HPC Security Orientation

HPC Security Orientation

Welcome

This mandatory workshop covers essential security practices and policies for using Sagehen HPC cluster. Completion is required within 30 days of account activation.

Callout

Pomona College HPC Context

This workshop is part of the Pomona College Research Computing Workshop Series for researchers using the Sagehen HPC cluster.

Prerequisites: - Active Sagehen HPC account (mandatory training required by ITS Policy 24 and NIST SP 800-171) - This is mandatory training for all HPC users - Access to the OnDemand portal

For questions or support, contact the Research Computing team at its-hpc@pomona.edu.

Requirement

All new HPC users at Pomona College must complete this training within 30 days. Failure to complete will result in account suspension.

What You’ll Learn

In this workshop, you will understand:

• Your responsibilities as an HPC user
• Pomona’s Acceptable Use Policy for computing resources
• Authentication methods and access controls
• Data classification and handling requirements
• How to recognize and report security incidents
• Where to get help with security questions
• How to recognize and respond to social engineering and phishing

Workshop Structure

1. Welcome and Responsibilities - Your role in HPC security
2. Acceptable Use Policy - What you can and cannot do
3. Authentication and Access - Staying secure online
4. Data Handling Basics - Protecting research data
5. Incident Reporting - What to do if something goes wrong
6. Getting Help - Resources and contacts
7. Social Engineering and Phishing - Recognize and resist human-targeted attacks (NIST SP 800-171 controls 3.2.2 / 3.2.3)

Total time: Approximately 2 hours

Success Criteria

To complete this workshop, you must: - Complete all 7 episodes - Understand data classification levels - Know how to report security issues - Acknowledge Acceptable Use Policy - Be able to recognize phishing and social engineering attempts

Critical Information

• Account suspension deadline: 30 days from account creation
• Mandatory for: All new HPC users
• No exceptions: Account will be suspended without completion
• Compliance required: Both policy understanding and signature

Let’s begin with Episode 1!

Acknowledgments

Developed by Andrew Wilson, Director of Research Computing and Digital Scholarship at Pomona College, with Andrei Motchenko, who tested, edited and produced screenshots for the workshop series.

	Setup Instructions	Download files required for the lesson
Duration: 00h 00m	1. Welcome and Your Responsibilities	What does HPC security mean? What are your responsibilities as an HPC user? Why does account suspension happen without security training? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 00h 20m	2. Acceptable Use Policy	What activities are allowed on Sagehen HPC? What is strictly prohibited? How are policy violations handled? What counts as “appropriate use”? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 00h 50m	3. Authentication and Access Control	How do you secure your HPC account? What is multi-factor authentication? Why is DUO MFA required? How do you protect your password?
Duration: 01h 20m	4. Data Handling Basics	What are data classification levels? How should different data be stored? When is encryption required? What is restricted data? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 01h 50m	5. Incident Reporting and Response	What constitutes a security incident? How do you report suspicious activity? What happens after you report an incident? What should you NOT do if you suspect a breach? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 02h 15m	6. Getting Help and Resources	Who do you contact for security questions? What documentation is available? How do you get security training updates? What if you have questions about this training? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 02h 35m	7. Social Engineering and Phishing	What is social engineering and why are HPC users targeted? How can you recognize phishing attempts? What should you do when you suspect a phishing attack? How does insider threat awareness fit into HPC security? ::::::::::::::::::::::::::::::::::::::::::::::::
Duration: 03h 10m	Finish

The actual schedule may vary slightly depending on the topics and exercises chosen by the instructor.

HPC Security Orientation - Setup Guide

Welcome to Mandatory HPC Security Training

This training is required for all Sagehen HPC users and must be completed within 30 days of account creation. Account suspension is automatic for non-completion.

Before Starting This Training

Prerequisites

You must have: - Active Pomona College account: An email @pomona.edu and password - HPC account on Sagehen: Request from its-hpc@pomona.edu if you don’t have one - Access to this training material: Available through OnDemand or linked from HPC website - Time to focus: 1.5-2 hours without interruptions - Notepad: For taking notes on policies and contacts

Pre-Training Checklist

Checklist

Account and Access

• I have an active Pomona @pomona.edu email account
• I have or am requesting an HPC account
• I can access OnDemand (https://ondemand.hpc.pomona.edu/) or have SSH access
• I know my Pomona username and password

Preparation

• I have read the Acceptable Use Policy (see resources below)
• I have 1.5-2 hours of uninterrupted time
• I have a notepad or digital document for notes
• I have identified my PI or lab manager
• I understand this is mandatory training

