Key Points

Welcome and Your Responsibilities

  • HPC security protects your research, your collaborators, and students
  • Security is a shared responsibility between staff and users
  • This mandatory training ensures everyone understands their role
  • Account suspension without training completion is not arbitrary
  • Your ongoing vigilance is the strongest security measure

Acceptable Use Policy

  • Acceptable use means research/education only, approved by PI
  • Sharing accounts, illegal activity, and harassment are automatic violations
  • Minor violations result in warnings; serious violations in account suspension
  • Severe violations may result in police involvement
  • Always ask if you’re unsure
  • You acknowledge this policy by using the cluster
  • Reporting violations helps protect the community

Authentication and Access Control

  • Strong, unique passwords are essential; use a password manager
  • DUO Multi-Factor Authentication adds critical security layer
  • Phishing and social engineering are common; recognize and report
  • Log out when finished, especially on shared computers
  • If credentials are compromised, contact ITS immediately
  • Legitimate staff never ask for passwords via email/phone

Data Handling Basics

  • Data classification determines storage and encryption requirements
  • PUBLIC data has no restrictions; RESTRICTED requires encryption
  • FERPA data must be protected and never shared without authorization
  • Export control may restrict research access
  • File permissions control who can access your data
  • Deleting data permanently requires special commands
  • Ask your PI and if classification is unclear

Incident Reporting and Response

  • Security incidents include unauthorized access, data exposure, suspicious activity
  • Report all incidents to promptly
  • Include specific details: date, time, what you observed
  • Do NOT investigate alone or delete evidence
  • No-blame culture means reporting is encouraged
  • Staff will guide you through investigation and recovery
  • Learning from incidents improves security for everyone

Getting Help and Resources

  • Contact for all HPC security questions
  • ITS Help Desk handles account and authentication issues
  • Documentation and resources are available on HPC wiki
  • Asking questions is encouraged and appropriate
  • This training sets foundation; advanced training available later
  • You’re expected to implement these practices immediately
  • Security is everyone’s responsibility working together

Social Engineering and Phishing

  • Social engineering attacks the human, not the computer; HPC accounts are valuable targets
  • Phishing tells: sender domain mismatch, urgency, generic greeting, suspicious links, unexpected attachments
  • Never click links or open attachments in suspicious messages; verify out of band through trusted channels
  • Forward suspected phishing to ; cc when HPC is involved
  • Insider mistakes (shared credentials, leaked passphrases, account sharing) are reportable too
  • This episode satisfies NIST SP 800-171 controls 3.2.2 (insider threat) and 3.2.3 (social engineering)