This is a little story about four people named Everybody, Somebody, Anybody, and Nobody. There ...

103 Pages·2011·7.62 MB·English

by  Ardoth Hassler

This is a little story about four people
named Everybody, Somebody,
Anybody, and Nobody.
There was an important job to be done
and Everybody was sure that
Somebody would do it.
Anybody could have done it, but
Nobody did it.
Somebody got angry about that
because it was Everybody's job.
Everybody thought that Anybody could
do it, but Nobody realized that
Everybody wouldn't do it.
It ended up that Everybody blamed
Somebody when Nobody did what
Anybody could have done

* Poster from US
1
Department of Commerce
Best Practices in
Cybersecurity that
Might Be Useful to
NSF Large Facilities
“Cybersecurity is now a major
national security problem for the
United States.”
3
“…America's economic
prosperity in the 21st century
will depend on cybersecurity.”
President Barack Obama
Washington, DC
May 29, 2009
4
“Throughout the developed world,
governments, defense industries, and
companies in finance, power, and
telecommunications are increasingly
targeted by overlapping surges of cyber
attacks from criminals and nation-states
seeking economic or military
advantage.”
– SANS Institute
http://www.sans.org/top-cyber-security-risks/
"The government is not going to
secure the private sector.
[But] we are making sure our
[private sector] partners have
more security as part of what
we’re doing.”
- Howard Schmidt
White House Cybersecurity Coordinator
RSA Conference March 2, 2010
6
Introduction
Community has asked for guidance on cybersecurity
 
Cybersecurity Summit Meetings*
 
First Summit held after a major incident affected multiple large
 
facilities
Opportunity to gather PIs and security professionals with program
 
directors
Fifth Summit held September 2009
 
Next Summit is pending
 
Summit outcomes have resulted in:
 
Closer workings within the community
 
NSF developing language about cybersecurity for the Cooperative
 
Agreements
This presentation is a work in progress.
 
Your feedback is most welcome.
 
* Funded by NSF
7
8
What is at stake…
Lost productivity
 
TeraGrid
 
Supports around $300M+ in research annually*
 
STAKKATO Incident ca. 2003-2004
 
McAfee DAT 5958
 
Worldwide impact April 2010
 
Not the first time this has happened
 
* Information provided by John Towns, NCSA A Work in Progress 9
What is at stake…
Expensive incident response and
 
notification
Laptop stolen from public west-coast research
 
university:
$750K out of pocket
 
Research server breach at private east-coast
 
research university:
$200K out of pocket
 
External hard drive stolen containing student
 
and alumni data from a locked office at
research university:
$1M out of pocket
 
10