Admin Guide for Sensitive Data

1. Introduction

Globus offers additional features at the High Assurance subscription tier so that institutions can meet their security and compliance obligations and researchers can easily access and share sensitive data. Below we highlight Globus Connect Server features, configuration options, and best practices that allow you to meet the unique security and compliance requirements of your environment.

Important
High assurance storage gateways should be used for sensitive data access.

2. Data access by users with local accounts

Users with local storage accounts can use Globus to manage and transfer their sensitive research data securely and reliably. When deploying Globus Connect Server for sensitive data access by local account holders, please be aware of the following features and options that can be configured according to the sensitivity of the data and requirements of your environment.

2.1. Node Level

2.1.1. Protect your endpoint’s deployment key

The endpoint deployment key is in the deployment-key.json file, which is generated during successful endpoint setup. This file must be kept confidential because it contains the secret to authenticate the endpoint node to Globus services and the encryption key used to encrypt your endpoint configuration. Protect the deployment key as you would a password. Globus cannot recover your deployment key.

2.1.2. Ensure your encryption ciphers are strong

The encryption cipher used to encrypt the data transfer channel is selected from the OpenSSL libraries installed on each data transfer node. The first common cipher is selected from the preference-ordered list of OpenSSL ciphers on the source and destination nodes. By default, OpenSSL uses the HIGH cipher suites with AES256-SHA as the first cipher in the list. Generally, there is no need to change the default list. If you require FIPS 140-2 compliance, you must enable FIPS mode on your operating system. When FIPS is enabled, OpenSSL will use only FIPS compliant ciphers. Consult your Linux distribution’s documentation for enabling FIPS mode.

2.1.3. Rotate the node client secret

The node client secret is used to authenticate the node to Globus services. When an endpoint node is first configured, its secret is set to the secret stored in the endpoint deployment key. You can replace this shared secret with a node specific secret, which can be routinely rotated.

2.2. Storage Gateway Level

2.2.1. Create the storage gateway as high assurance

If your users will use Globus to access sensitive data, you must configure the storage gateway to be high assurance. High assurance storage gateways support features such as automatic enforced encryption, local audit log generation, session isolation, sharing permission expiration, and multi-factor authentication requirements. A storage gateway may only be configured as high assurance on creation and cannot be changed.

2.2.2. Select an institutional authentication domain

Users must authenticate with the identity providers you have configured as the storage gateway authentication domain. Select a domain from an institution that provides an appropriate level of authentication assurance for sensitive data, typically your campus domain rather than, for example, gmail.com. You may not select globusid.org as the authentication domain for a high assurance storage gateway.

2.2.3. Reduce the authentication timeout period

Users must reauthenticate after the authentication timeout period has passed. The default timeout period is 11 days. For sensitive data access, we recommend you shorten the authentication timeout.

2.2.4. Configure the appropriate identity mapping

Identity mapping defines a user’s local storage system account and can be derived from a user’s identity information in Globus. You should confirm that the default mapping is appropriate for your system, or otherwise generate custom mapping for your system.

2.2.5. Restrict the paths that can be accessed with Globus

Users may never use Globus to access parts of the filesystem beyond their local access permissions. Data access using Globus is always constrained by local access permissions. You can further constrain access using Globus by configuring paths that users may or may not access via Globus. For example, you may want to restrict access through Globus to home directories only.

2.2.6. Restrict the users that can access the system with Globus

You can deny or allow a local account or group of local accounts to access data via Globus by configuring user access restrictions. For example, you may want to prevent access by Globus to an admin-user account. You can further narrow access by configuring which local accounts may access which paths via Globus.

2.3. Collection Level

2.3.1. Restrict transfers to high assurance collections

You can configure a collection to restrict data transfers to high assurance collections only, ensuring data leaving your system remains on a high assurance collection.

2.3.2. Require multi-factor authentication

You can require users to authenticate with their identity providers using MFA in order to access their data via Globus. However, before configuring your system to require MFA, please confirm with Globus at support@globus.org that the identity provider you have selected for your storage gateway authentication domain reports to Globus that MFA was used.

You can configure a custom user message and link that is displayed in the Globus Web app when a user accesses your system. For example, the message can remind users they are accessing sensitive data and the link can take users to your acceptable use policies.

2.3.4. Secure audit logs

Consider your policies and procedures for log access, encryption, retention and monitoring when managing your high assurance audit logs. High assurance audit logs can contain sensitive data and should be protected accordingly.

2.3.5. Ask your Subscription Admin to verify your collection

Ask your Globus Subscription Administrator to verify your collection. Verified collections appear in the Globus web app with a verified icon next to the collection name. Users can rely on verification status to ensure they are accessing a collection operated and maintained by the subscribing organization.

2.3.6. Configure a custom domain

You can configure a custom domain name for a Globus Connect Server collection. A custom domain makes it easy for your users to search for and recognize your collection.

3. Data access by users who do not have local accounts

If you enable data sharing, your users can share their data with external collaborators. This feature allows researchers to authorize access to their data by users who do not have local accounts on your storage system. Your users may only ever share data that you have made accessible to them through Globus, and the sharing permission are always constrained by the local access permissions of your users. In addition, you can place the following restrictions on who can share, what can be shared, and how it can be shared.

3.1. Restrict sharing by user, path, and/or permission level

You can narrow the scope of allowed data sharing by restricting which local accounts may share which paths at which permission levels. For example, you could allow your users to only share their home directories, or you could prevent a specific user account from sharing any data. You can also allow a specific user to share a specific directory, such as allowing local user jbester to share \project1\ at the read-only level.

3.2. Limit the time sharing permissions are valid

You can configure a maximum expiration time for sharing permissions. Once a sharing permission expires, it is automatically deleted. Users are notified before their sharing permissions are deleted.

3.3. Restrict identity providers for sharing permissions

You can restrict the identity domains that your users may use for data sharing. For example, you can allow your users to share only with identities from your own campus, or only with identities in *.edu domains, or you can prevent your users from sharing with gmail.com identities.

3.4. Automatically delete unused guest collections

You can configure guest collections to delete automatically if they have not been accessed for a specified period of time. Guest collection admins are notified that their unused collection will be deleted if not accessed soon.