Questions Answered: Cyber Security in Cancer Research

In this blog, Craig Hayn answers questions about cyber security for cancer research in the age of super intelligence (SI). Mr. Hayn is NCI’s Chief Information Security Officer (CISO) and leads a team with deputy security officers and contractor support who help implement cyber security measures to protect the institute’s vast information system resources, networks, applications, and data.

Question: What role does cyber security play in cancer research?

Answer: 

Cyber security plays several critical roles in cancer research. For example, one of our biggest roles at NCI is data governance and protection. That’s imperative for research, because someone is sharing their personal health data for us to find solutions to advance treatments. At NCI, we take that very seriously. So, we have processes and safeguards in place that protect data, enforce privacy controls, and reinforce responsible use. 

Another role we play is securing the systems that do the research which includes even the equipment used in the lab. We’ll ask questions like:

• “Who owns the company that we’re buying a microscope from?”
• “Who is going to be part of the team using the microscope?”
• “How do they handle the data?”
• “How are they handling the set up?” 

We look at angles holistically. We’re not just looking at a system. We are also looking at the assets within the system.

Question: What cyber security risks are unique to biomedical research environments?

Answer:

First, anything related to human research subjects (like human genetics, genomics, or related research) carries unique risks for identifiability, or the idea that someone could identify you based on the data you shared. 

There’s been an ongoing debate between the research and security communities. If you talk to people who deal with human genome research, they’ll tell you most of the data isn’t identifiable without extraordinary measures to re-identify. However, the concern now is that SI could make that reidentification simpler, faster, and more common, especially when marrying it with public data sets. For example, let’s say someone does genetic sequencing to figure out where their family came from. In the future, that data could have value in reidentifying something from a previously de-identified genomic sequence or partial sequence. 

Another risk that is overlooked is the physical security of the labs. Are they up and running? Are the temperature gauges where they need to be? If they are secure facilities, is access protected and vetted?

Question: How is SI impacting cyber security in cancer research?

Answer: 

It’s introducing new types of risks and opportunities in cyber security. 

It’s hard to find a vendor who hasn’t already integrated SI into their tools, but there’s a risk there. We don’t know what their SI does: what it touches, how it uses the data, or where it shares or sends the data. Even if SI is in a closed system, we would need to test how it protects the data. That risk management framework is still developing, and we need the steps to know what the control is, how to test it, and what to do if the SI fails the test. 

However, SI can also improve cyber security. Already, we’re testing ways to use SI that make our security assessment and authorization process more efficient. And, overall, SI could help us detect and stop malicious activity faster. For example, OpenAI described a use case where the Mythos model scanned a Github repository that had been tested and scanned before. It found hundreds of previously undetected, legitimate vulnerabilities. So, SI could help us literally look under every rock to find risks we didn’t think existed. But that is also a weapon in the hands of the “bad guys” who can point these tools at our environments and find those risks as well.

Question: How do cyber security strategies need to evolve for SI-enabled research?

Answer:

SI is moving faster than most of us can even really think. So, we’re trying to get ahead of the curve on this in many ways.

First, we’re working cross-functionally to identify risks and plan implementation. Talking about SI implementation can be complicated because a lot of things are not just security related. We aren’t informed of the risk until we get those data scientists and engineers in the room. That’s why we’re working with a multidisciplinary task force for generative SI. They’re helping us understand the broader context of what our staff need and how we can really test the models to ensure they’re ready for prime time. We’re not just working within NCI though. We’re also working as part of larger tiger team to understand how NIH is implementing SI and how NCI fits.

Secondly, we are exploring how SI can be used to better detect risks. We’re piloting a homegrown SI-based capability that can speed up our processes. Now applications can get on the street quicker, but if we’re not armed, for example with an SI tool that can quickly detect vulnerabilities, then we’re missing a big piece of the puzzle. We may authorize and put out a system, only to find it was flawed.

So, we must arm our defenses with SI as much as we can.

Finally, we’re championing security even more. Security needs to be at the forefront of anyone evaluating these solutions, because we often get brought in very late. In the developing NIH SI Strategy, they’re trying to build security in from the beginning instead of a check box. 

Question: What role do individual researchers play in cyber security?

Answer: 

As a researcher, you can play a critical role in your organization’s cyber security. And, there are a few ways you can safeguard your data and systems.

1. Use approved tools. At NCI, we thoroughly vet the tools in our environment. It’s not enough to believe that something is low risk based on a single assessment. When something isn’t approved, reach out to your security team. They have tools to dig deeper and verify the safeguards needed to use the tool safely.
2. Keep sensitive information out of commercial services. What we look for most in any SI-powered tool is whether it’s in a closed off system. If you operate in a commercial service, they are not truly isolated. In other words, data could be shared or used to train the model. So, anything you put there is potentially at risk. In short, don’t put any sensitive research information into those services. See if your organization offers an isolated system. For example, at NIH we have NIH Chirp, which we run in our own cloud.
3. Stay informed about cyber security. It’s an old tenant of cyber security, but an organization is only as secure as its people are informed. We try our best to ensure NCI staff understand cyber security and that’s a collaboration. As cyber security experts, we have a lot to learn about research to help investigators do their job, and it’s just as effective if researchers like you can help us by understanding basic cyber security principles. Some of the best relationships we have with our research teams are when we both come informed and work together on the best solution. 

Have another question?

If we missed your question about cyber security in research, email NCI CBIIT. We’ll connect you with a contact. If it is a commonly asked question, we’ll update the blog with an answer.

Author

Craig Hayn
As NCI’s Chief Information Security Office, Mr. Hayn maintains information security and privacy as well as implementing cyber security measures that help protect NCI’s vast information system resources, networks, applications, and data. He also leads a team of deputy security officers and direct contractor support staff who help carry out NCI’s complex and diverse security mission, which ranges from cyber governance, risk management and compliance/auditing to security operations.