Security Standards on HPC

"The Database of Genotypes and Phenotypes (dbGaP) was developed to archive and distribute the data and results from studies that have investigated the interaction of genotype and phenotype in Humans." By definition therefore, it contains human subject data that, while somewhat anonymized, is still considered sensitive and therefore requires additional electronic safeguards for use. These requirements are described in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH Genomic Data Sharing (GDS) Policy paper.

The requirements listed therein have been re-worked into a summary mapping paper by John Denune of the UCI Security Team. Many of the proposed security enhancements in it are described in more detail below.

(NB: John has to to provide the actual doc).

The Cancer Genome Atlas is a data collection similar to dbGap in terms of scope and complexity, but focussed on cancer specifically. As such, it also contains much human data, also similarly anonymized, but also unavoidably contains personally identifiable traits. Since it is also an NIH project, the release and analysis of that data is covered by the same security restrictions as dbGaP (see above).

The Health Insurance Portability and Accountability Act of 1996 ( aka HIPAA). The part that concerns us is Title II, (unironically called Administrative Simplification provisions) which describes the computer protocols, security that involve the transfer of medical records and especially the penalties for their breach. The information concerns Personal Health Information (PHI) which is defined as "any information that is held by a covered entity regarding health status, provision of health care, or health care payment that can be linked to any individual". While originally, the covered entity referred to Health Insurance and Billing companies and Health Care Providers, the scope has been expanded to any organization that holds PHI data. And since PHI often covers genomic information, this is of concern to UC Irvine.

There are levels of anonymization that can take place with such data and PHI is generally attributed to information relating to Electronic Medical Records (EMR) as opposed to raw data such as the aggregated (tho de-identified) genomic information in dbGaP and TGCA. There is an inherent problem with this dichotomy since genomic information, when coupled with the kind of metadata provided by dbGaP and TGCA provides a statistical narrowing of possibilities and when cross-matched with other information, can be used to identify the supposedly anonymous data. So, while it is not as sensitive as actual EMR, it cannot be defined as Open Source Data and must therefore be protected.

Federal Information Security Management Act (FISMA) refers to the regulatory act that created several levels of computer security. FISMA is not a single set of security guidelines, but a requirment that each Federal government agency define security regulations that must be implemented to host the various data types under its control. As such, it is complex, contradictory, expensive to implement and audit. It calls for not only a census of the hardware and software that make up computer systems and networks under its control, but also the classifications and protections of all the data types. Some of the documentation describing this process is listed here.

The 2 data types below are examples of how various Federal and State goverments have addressed the FISMA requirements.

UCI’s Lightpath 10GbE data network was funded by the NSF, starting in 2016 and one of the criteria for funding was that firewalls were forbidden as constricting for the high speed data transfer. This leaves only Access Control Lists (ACLs) at the border router as constraining ingres.

However, while HPC does have direct connection to the LightPath network, no such nodes allow inbound connection on the LightPath DMZ; only outbound connections are allowed.

RCIC is investigating high-speed firewalls which could sustain full 10Gbs wirespeed and are testing some. Implementation will depend on agreement and synchronzation with the UCI Security Team.

We can create specific encrypted partitions on the HPC filesystems if required, but entire filesystems are not Encrypted At Rest (EAR) or by default, since theft of a multi-rack, multi-chassis distributed parallel filesystem is a fairly rare event. Usually the encrypted partitions are created on private filesystems on the owners' servers where they are invisible to other-groups. We can provide ecryptfs partitions so that the owner can decrypt the data on login with a passphrase and not even the sysadmins can view the data. If data requires backup, it is backed up encrypted, so that clear-text data is never visible.

HPC does not provide sophisticated web services such as Galaxy, PacBio’s SmrtAnalysis web interface, or Partek’s FLOW system. We do provide a single containerized instance of the The Virtual Brain to a research group with a reverse-proxied connection.

HPC currently hosts a single web server that provides access to static documentation and to files that users want to share with collaborators . The latter service is provided to all users, as part of a web-available but non-browseable part of the filesystem. Ie, the user has to send the collaborator an explicit link to the file being shared; users cannot look around the filesystem, although they can download the files without a password.

This system is in the process of being moved from an HPC-associated server to one on another network to isolate the HPC system. It will provide the same services, but not directly from an HPC-associated IP address. The required hardware has been ordered and we anticipate separation of the service will be complete in September, 2018.

We are testing a number of systems that monitor changes to specific files by comparing checksums to a database of previously verified files (the archetype of such systems is tripwire, which has become a commercial product and therefore quite expensive. This is in progress.