1 of 11

About Borealis (https://borealisdata.ca)

National hosted research data repository (Dataverse)
Institutional collections (70 participating partners)
Currently do not accept “sensitive data” (See Terms of Use)

Secure Research Data Repository Landscape
UofT Policies & Information Security Controls
Project Plan: Gap Analysis & Pilot
Roadmap Planning

Borealis Secure Dataverse Project (2024)

Borealis/UTL Controlled Access & Sensitive Data Project Working Group

2 of 11

Restricted Research Data Deposits (January 2024)

Borealis (entire repository)

Total number of files deposited (published and unpublished): 457,045

Open access (public): 433,190

Restricted: 23,837 (roughly 5% of total)

Embargoed and then public: 26

Embargoed and then restricted: 1

University of Toronto Collection

Total number of files deposited (published and unpublished): 80,366

Open access (public): 78,709

Restricted: 1,657 (roughly 2% of total) and of these the majority are UTL Map and Data Library Licensed data (960 - or 58% of restricted files are licensed/copyrighted data made accessible by the library)

Embargoed and then public: 0

Embargoed and then restricted: 0

Examples of restricted research data from UofT’s Collection:

(restricted access granted to IP range (UofT)

HLVC Transcriptions and Recordings - Heritage Language Dataverse (borealisdata.ca)

(restricted audio recordings (sensitive))

Common research problems & questions:

“Data access statements are often not reliable after publication”

“I can’t share my data its sensitive and it will need to be destroyed”

“How can I share my sensitive data? I've received participant and ethics review board approval for sharing (e.g. approved consent forms, anonymised and de-identified data to protect participants' privacy)”

“Only research affiliates and authorized users can access the data, how can we share this data?”

“Restricted sensitive data are often not discoverable or reusable”

“Legacy and cultural heritage data and indigenous data requires distinct consideration”

�

3 of 11

Secure Research Data Repository Landscape

Funders (Tri-Agency)
Institutions

Research Office
Ethics Review Board
IT & Security
Library & Archives

Government Data Centres (e.g. CRDCs, ICES)
Digital Research Alliance of Canada (Alliance)
Repositories
Research Hospitals
Research Projects

Canadian Research Data Policies, Resources, & Guidelines

Tri-Agency Research Data Management Policy (2021), Section 3.1 Institutional Strategy; Section 3.3. Data Deposit

University of Toronto RDM Strategy (2023)

UofT Policy on Information Security and the Protection of Digital Assets (2020)

UofT Information Security Control Standard

Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans – TCPS 2 (2022) (TCPS2)
Personal Information Protection and Electronic Documents Act (2018) (PIPEDA)
(Alliance) Sensitive Data Expert Group. (2020). Sensitive Data Toolkit for Researchers Part 1: Glossary of Terms for Sensitive Data used for Research Purposes.
(Alliance). Controlled Access Management for Research Data (CAM Project) (2023-25)

4 of 11

Controlled Access Data

Sensitive human health data

At Risk Environmental Research data

Other Restricted Data

Licensed & Commercial Data

Deposit Agreement

Access Restrictions & Terms

Request Access

User Access

Anonymized / Summary Sharing

Open Discovery

Research Needs

Repository Support

Secure Storage

End-User Agreement

Ethics Approval

Sharing Policy & Approval

5 of 11

3 of 71 controls	Level 1	Level 2	Level 3	Level 4
AC-11 Terminate (automatically) a user session after a defined condition. (Web, SSH, VPN, RDP)	optional (idle session timeout: OS defaults)	recommended (idle session timeout: 1-24h)	required (organisation /policy defined) (idle session timeout: <5 min)	essential (organisation /policy defined) (idle session timeout: <1 min)
AC-13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions	recommended (use encrypted sessions: HTTPS, SSH, VPN)	required (use encrypted sessions: HTTPS, VPN, SSH)	essential (use encrypted sessions: HTTPS, VPN, SSH - MFA)	essential (use encrypted sessions: HTTPS, VPN, SSH - MFA)
SII-2 Provide protection from malicious code at designated locations within organizational systems	required (SIEM client)	required (SIEM client)	essential (SIEM client)	essential (SIEM client)

UofT ISEA Controls & Security

6 of 11

Control ID	Managed Action	System Action
AC-11 Terminate (automatically) a user session after a defined condition.	Ensure session time-outs (Web, SSH, VPN, RDP)	L1: optional: use OS defaults L2: recommended: make sure that there is “something”: 1-24h L3 & L4: 60 seconds - 5 minutes (based on organisation regulations & policy)
AC-13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions	Use encryption for all sessions	Use encryption for all sessions: web (HTTPS), shell (SSH), RDP, VPN, + MFA
SII-2 Provide protection from malicious code at designated locations within organizational systems	Security Information & Event Management (SIEM) client (next generation antivirus)	SIEM client provides: Log Management Event Correlation Threat Detection Incident Response

Secure Repository Controls & Security

Log Management – SIEM collects and stores logs from multiple security devices and applications, providing a centralized log management, analysis, and reporting platform.
Event Correlation – SIEM analyzes security events and identifying patterns or relationships that indicate potential threats. SIEM solutions use advanced correlation algorithms to detect suspicious activities and generate real-time alerts.
Threat Detection – SIEM can identify potential security threats, such as malware infections, unauthorized access, and data breaches by collecting and analyzing data from various sources.
Incident Response – SIEM provides real-time alerts and reporting to help security teams respond to incidents more effectively, enabling them to contain, investigate, and remediate security threats.

7 of 11

ISEA: Maintenance (M) (1-5)

Hardware & Software Maintenance needs to be:

planned, approved
documented, logged,
with tools inspected,
external technicians supervised
equipment sanitized prior to removal

Proposed Repository changes:

All the above (before, the maintenance was done ad-hoc - on the spot, immediately, tailored for each situation)

8 of 11

Secure Repository Controls Gap Analysis & Inventory

In total there are 71 controls to be reviewed
Create documentation for each control

Inventory controls & executive summary (2-3 sentences each section)
Controls that are indicated as “priorities/ need to act on / new settings / new security programs / new auditing systems/ new monitoring” get JIRA tickets

Specific major challenges identified

Establishing common definitions & understanding w/ stakeholders (e.g. “Repository” )
Assess risk & prioritization of work
Some controls require additional system development
Balancing need for security & usability
More managed resources

9 of 11

Controlled Access in Dataverse

Repository Security & Controlled Access

Secure Web Application & Tools
Encrypted Data & Storage
Private & Trusted Host Servers
Security Monitoring & Compliance
Standard File Access Procedures
Information Security Policies & Documentation
Repository Staff Training Plan & Schedule

10 of 11

Secure Repository Pilot Features

Open metadata & access terms
Data Tags & assigned data classification
Configurable repository storage
Trusted remote storage configuration
Remote storage file linking
Institutional workflows & templates
Request Access Guestbooks
Institutional metrics & monitoring
System alerts, dashboards, & protections

11 of 11

Roadmap Planning

November 2023 - October 2024

Secure Data Repository Roadmap

Inventory & assess ISEA system control gaps
Recommend best practices for secure policies & procedures
Identify research pilot(s) & workflows
Evaluate service planning & resource gathering
Present opportunities for adoption, interoperability, & reuse across institutions and partner organizations