Thematic CERN School of Computing on Security 2026

Name: Thematic CERN School of Computing on Security 2026
Start: 2026-09-27T11:00:00+01:00
End: 2026-10-03T12:00:00+01:00
Location: Cosener's House

27 Sept 2026, 11:00 → 3 Oct 2026, 12:00 Europe/London

Cosener's House

15-16 Abbey Cl, Abingdon OX14 3JD, United Kingdom

David Crooks (UKRI STFC), Andrzej Nowicki (CERN), Catharine Noble (CERN), Kristina Gunne (CERN)

Description

The 20^th Thematic CERN School of Computing (tCSC security 2026) will take place on Sunday 27 September until Saturday 3 October. The theme of the school is "Security of research computing infrastructures" - see the academic programme for more details.

The school is proposed to people working in academia and research institutes, who as part of their job need to ensure security and resilience of computing resources they manage, and want to be prepared to detect and handle possible security incidents.

This school is organized by CERN in collaboration with the UK Research and Innovation, Science and Technologies Facilities Council (UKRI STFC) The school will take place in Abingdon and will be hosted in The Cosener's House, located in the grounds of the medieval Abbey of Abingdon, 8 miles from Oxford.

Important Dates

Wednesday 20 May 2026 - applications open
~~Wednesday 1 July 2026 - applications close at midnight~~
EXTENDED: Wednesday 8 July 2026 - applications close at midnight
Thursday 9 July 2026 - invitations sent to the selected participants
Monday 17 August 2026 - registration fee payment deadline

CERN School of Computing

Computing.School@cern.ch

Sunday 27 September
- 16:00
  
  Registration
- 1
  
  Welcome to the CERN School of Computing
- 2
  
  Self-presentation: 1 minute per person
  
  self_presentations.pdf
- 19:00
  
  Dinner at the Nag's head pub
Monday 28 September
- 3
  
  Opening Session
  
  Speakers: Andrzej Nowicki (CERN), Anton Lawrence (UKRI STFC), Dr David Crooks (UKRI STFC)
- 4
  Security in research and scientific computing
  - computer security: past, present and future
  - current risk landscape
  - most common threats and attack vectors
  - "why are we here?"
  Speaker: Dr David Crooks (UKRI STFC)
  
  sCSC_2026_Security_Landscape.pdf
- 5
  
  Announcements
  
  Some logistics Monday_kg_v1.pdf
  
  Some logistics Monday_kg_v1.pptx
- 11:00
  
  Coffee break
- 6
  
  Security architecture fundamentals
  
  Security architecture fundamentals
  • fundamental security principles
  • develop skills to be a security architect
  • how to design and provide secure computing infrastructure
  • security standards and frameworks
  • physical security
  • network security: segmentation, firewalls, VPNs
  
  Speaker: Barbara Krašovec (IJS)
  
  TCSC2026_Security_architecture_fundamentals.pdf
- 12:30
  
  Lunch
- 7
  
  Study time and/or daily sports
- 8
  
  Defensible security architecture: how to implement security principles
  
  • data security
  • endpoint security: hardware, host, OS, BMC security, system hardening
  • application security
  • future security trends
  
  Speaker: Barbara Krašovec (IJS)
  
  TCSC2026_Defensible_Architecture.pdf
- 15:45
  
  Coffee break
- 9
  Logging and traceability
  - host-based logs (system and application level), network monitoring
  - the importance of central logging
  - tools and technologies
  - data privacy, dealing with personal and sensitive data, log retention
  - traceability challenges
  Speaker: David Crooks (UKRI STFC)
  
  Detection_1_2026_as_presented.pdf
- 10
  
  Identity, authentication, authorisation
  
  • An introduction to the concepts of Identity, Authentication, and Authorization
  • Authentication and authorisation for distributed research
  • Methods for communicating authentication and authorization: Certificates, SAML, OAuth
  • How these technologies fit within research infrastructures
  
  Speaker: Mr Tom Dack
  
  scsc26-identityAuthNAuthZ-updated.pdf
- 11
  Identity Management & AAI - exercise
  In today's interconnected world, authentication and authorisation have become critical components of modern research infrastructure. In this tutorial we will be exploring traditional methods, such as certificate-based authentication, before progressing to how initiatives like WLCG, IRIS (UK computing resource federation) and SKA SRCNet (Square Kilometre Array - SKA Regional Centres Network) leverage industry-standard, token-based Authentication and Authorization Infrastructure (AAI) to enable large-scale research federations.
  
