, and have been known to insist on
>     multiple distributed copies of information assets for redundancy
>     and survivability in the event of adverse events (whether that's
>     fire, flood, institutions going out of business, people getting
>     rid of their last 9 track tape drives or 8" floppy drives, spinning
>     media crashing or non-archival magnetic media deteriorating over
>     time, etc.)
>
> -- Or is your query specific to system and network security-related
>     datasets that your researchers may be working with? (If the later,
>     I'd mention that we'll be having the 2nd Data Driven Collaborative
>     Security Workshop for High Performance Networks later this month,
>     and as you might expect from the title, methodological and
>     substantive data-driven collaborative sharing issues relating to
>     security data will likely be "center stage" during those sessions,
>     as they were for the first DDCSW last year, see
>     http://security.internet2.edu/ddcsw/ )
>
> Anyhow, love to hear more about the specific areas related to this
> topic that you or others may be particularly interested in... I think
> it's a fascinating (but potentially immense) topic, so narrowing in
> on the particular aspects you're most interested in would probably
> be a key first step.
>
> Regards,
>
> Joe St Sauver (joe () oregon uoregon edu or joe () internet2 edu)
> Internet2 Security Programs Manager
> http://www.uoregon.edu/~joe/