skip to main content
technical-note
Open access

Protecting Sensitive Data with Secure Data Enclaves

Published: 19 June 2024 Publication History

Abstract

A Secure Data Enclave is a system that allows data owners, such as governments and private firms, to control data access and ensure data security while facilitating approved uses of data by other parties. This model of data use offers additional protections and technical controls for the data owner compared to the more commonly used approach of transferring data from the owner to another party through a data sharing agreement. Under the data use model, the data owner retains full transparency and auditing over the other party's access, which can be difficult to achieve in practice with even the best legal instrument for data sharing. We describe the key technical requirements for a Secure Data Enclave, provide a reference architecture for its implementation on Amazon Web Services using managed cloud services, and describe four use cases of this architecture in partnerships with state governments to control access to sensitive administrative data.

1 Introduction

Data is increasingly a driver of innovation and improved product and service delivery. Advances in data-intensive methods like machine learning and artificial intelligence have fueled innovation in the private sector, improving product quality, customer experience, and lowering production costs [1]. The public sector has similarly begun exploring the use of big data, machine learning, and artificial intelligence to solve important policy challenges [26].
Many organizations, both private and public, require external expertise to fully leverage the value of their data or to apply cutting-edge methods like machine learning and artificial intelligence. Organizations may, for example, contract with consultants who specialize in data analysis or engage academic researchers who can bring a rigorous and scientific framework to solving problems with data. Sharing sensitive data with other parties, however, creates many risks for organizations, especially when it involves transferring data to a system outside the organization. Moreover, collaborations with academic researchers often involve an academic responsibility to openly publish findings through scientific peer review, which can conflict with the restrictions surrounding sensitive data [7].
Traditionally, data sharing is accomplished with legal agreements that govern acceptable uses of the data, transfer liability, and provide remedies for data breaches or other unacceptable data use [8]. However, once the data leave the custody of an organization it can be difficult in practice to enforce these terms or audit the actual use of the data by other parties.
In contrast, data use is a model in which an organization retains custody of its data at all times while allowing approved users to access the data. The benefit of this approach is that the organization has full transparency into the use of the data and can terminate access at any time. However, this approach requires that the organization maintain a secure system with appropriate technical controls to securely host their data and grant access to other parties.
Many previous systems have been created with these goals in mind and we collectively refer to them as Secure Data Enclaves, following terminology already in use.1 A related concept is a Research Data Center, which is a secure research facility that requires physical access for analyzing sensitive federal data, run in conjunction with the US Census Bureau or National Center for Health Statistics [910]. Because of the practical challenges and constraints around physical access, remote-access variants of these secure systems have been developed, many of which are hosted on-site at research universities [11].
Today, organizations of any size can implement a Secure Data Enclave in a cost-effective way using best practices for security and compliance through managed cloud services. In this paper, we describe a cloud-based approach to implementing a Secure Data Enclave, along with a standardized set of technical and governance controls and a reference architecture for Amazon Web Services. We describe four existing use cases of this solution, including our organization's recent use of a cloud-based Secure Data Enclave for processing Pandemic Unemployment Assistance claims as part of the State of Rhode Island's emergency response to the COVID-19 pandemic [12]. That system followed the reference architecture described here and allowed the state to safely share sensitive claims data with contractors for claims processing and fraud detection.

