1. Enterprise Data Decentralized Control, Data Security and Privacy Data Encryption Data Encryption Information Sharing/Protection of Research Data Information Sharing/Protection of Research Data Next Steps Next Steps Michael Pickett - Duke Michael Pickett - Duke

2. Data Encryption – Some Tools Linux EncFS AES-128/256 or Blowfish Linux EncFS AES-128/256 or Blowfish http://arg0.net/wiki/encfs http://arg0.net/wiki/encfs http://arg0.net/wiki/encfs Mac FileVault – AES-128 Mac FileVault – AES-128 http://www.apple.com/macosx/features/filevault/ http://www.apple.com/macosx/features/filevault/ Windows (XP SP1+) Encrypting File System – AES-256 or 3DES Windows (XP SP1+) Encrypting File System – AES-256 or 3DES http://www.windowsecurity.com/articles/Where_D oes_EFS_Fit_into_your_Security_Plan.html http://www.windowsecurity.com/articles/Where_D oes_EFS_Fit_into_your_Security_Plan.html http://www.windowsecurity.com/articles/Where_D oes_EFS_Fit_into_your_Security_Plan.html http://www.windowsecurity.com/articles/Where_D oes_EFS_Fit_into_your_Security_Plan.html

3. Information Sharing/Protection of Research Data NSB - LONG-LIVED DIGITAL DATA COLLECTIONS NSB - LONG-LIVED DIGITAL DATA COLLECTIONS http://www.nsf.gov/nsb/documents/2005/LL DDC_report.pdf http://www.nsf.gov/nsb/documents/2005/LL DDC_report.pdf http://www.nsf.gov/nsb/documents/2005/LL DDC_report.pdf http://www.nsf.gov/nsb/documents/2005/LL DDC_report.pdf

4. NSB - LONG-LIVED DIGITAL DATA COLLECTIONS What data do we not want to lose? What data do we not want to lose? Data deemed useful over long period (data we would desire to migrate across tech generations) Data deemed useful over long period (data we would desire to migrate across tech generations) Importance defined by peers (e.g. Protein Data Bank) Importance defined by peers (e.g. Protein Data Bank) Metadata required to make the raw data useful and to replicate findings (derived data?) Metadata required to make the raw data useful and to replicate findings (derived data?) Are we worried about intruders altering data that our researchers collect or use? Are we worried about intruders altering data that our researchers collect or use?

5. Current Policy Examples Earth/Ocean Sciences – 2 yrs to deposit in national data center Earth/Ocean Sciences – 2 yrs to deposit in national data center Cognitive Brain Science – 1 year to deposit in library or data archive Cognitive Brain Science – 1 year to deposit in library or data archive NIH – grant must include data sharing plan if > $500K (data to replicate – not summaries) & PI keeps data for 3 years after grant ends NIH – grant must include data sharing plan if > $500K (data to replicate – not summaries) & PI keeps data for 3 years after grant ends

6. The Future Recommendation 4: The NSF should require that research proposals for activities that will generate digital data, especially long-lived data, should state such intentions in the proposal so that peer reviewers can evaluate a proposed data management plan. Recommendation 4: The NSF should require that research proposals for activities that will generate digital data, especially long-lived data, should state such intentions in the proposal so that peer reviewers can evaluate a proposed data management plan. Building policy and infrastructure to help researchers do this will be a competitive advantage (for securing faculty and grants) Building policy and infrastructure to help researchers do this will be a competitive advantage (for securing faculty and grants)

7. Next Steps Are security breaches at colleges and universities on the rise? Are security breaches at colleges and universities on the rise? What are we doing to address the protection (privacy, security, integrity) of information? What are we doing to address the protection (privacy, security, integrity) of information? Are there things we should be doing differently than industry and government? Are there things we should be doing differently than industry and government? What infrastructure (technology, procedures, policy, templates) should we provide for our schools? What infrastructure (technology, procedures, policy, templates) should we provide for our schools?