UMBC is leading a new initiative, in partnership with several Historically Black Colleges and Universities (HBCUs) and minority-serving institutions (MSIs) in the region, that’s aiming to expand the research compliance capacity of mid-size (universities with 15,000 or less students) and smaller universities to better adhere to emerging federal research security policies. 

To address the challenges associated with expanding research compliance capacity at institutions at these sizes, UMBC is partnering with the University of Maryland, Eastern Shore, Morgan State University, and Delaware State University to develop the Research Integrity, Security, and Compliance (RISC) program. RISC is supported through a five-year, $3.9 million grant from the National Science Foundation’s Growing Research Access for Nationally Transformative Equity and Diversity (GRANTED) program. The program’s goal is to address systemic barriers within the nation’s research enterprise by improving research support and service capacity.

Principal investigator (PI) Karl V. Steiner, vice president for research and creative achievement, and co-PI Christine Mallinson, assistant vice president for research and scholarly impact, will lead the multi-institutional RISC program. 

“Mid-size institutions, along with MSIs and HCBUs, are expected to keep pace as new policies and guidance emerge, but they may not have the same ability or capacity to do so, compared to larger and more highly resourced research institutions,” explains Mallinson. “RISC will help us develop and then implement these evolving compliance structures and processes for smaller universities.”

Research security, according to the nation’s federal guidelines on government-supported research, is defined as “safeguarding the research enterprise against the misappropriation of research and development to the detriment of national or economic security, related violations of research integrity, and foreign government interference.” As part of the RISC program, UMBC will create, test, and implement a model for how mid-sized and smaller research universities can adhere to new and emerging research security policies.

That process, Mallinson explains, includes developing training modules on research security and compliance for researchers and research administration staff. The model will be further developed and evaluated among the partnering RISC institutions. 

The program will also support expanding the team in UMBC’s Office of Research Protections and Compliance (ORPC) and an additional cybersecurity specialist role in the Division of Information Technology, as well as supporting an increase in compliance staffing at the partnering institutions. Mallinson shares the “RISC Roadmap” will be publicly available for other institutions to assist them in responding to research integrity, security, and compliance guidance and meeting institutional needs.

“UMBC is at the forefront of this conversation of what it looks like for mid-sized institutions and smaller, emerging research institutions to build their research infrastructure in this area,” says Mallinson.

“I am very pleased about our multi-institutional, regional partnership and the significant support by the NSF that will allow us to address these pressing issues of research compliance and to create a blueprint for other smaller and mid-size research institutions,” adds Karl Steiner. “We have already benefited from the input provided by our partners during the proposal process.”

In addition to the RISC program, Mallinson has also been working to educate undergraduate students on careers in research administration with the GRANTS MADE Research Administration Internship. The internship, also funded by NSF’s GRANTED program, was created to expand and diversify the research administration workforce. UMBC’s Alexis Johnson ’24 and current senior Andy Quach, both financial economics majors, were a part of the internship program’s inaugural cohort. This summer, Quach continued his potential career interests in research administration with an internship with the ORPC. Quach helped to review and audit active research protocols and drafted various compliance documents. 

Mallinson adds that prospective interns may also have the option to work with the ORPC team, allowing for a synergistic opportunity to train the next generation in this critical area of research security and compliance.

By Haibin Zhang, Assistant Professor of Computer Science and Electrical Engineering
Header photo:SWEviL/Shutterstock.com

As cloud storage becomes more common, data security is an increasing concern. Companies and schools have been increasing their use of services like Google Drive for some time, and lots of individual users also store files on Dropbox, Box, Amazon Drive, Microsoft OneDrive and the like. They’re no doubt concerned about keeping their information private – and millions more users might store data online if they were more certain of its security.

Data stored in the cloud is nearly always stored in an encrypted form that would need to be cracked before an intruder could read the information. But as a scholar of cloud computing and cloud security, I’ve seen that where the keys to that encryption are held varies among cloud storage services. In addition, there are relatively simple ways users can boost their own data’s security beyond what’s built into systems they use.

Who holds the keys?

Commercial cloud storage systems encode each user’s data with a specific encryption key. Without it, the files look like gibberish – rather than meaningful data.

But who has the key? It can be stored either by the service itself, or by individual users. Most services keep the key themselves, letting their systems see and process user data, such as indexing data for future searches. These services also access the key when a user logs in with a password, unlocking the data so the person can use it. This is much more convenient than having users keep the keys themselves.

But it is also less secure: Just like regular keys, if someone else has them, they might be stolen or misused without the data owner knowing. And some services might have flaws in their security practices that leave users’ data vulnerable.

Letting users keep control

A few less popular cloud services, including Mega and SpiderOak, require users to upload and download files through service-specific client applications that include encryption functions. That extra step lets users keep the encryption keys themselves. For that additional security, users forgo some functions, such as being able to search among their cloud-stored files.

These services aren’t perfect – there’s still a possibility that their own apps might be compromised or hacked, allowing an intruder to read your files either before they’re encrypted for uploading or after being downloaded and decrypted. An encrypted cloud service provider could even embed functions in its specific app that could leave data vulnerable. And, of course, if a user loses the password, the data is irretrievable.

One new mobile app says it can keep phone photos encrypted from the moment they’re taken, through transmission and storage in the cloud. Other new services may arise offering similar protection for other types of data, though users should still be on guard against the potential for information to be hijacked in the few moments after the picture is taken, before it’s encrypted and stored.

Protecting yourself

To maximize cloud storage security, it’s best to combine the features of these various approaches. Before uploading data to the cloud, first encrypt it using your own encryption software. Then upload the encoded file to the cloud. To get access to the file again, log in to the service, download it and decrypt it yourself.

This, of course, prevents users from taking advantage of many cloud services, like live editing of shared documents and searching cloud-stored files. And the company providing the cloud services could still modify the data, by altering the encrypted file before you download it.

The best way to protect against that is to use authenticated encryption. This method stores not only an encrypted file, but additional metadata that lets a user detect whether the file has been modified since it was created.

Ultimately, for people who don’t want to learn how to program their own tools, there are two basic choices: Find a cloud storage service with trustworthy upload and download software that is open-source and has been validated by independent security researchers. Or use trusted open-source encryption software to encrypt your data before uploading it to the cloud; these are available for all operating systems and are generally free or very low-cost.

Haibin Zhang, Assistant Professor of Computer Science and Electrical Engineering, University of Maryland, Baltimore County

This article was originally published on The Conversation. Read the original article.