2 Technical Design

A Secure Data Enclave implements both technical controls (denoted with “T”) that enforce constraints on the use of the system by data users, as well as governance controls (denoted with “G”) that provide best practices and policies for how data owners manage use of the system (Table 1). Most importantly, the Secure Data Enclave is owned and managed by the data owner. Data never leave the data owner's custody. The data owner retains control over who can access the data, how the data are used, and what analysis products can be exported from the system.
Table 1.
SDE ControlNISTHIPAAFERPACJIS
T1No outbound access to the Internet.3.1.20164.312(a)(1)Provide a layered defense5.10.1.1
T2Inbound remote access through a controlled client only.3.1.14164.312(a)(1)Provide a layered defense5.5.6
T3No copy/paste out from the remote client.3.1.3164.312(a)(1)Access control5.5.6
T4Enforce a password lock screen after 5 minutes of inactivity in the remote client.3.1.10164.312(a)(2)(iii)Access control5.5.5
T5Software installation is controlled centrally.3.4.9164.308(a)(5)(ii)(B)Secure configurations5.10.4
T6Software is kept up-to-date with security patches applied on a regular schedule.3.14.1164.308(a)(5)(ii)(B)Patch management5.10.4.1
T7New software is scanned for viruses and malware at installation time.3.14.2164.308(a)(5)(ii)(B)Automated vulnerability scanning5.10.4.2
T8All data is encrypted in transit (TLS 1.2).3.13.8
3.13.11
164.312(e)(2)(ii)Secure configurations5.10.1.2.1
T9All data is encrypted at rest (AES 256-bit).3.13.10
3.13.11
3.13.16
164.312(e)(2)(ii)Secure configurations5.10.1.2.2
T10Data cannot be downloaded from the system by data users.3.1.2164.312(a)(1)Access control5.5.2
T11Comprehensive audit logging of all access to the system.3.3.1164.312(b)Audit and compliance monitoring5.4.1
G1Access approval by user/project with security pledge (see Appendix A.1 for an example).3.9.1164.308(a)(4)(ii)(B)Personnel security5.1.1.5
G2Review and documentation of all data exports by the data owner.3.3.5164.308(a)(4)(ii)(C)Policy and governance5.5.2
G3Periodic review by the data owner of all approved projects and users (e.g. quarterly).3.9.2164.308(a)(3)(ii)(C)Policy and governance5.1.2
Table 1. List of Technical and Governance Controls for a Secure Data Enclave
This specific set of controls was established to address the security requirements of an extensive fact-based policy collaboration between our team of scientists and policy makers in the State of Rhode Island, beginning in 2015 [6]. We developed an integrated database of sensitive and de-identified administrative records from 12 Rhode Island state agencies [5]. However, each agency brought its own set of security requirements to this partnership, originating in four separate but related security frameworks. Agencies managing health-related data (those under the Executive Office of Health and Human Services) required compliance with the Security Rule from the Health Insurance Portability and Accountability Act (HIPAA). The RI Department of Education required compliance with the data security checklist from the Family Education Rights and Privacy Act (FERPA). The RI State Police required compliance with the FBI's Criminal Justice Information Services (CJIS) Security Policy. The remaining agencies did not have a specific security mandate and agreed to the security framework from the National Institute of Standards and Technology's (NIST) Special Publication 800-53 (which we have subsequently updated to Special Publication 800-171). Therefore, we selected the controls for a Secure Data Enclave as the full set that would satisfy all requirements of the twelve agencies from these four frameworks. In Table 1, we provide a summary of where the controls originated in the four frameworks (a full crosswalk is available in supplementary material). In Table 2, we provide an ablation study to establish the necessity of each control.
Table 2.
SDE ControlPotential Effect of Removal
T1With Internet access, a bad actor could egress sensitive data through any publicly available file transfer service without the data owner's knowledge.
T2Without restricting remote access through a controlled client, an approved user could install a remote client from an untrusted source, increasing the risk of malware or spyware that allows unauthorized access of sensitive data.
T3With copy/paste enabled in the client, a bad actor could egress sensitive data the size of the clipboard buffer by copying it in the SDE and pasting it to their client system, without the data owner's knowledge.
T4Without a timed lockout screen, a bad actor could gain unauthorized access to sensitive data by exploiting a gap in physical security of an approved user's client system.
T5Without a centrally-controlled software repository, an approved user is more likely to install software from an untrusted source, increasing the risk of malware or spyware that allows unauthorized access of sensitive data or that compromises the integrity of the sensitive data.
T6Without up-to-date security patches, installed software is at higher risk of containing malware or spyware that allows unauthorized access of sensitive data or that compromises the integrity of the sensitive data.
T7Without automated virus and malware scanning, new software that is added to the centrally-controlled repository is at higher risk of containing malware or spyware that allows unauthorized access of sensitive data or that compromises the integrity of the sensitive data.
T8Without in-transit encryption, data could be accessed by unauthorized users through eavesdropping of network traffic.
T9Without at-rest encryption, data could be accessed by unauthorized users if storage devices are reused in another system.
T10With direct access to download data, a bad actor could egress sensitive data without the data owner's knowledge.
T11Without comprehensive audit logging, the data owner's ability to detect and investigate security incidents will be limited.
G1Without an access approval process by user/project, a bad actor could access sensitive data for a project or purpose without the data owner's knowledge or consent. Without signed security pledges (which provide evidence that an approved user is aware of the limitations on data use), the data owner may have fewer legal remedies available in the case of unapproved or inappropriate use of the sensitive data.
G2Without review and documentation of data exports, a bad actor could falsify a data export request to egress sensitive data for a different purpose.
G3Without periodic review of approved projects and users, the data owner could inadvertently allow continued use of the sensitive data for a purpose that is no longer approved.
Table 2. Ablation Study of Potential Effects of Removing Controls from a Secure Data Enclave
In the subsections below, we describe one possible implementation of the technical controls in Amazon Web Services (AWS) using managed cloud services, summarized visually in Figure 1. However, a Secure Data Enclave can be implemented with many cloud provider's services or even in an on-premise system (although this would negate many of the advantages for security, scalability, resiliency, and cost optimization offered by cloud services).
Fig. 1.
Fig. 1. Architecture diagram of a Secure Data Enclave in Amazon Web Services.

