Process for security exception to access private data

[wwarriner]

If the researcher is a supervisor requesting their staff or student's data, use the full procedure below.

If the researcher wants to hand off data to their supervisor, start at "create a task..."

1. Before the researcher requests the approval, make sure to point them to https://docs.rc.uab.edu/data_management/research_data_responsibilities/#security-exceptions-for-accessing-former-uab-personnel-data and let them know to request /data/user, /home/ and /scratch/ all at once, as appropriate.
2. Receive approval for the security exception from Enterprise Information Security in the form of an RITM assigned to our "Assignment Group".
3. Create a TASK describing what needs to be done and notify rc-ops-team.
4. Copy the requested storage to another storage location and grant access to the requester or their delegate. We won't grant access to multiple people. If multiple people need access, the single requester/delegate can copy the data out to another location where those others can view it.
   1. Copy requested directories (ideally this will be all of /data/user/$USER, /home/$USER/, and /scratch/$USER) to /rstore/share/RITM########/. Simply copy the full paths.
   2. Recursive chown $requester on the RITM# directory.
   3. Recursive chmod u+rwx for directories and chmod u+rw for files starting at .../RITM#/.
5. Notify the user of the path and give them 2 calendar weeks (??) before we delete, and request notification when they have completed their work. (Can we automate access revocation with a single cron trigger, is it worth it? Happy to document this.)
6. Delete the copy when we hit the time limit or when they notify us.

[iam4tune]

Canned response for a scenario where a user cannot copy data from their personal account to another location (e.g., shared location, project directory), and we are unable to restore access to their account. In this scenario, the requester is usually not the owner of the destination location; therefore, approval from the destination location owner must be obtained before the transfer can be initiated.

"Your request serves as notice for us to transfer your files into the project directory you provided. Since your BlazerID/account will be deleted on MM DD YYYY, you may not receive a notification once the transfer is complete. I have included your supervisor (owner of the project directory) in this request so they are aware and can provide final approval for this file transfer.

As soon as that approval is received, I will submit a request to our Ops team and update this ticket once the transfer is complete."

[wwarriner]

With better understanding of our systems, I believe we can present the following options to researchers.

RC will do either of the following. You must have, or will need to create, an RCS account.

1. Copy data to your /data/project/ directory

• We can create a 25 TB shared allocation if you do not already have one.
• We will recursively change owner and group owner to you.
• We will recursively set permissions of files and directories within the transferred data appropriately.
• We will set the top-level directory permission to only allow you access. You can change this after the data is in place.

2. Copy data to your LTS allocation

• We can create a 75 TB shared allocation if you do not already have one.
• Linux filesystem metadata will be lost, including all of the following: creation time, last access time, last modification time, owner, group owner, and permissions.