Important Documents to Review

Before the training, please review these key policies:

1. Acceptable Use Policy (AUP)

The Acceptable Use Policy governs how Sagehen can be used. Summary: - HPC resources are for approved research and educational use only - Your PI or department must authorize your research - You are responsible for accounts in your name - Prohibited: illegal activity, harassment, resource waste, sharing accounts - Violations can result in account suspension or legal action

Location: Check your email for AUP link, or ask its-hpc@pomona.edu

2. Data Classification Policy

Pomona College classifies data into three tiers:

PUBLIC: Already published, freely shareable - Examples: Published papers, open datasets - Storage: Anywhere - Encryption: Not required

PROPRIETARY: Confidential, restricted to authorized individuals - Examples: Draft papers, lab notes, unpublished research, novel algorithms, pre-publication data - Storage: Sagehen - Encryption: Recommended (gocryptfs) - Sharing: Only with authorized people or under NDA

RESTRICTED: Legally protected information - Examples: FERPA (student records), HIPAA (health data), genetic data with IDs - Storage: Sagehen only - Encryption: REQUIRED (gocryptfs or VeraCrypt) - Sharing: Only with Data Use Agreement

You’ll learn to classify your own data during training.

3. Your Institution’s Regulations

Familiarize yourself with: - FERPA: If you work with student records - HIPAA: If you work with health/medical data - Export Control: If your research involves certain technologies - IRB: If your research involves human subjects

Required Training Topics

This training covers:

1. Why Security Matters (15 min)
   • Real data breach scenarios
   • Costs and consequences
   • Everyone’s responsibility
2. Acceptable Use Policy (20 min)
   • What you can/cannot do with Sagehen
   • Account sharing (prohibited)
   • Appropriate vs. inappropriate use
3. Passwords & Authentication (20 min)
   • Creating strong passwords
   • Using DUO Multi-Factor Authentication
   • What to do if credentials are compromised
4. Data Classification & Protection (20 min)
   • Three data tiers explained
   • Storage requirements per tier
   • Encryption basics
   • Access control and permissions
5. Incident Reporting (15 min)
   • How to recognize security incidents
   • How to report them (no-blame policy)
   • Who to contact and what information to provide
6. Resources & Summary (10 min)
   • Key contacts and where to get help
   • What you must acknowledge before using Sagehen

What You’ll Need During Training

• Pomona username (part before @pomona.edu)
• Access to your email (for any verification)
• Notepad: Write down important contacts
• Commitment: This is important; please focus and ask questions

After Completing Training

You will be asked to acknowledge: - You’ve read and understand the Acceptable Use Policy - You understand data classification (three tiers) and its requirements - You accept responsibility for your account security - You know how to report security incidents - You understand violations can result in account suspension

Your completion will be documented and required for account activation.

Emergency Contact Information

Save these contacts before starting:

Callout

Key Contacts for Security and Incidents

• HPC Security/Support: its-hpc@pomona.edu
• ITS Help Desk: See Pomona directory or email servicedesk@pomona.edu
• Incident Reporting: its-hpc@pomona.edu (no-blame, non-punitive)
• Compliance Questions: Contact your department chair or research compliance office
• IRB (Human Subjects): Research Compliance office (see department)

In case of suspected compromise: 1. Change your password immediately 2. Contact its-hpc@pomona.edu with details 3. Monitor your account for unusual activity 4. Follow any guidance from HPC staff

Questions Before Starting?

• About this training: Email its-hpc@pomona.edu
• About your account: Contact ITS Help Desk
• About your research’s data classification: Ask your PI or email its-hpc@pomona.edu
• About policies: See the links provided above

How This Training Works

• This is self-paced: Work at your own speed
• Episodes build on each other: Complete in order
• Hands-on exercises: You’ll complete practical scenarios
• Key takeaways: Marked clearly for review
• Mandatory acknowledgment: At the end, you’ll confirm understanding

Time Management

Plan for: - Total time: 1.5-2 hours - Per episode: 15-20 minutes each - Breaks: Take breaks if needed; you can pause and resume - Note-taking: Budget extra time if you take detailed notes

Making the Most of This Training

1. Read carefully: Policies matter; don’t skim
2. Take notes: Write down contacts, key rules, classification examples
3. Ask questions: During workshop or email afterward
4. Think about your data: How will you classify the data you work with?
5. Plan ahead: Before you need encryption, understand how it works

This training protects you, your research participants, Pomona College, and the broader research community. Thank you for taking it seriously.

Let’s begin!