2.1 Virtual Desktops

The key managed service for our reference architecture is Amazon WorkSpaces, which provides managed Windows or Linux virtual desktops. AWS provides a remote desktop access client and manages the security, patching, and maintenance of gateway and access client. The managed workspaces run within a virtual private cloud (VPC) that is cordoned off from the Internet and all other systems.
The VPC is configured without an Internet Gateway, meaning that no traffic routes to the Internet, implementing SDE T1. In some cases, limited Internet access may be required to pre-specified locations (for example, to import data into the environment). That use case can be implemented by adding Internet and NAT Gateways to the VPC and modifying the built-in WorkSpaces security group (firewall) to allow egress to only the approved destinations, or through a more feature-rich stateful firewall implemented with the AWS Network Firewall service. There are Amazon VPC Endpoints that are created within the VPC, providing private and secure access to only the required AWS services, for example Amazon S3.
Amazon WorkSpaces requires integration with Microsoft Active Directory (AD) infrastructure, which can be managed with AWS Directory Service. This directory provides identity management for approved users of the system, implementing SDE G1. The following options are currently recommended by AWS [13]:
(1)
Integration with an existing Azure AD or on-site directory through the AWS AD Connector service.
(2)
Creating a stand-alone directory for the Secure Data Enclave using the AWS Managed Microsoft AD service.
(3)
Installing a self-managed stand-alone directory on cloud-hosted virtual machines.
In addition to being configured without Internet routing, the workspaces are only accessible using approved Amazon WorkSpaces clients for Windows, Linux, Mac, Android, iOS, web browsers, or Chrome OS, which can be enabled or disabled for any combination of clients, implementing SDE T2. Additionally, group policies can be configured in the Active Directory to control the directionality of copy and paste in the WorkSpaces client and require a password-protected lock screen, implementing SDE T3 and SDE T4.
The software stack available in the workspaces is managed and updated via a secured build workspace that is independent of the Secure Data Enclave and located in a separate AWS account with Internet access, implementing SDE T5. This build workspace can be updated on a regular schedule to incorporate security patches, implementing SDE T6, and can also be updated on-demand to install new analysis or statistical software and packages as required by the data users. To create a new software release, the build workspace is scanned for viruses and malware, implementing SDE T7, and imaged, then the image is shared across AWS accounts for use as the base image with the Secure Data Enclave workspaces. Amazon WorkSpaces provides a mechanism for rebuilding a data user's workspace in-place against an updated image while preserving the user's locally stored data [14].