  Participants will:
  1. Examine what is a certificate
  2. Perform a SAML SSO
  3. Obtain a token from the issuer and analyse its content to understand the underlying architecture.
  4. (Extended) Issue a certificate and explore how token information translates into certificate issued via automated certificated issuer and how the 2 technologies can be bridged.
  5. (Extended) Use the issued certificate to access research resources in a simulated environment, demonstrating secure and streamlined access workflows.
    By the end of the session, attendees will gain practical skills for implementing modern AAI solutions in global research infrastructures.
  Speaker: Donald Chung (STFC)
  
  AAI-Lab-Notes.md
  
  LessonCred.txt
  
  sCSC account Sign-up
- 19:15
  
  Dinner at Cosener´s house
Tuesday 29 September
- 12
  
  Risk Management - lecture 1
  
  Speaker: Sven Gabriel
  
  ITSP_University_of_Harderwijk_Herbal_Research_Infrastructure.docx
  
  ITSP_University_of_Harderwijk_Herbal_Research_Infrastructure.pdf
  
  ITSRM Methodology v.1.2 - Description.pdf
  
  ITSRM Methodology v.1.2 - Detailed Catalogues.pdf
- 13
  
  Risk management - lecture 2
  
  The files attached to Risk management - lecture 1 contain all the slides for both lectures
  
  Speaker: Sven Gabriel
  
  main.tcsc2026_risk_management.pdf
- 14
  
  Announcements
  
  Tuesday_29Sep_kg.pdf
  
  Tuesday_29Sep_kg.pptx
- 15
  
  School photo
- 11:05
  
  Coffee break
- 16
  
  Virtualisation and cloud security
  
  Virtualisation and cloud security
  • virtualisation security fundamentals
  • cloud service models
  • authentication and key management
  • data security in the cloud
  • DevSecOps
  • security in private and public cloud
  • common threats in the cloud
  • security tools
  
  Speaker: Barbara Krasovec (IJS)
  
  TCSC2026_Virtualisation_and_Cloud_Security_tuesday.pdf
- 12:30
  
  Lunch
- 17
  
  Study time and/or daily sports
- 18
  Vulnerability management
  - vulnerability lifecycle, monitoring, scanning
  - CVE, CVSS, CPE, CWE and related standards
  - special cases: vulnerable hardware, EOL systems etc.
  Speaker: Sven Gabriel
  
  main.vuln_management.pdf
- 15:45
  
  Coffee break
- 19
  Student lightning talks
  
  lightning-talk-jupyter.pdf
  - a) STFC CERN-Inspired Security Operations
    
    Trained in Security Incident and Response through CERN and applied those practices at STFC. This session shares lessons from real-world incident handling, including support for forensic analysis of a cryptocurrency miner attack in a container environment during December 2025. The incident was investigated, contained, and used as a catalyst for developing long-term procedures and defensive initiatives to strengthen resilience against similar attacks.
    
    Speaker: Santosh Vasant Rane
  - b) Designing Secure Cloud-Native Multi-Tenant Jupyter Solutions
    
    Standard multi-tenant JupyterHub deployments bundle user code execution, authentication management, and notebooks within a single container. This presentation shows how JupyterHub can be extended to a hardened, cloud-native architecture that enforces a strict separation of concerns in a zero-trust environment. We decouple the Jupyter runtime into stateless, isolated components, isolating user identity using lightweight proxy sidecars and securing notebooks behind a database-backed API backend.
    
    Speaker: Stergios Gemelas
  - c) What is EISCAT
    
    A whirlwind tour of EISCAT, incoherent scatter and space junk.
    
