Make changes to comply with Harvard level 3 privacy rules for our NERC data

[joachimweyl]

Next Steps

• We need to make all level-3 data private. What is the best way forward?
  • Create copies of the data in private repos and then obfuscate the current public repos?
  • Other options?
• We need to make sure that the changes we make do not break any of our automation we have in place

Harvard Data Security Level 3

Link to Harvard Data Security Level-3

Links shared with Havard Data Security:

• hardware.csv
• network.md
• MGHPCC-NERC-1-A-8-2022.png
• Network.svg
• Network.svg
• Nerc Reference Architecture.pdf
• Clusters.svg
• Infra OpenShift Apps.svg
• software-components.md

Nathan Hall's response:

"Hi Justin,

Much of that would be considered Level 3 data (specifically non-security technical specifications/architecture schema). Repositories with this level of detail about Harvard systems should not be public. Obfuscated/generalized specifications or reference architecture could be shared in public repos.

Nathan"

[msdisme]

We don't think this information is actually a security risk. the architectural details are the point- one of the goals of this project is to expose the architectural details so that this may be understood and other sites may reproduce.

[pjd-nu]

"Level 3" is really restrictive - https://security.harvard.edu/data-classification-table
if any of our stuff gets classified at that level we're probably screwed - this definitely needs to be appealed. Among other things, it would seriously limit the ability for non-Harvard employees to access the information, and would prevent it from being used in published research papers.

[msdisme]

Scott and Wayne to discuss tuesday having Scott/Wayne present to security team with context.

[msdisme]

sent email to scott and wayne asking for an update.

[msdisme]

While we do not believe that sharing this information publicly is an security risk we would like to better understand why Harvard feels it is.

The value of the data is in the relationships so if the data is to be obscured the relationships should be maintained; we believe doing so is going to be pretty diffic

[msdisme]

With Scott and Wayne, they are out for next 3 weeks. I am moving to April Sprint. This is tracking for others work.

[msdisme]

Feedback from Scott - ignoring this for now.

[msdisme]

We don't think this information is actually a security risk. the architectural details are the point- one of the goals of this project is to expose the architectural details so that this may be understood and other sites may reproduce.

[pjd-nu]

"Level 3" is really restrictive - https://security.harvard.edu/data-classification-table
if any of our stuff gets classified at that level we're probably screwed - this definitely needs to be appealed. Among other things, it would seriously limit the ability for non-Harvard employees to access the information, and would prevent it from being used in published research papers.

[msdisme]

Scott and Wayne to discuss tuesday having Scott/Wayne present to security team with context.

[msdisme]

sent email to scott and wayne asking for an update.

[msdisme]

While we do not believe that sharing this information publicly is an security risk we would like to better understand why Harvard feels it is.

The value of the data is in the relationships so if the data is to be obscured the relationships should be maintained; we believe doing so is going to be pretty diffic

[msdisme]

With Scott and Wayne, they are out for next 3 weeks. I am moving to April Sprint. This is tracking for others work.

[msdisme]

Feedback from Scott - ignoring this for now.