2.2 Data Transfer, Storage, and Access

Sensitive data can be ingested into the Secure Data Enclave using either the native S3 transfer protocol or the Secure File Transfer Protocol (supported through the AWS Transfer for SFTP managed service [15]), both of which provide in-transit encryption to implement SDE T8. All S3 buckets and the storage volumes underlying the workspaces are encrypted with AWS Key Management Service (KMS) customer-managed keys, implementing SDE T9.
The S3 buckets are configured so that the sensitive data bucket is writable by the data owner from outside the system using S3 or SFTP as described above. It is read-only from the workspaces of the data users. The import bucket is writeable by data users from outside the system and read-only from the workspaces. It allows public data sets, analysis code, and other non-sensitive resources to be imported into the Secure Data Enclave. Finally, the export bucket is writable by data users from the workspaces but can only be read outside the system by the data owner. It allows the data owner to export approved analysis products from the Secure Data Enclave.
We use a combination of S3 bucket policies (e.g. the resource policies on each of the S3 buckets), the resource policy on the VPC Endpoint for S3, and the IAM roles assigned to the data users to implement these read/write permissions. This configuration prevents sensitive data from being downloaded by data users outside of the VPC, implementing SDE T10, while allowing data users to import non-sensitive public data and analysis code in a self-service way without requiring excessive administration and intervention from the data owner. Furthermore, the export bucket allows the data owner to implement SDE G2 and review all data exports from the system.
Data users can read directly from the sensitive data bucket from inside the workspace and store analysis results to local workspace storage. However, this requires using the command line interface or a third-party client to manually interact with S3 and sync files to the local volume. Also, local storage has limited backup and snapshot settings and cannot be shared among data users within the system. There are several additional storage options, compared in Table 3, which can be deployed to provide shared network-attached storage to the workspaces internally within the VPC.
Table 3.
Managed ServiceProsCons
AWS Storage Gateway
Acts as an abstraction layer between WorkSpaces and an S3 bucket, removing the need to interact with S3 through the command line.
Mountable as a network file system in WorkSpaces using AD credentials and standard protocols (SMB or NFS).
Provides SSD-backed and memory-backed caching for better throughput on repeated data retrieval.
Requires persistent server resources (through EC2 instances in the VPC) that incur additional costs.
Files written directly to the S3 bucket need to be discovered by Storage Gateway, although it can be scheduled to refresh regularly.
Amazon FSx for Windows File Server
A serverless network-attached file system that runs within the VPC.
Like Storage Gateway, provides a mountable SMB network file system in WorkSpaces that fully supports Windows access control lists.
A fully managed service with no servers to manage.
Requires pre-provisioning the available storage allocation and throughput.
Amazon Athena
A serverless query service that treats big data as a SQL-like database. Athena offers flexible computation of complex queries without requiring significant resources within the VPC.
Offloads the computational resources needed to run SQL-like queries against structured data in an S3 bucket.
Works well with a variety of big data formats including CSV data files and Apache Parquet columnar data files.
Access controls are not as fine-grained as IAM policies for S3 buckets or Windows access control lists.
Most analysis software (such as Power BI, Python, or R) will require specialized packages and an ODBC driver to directly access Athena.
Table 3. Comparison of Storage Options for the Secure Data Enclave

2.3 Account Security

The Secure Data Enclave should be deployed within an AWS account that is configured according to security best practices, such as those recommended by the Center for Internet Security's AWS Benchmarks [16]. Compliance with these benchmarks can be continuously monitored within the account using AWS Security Hub. At a minimum, the account should be configured to audit all account activity and S3 bucket access with AWS CloudTrail [17], implementing SDE T11.

3 Use Cases

Since 2020, the Secure Data Enclave architecture described here has been deployed to meet a variety of policy needs in the public sector. We describe four specific use cases below.
(1)
Rapidly delivering unemployment assistance. The COVID-19 public health emergency caused widespread economic shutdown and unemployment. The resulting surge in Unemployment Insurance (UI) claims threatened to overwhelm the legacy systems state workforce agencies rely on to collect, process, and pay claims. Research Improving People's Lives (RIPL) partnered with the Rhode Island Department of Labor and Training and Amazon Web Services (AWS) to deploy the Secure Data Enclave as part of a scalable cloud solution to collect and process Pandemic Unemployment Assistance (PUA) claims. RIPL's system was developed, tested, and deployed within just 10 days, making Rhode Island the first state in the nation to collect, validate, and pay PUA claims [12]. The Rhode Island Department of Labor and Training (RIDLT) then used their Secure Data Enclave architecture to launch new tech-based solutions to help displaced workers reskill for economic recovery through career recommendations powered by data and artificial intelligence [18].
(2)
Securely exchanging data between state agencies to reduce benefit processing time. To ensure that PUA and UI benefits were paid quickly during the pandemic, Rhode Island needed to verify claims against claimants’ individual tax data from federal or state tax authorities on a real-time basis, as opposed to the traditional verification against UI tax records collected from employers. RIPL partnered with the Rhode Island Department of Taxation to deploy a Secure Data Enclave architecture for verifying 2018/2019 state income tax records against the adjusted gross income reported in PUA claims. Using separate enclaves connected through a private VPC link, the Department of Taxation and RIDLT exchanged data securely without disclosing Personally Identifiable Information to staff at either department. This automated verification allowed Rhode Island to “pre-validate” PUA claims and avoid downstream costs and delays associated with manual verification, contributing to Rhode Island being the first state in the country to pay PUA claims [12]. This use case also illustrates “evaluation as a service,” a model enabled by the Secure Data Enclave architecture where other parties can partner with government to use administrative data to evaluate the impact of policies and programs while maintaining data confidentiality between all parties.
(3)
Helping students connect, learn, and earn rewards for academic improvement during the summer. During the COVID-19 public health emergency, the Rhode Island Department of Education (RIDE) needed a way to encourage students to stay on the path to academic success and reduce remediation following school closures and lost in-person classroom time. RIPL partnered with RIDE to deploy the free Summer Academy for Interactive Learning (SAIL), which provided virtual courses to support transitions to high school and college [19]. Using a Secure Data Enclave augmented with the Amazon Pinpoint and Lex managed services, RIPL deployed a chatbot in under four weeks to deliver texting-based behavioral nudges and financial incentives that encouraged students to attend virtual classes, submit weekly classwork, and prepare for the 2020-2021 school year. RIDE then used the Secure Data Enclave to partner with RIPL researchers to measure the causal effects of nudge-based educational programs like SAIL and the Rhode2College [20] program on connecting students to successful pathways to college.
(4)
Streamlining and securing data use across the Commonwealth of Virginia. The Commonwealth of Virginia has more than 1,400 data systems used to track and measure policy and programs. In 2020, the Office of the Governor issued an Executive Order to establish a permanent data sharing and analytics structure for the Commonwealth to promote increased data sharing and leverage government data for evidence-based policy. RIPL partnered with the Office of the Chief Data Officer and the Center for Innovative Technology to deploy a Secure Data Enclave for accessing and analyzing data approved through DataSAGE, Virginia's Secure Analytics and Governance Environment, which launched in August 2020. DataSAGE uses a Secure Data Enclave to facilitate secure data use by approved researchers under a data governance structure where government agencies review and approve access for important policy and research projects [21].