    Speaker: Simon Brown
    
    2026-09-CERN-What-is-EISCAT.pdf
- 20
  Application security
  - web application security, typical web vulnerabilities
  - ethical hacking
  - introduction to pentesting
  Speaker: Sebastian Lopienski (CERN)
  
  Introduction to web penetration testing.pdf
  
  Introduction to web penetration testing.pptx
- 21
  
  Application Security - exercises
  
  Speaker: Sebastian Lopienski (CERN)
- 19:15
  
  Dinner at Cosener´s house
Wednesday 30 September
- 22
  Container security
  - key concepts of containers (namespaces, cgroups etc.) and Docker
  - container security, threat landscape
  - vulnerability and patch management
  Speaker: Daniel Kouřil
  
  container-security.pdf
- 23
  
  Container security - exercises
  
  Speakers: Daniel Kouril, Daniel Kouřil
- 24
  
  Announcements
  
  Wednesday_30Sep_kg.pdf
  
  Wednesday_30Sep_kg.pptx
- 11:00
  
  Coffee break
- 25
  Intrusion detection with SOC: deployment and operation
  - indicators of compromise (IoCs), threat intelligence sharing, TLP protocol
  - tools and technologies: MISP, Zeek, OpenSearch etc.
  - deploying a Security Operation Center
  - security incidents: detecting and alerting* indicators of compromise (IoCs), threat intelligence sharing, TLP protocol
  - tools and technologies: MISP, Zeek, OpenSearch etc.
  - deploying a Security Operation Center
  - security incidents: detecting and alerting
  Speaker: David Crooks (UKRI STFC)
  
  Detection_2_2026.pdf
- 12:30
  
  Collect lunch bags
- 26
  
  Departure of bus to Oxford
- 14:00
  
  Oxford visit, punting and dinner
- 27
  
  Transport by bus to Cosener's house
Thursday 1 October
- 28
  
  Security Operations
  
  additional material:
  - source code for communication challenges
  https://codeberg.org/dussa/CommsChallenge/
  
  Speaker: Sven Gabriel
  
  main.sg_sec_ops.pdf
- 29
  
  Incident response management
  
  • incident management and coordination
  • incident analysis and investigation
  • communication with stakeholders
  • containment and eradiction
  • recovery
  • lessons learnt
  
  Speaker: Barbara Krašovec (IJS)
  
  TCSC2026_Incident_response.pdf
- 30
  
  Announcements
- 11:00
  
  Coffee break
- 31
  
  Digital forensics: essentials and data acquisition
  
  digital evidence handling
  data acquisition (live systems, storage etc.)
  data analysis (OS, file system, network, executables etc.)
  reporting
  
  Speaker: Daniel Kouřil
  
  forensics-intro.pdf
- 12:30
  
  Lunch
- 32
  
  Study time and/or daily sports
- 33
  
  Digital forensics: data analysis
  
  Speaker: Daniel Kouřil
  
  forensics-analysis.pdf
- 15:45
  
  Coffee break
- 34
  Intrusion detection with SOC - exercises
  - indicators of compromise, threat intelligence sharing, TLP protocol
  - tools and technologies
  - deploying a Security Operation Center
  - detecting security incidents
  Speaker: David Crooks (UKRI STFC)
- 18:45
  
  Dinner at Cosener´s house
- 35
  
  Pub quiz at Kings Head and Bell Pub
Friday 2 October
- 36
  
  Digital forensics - exercises
  
  Speaker: Daniel Kouřil
- 10:15
  
  Coffee break
- 37
  
  Introduction to forensics - exercises
  
  Speaker: Daniel Kouřil
  
  forensics-handson.pdf
- 38
  
  Announcements
- 39
  
  Penetration testing - exercise debriefing
  
  Speaker: Sebastian Lopienski (CERN)
  
  Introduction to web penetration testing - debrief.pdf
  
  Introduction to web penetration testing - debrief.pptx
- 12:30
  
  Lunch
- 40
  
  Study time
- 41
  
  Exam
- 15:00
  
  Short break
- 42
  Incident response - exercise
  - incident management and coordination
  - Sirtfi and trust frameworks
  - communication with local users, external communities, and other stakeholders
  - working with law enforcement
  - privacy aspects
  Speakers: Dr David Crooks (UKRI STFC), Romain Wartel (CERN), Sebastian Lopienski (CERN), Mr Tom Dack
- 16:45
  
  Coffee break
- 43
  Incident response - exercise
  - incident management and coordination
  - Sirtfi and trust frameworks
  - communication with local users, external communities, and other stakeholders
  - working with law enforcement
  - privacy aspects
  Speakers: Dr David Crooks (UKRI STFC), Romain Wartel (CERN), Sebastian Lopienski (CERN), Mr Tom Dack
- 44
  
  Closing Session
  
  Speakers: Andrzej Nowicki (CERN), David Crooks
- 19:30
  
  Closing Dinner at Dorindos
Saturday 3 October
- 10:00
  
  Departure