4 Discussion

There are several decision points for when and how an organization should deploy a Secure Data Enclave. Organizations will typically be motivated to deploy one when there is a clear value proposition for partnering with external parties to use sensitive data for innovation.
The first consideration will likely be the organization's technical capacity. Although the reference architecture presented here reduces the technical work to deploy a Secure Data Enclave through its use of existing managed services in the cloud, there is a baseline of cloud engineering expertise required to deploy and maintain it. An organization that is not able to staff this expertise internally might consider working with a cloud consulting or IT services firm. Additionally, organizations without dedicated information security teams might consider using an external security firm to audit and monitor the Secure Data Enclave.
Another decision point is cost. A cloud-based solution reduces capital expense but presents an on-going operational expense. As a reference point, the total cloud computing costs of the Secure Data Enclave deployment was less than $1,000 USD per month for each use case described in Section 3. However, many factors affect these costs and we recommend estimating costs for any new Secure Data Enclave based on the specific requirements. In addition to cloud computing costs, organizations should factor in the on-going personnel costs related to deploying, maintaining, and governing a Secure Data Enclave.
An alternative approach to the cloud-based, remote-access architecture we presented here is an on-premise architecture that uses physical access controls to accomplish many of the same technical and governance controls of the Secure Data Enclave. This is the approach used by Research Data Centers [910]. An organization might consider this alternative if they prefer capital investment over operational expense and the logistical constraints of physical access are not an obstacle to partnering with external parties.
One specific area of maintenance that can be challenging is software management. Operating system updates and security patches (SDE T6) are handled automatically by the Amazon WorkSpaces managed service, but statistical software and packages typically need to be installed and updated many times over the course of an analysis project as methods evolve. Older versions of analysis packages can quickly become out of date, but newer versions (especially prerelease or beta versions) may introduce security or performance issues.
Managing statistical software in a centralized repository (SDE T5) addresses these issues and has the advantage that updates for one project can be shared with another. For the use cases described above, we developed a custom deployment tool for Python and R to automate the process of installing new packages, updating existing ones, and scanning software changes for viruses and malware (SDE T7) to address potential security issues. Performance issues are mitigated by using virtual environments or an “environment modules” [22] approach, in which newly installed software does not overwrite previous versions. If a performance issue is detected, the software environment can be immediately rolled back to the previous working version. The default version of the environment module is set to the newly installed version following user acceptance testing.
Environment modules are also helpful in more complicated settings where projects cannot share a single software environment because of conflicting dependencies or where different users on the same project need different versions of software. Another option that can be used in place of or in tandem with environment modules is to mirror and pre-scan the entirety of public repositories like the Python Package Index or Comprehensive R Archive Network inside the Secure Data Enclave. This provides better self-service delivery of analysis packages since users can install and manage their own packages but it introduces additional maintenance for keeping the mirrors in sync.

5 Conclusion

The comprehensive scope and availability of managed services in the cloud allow organizations to rapidly deploy cost-effective systems for securing and controlling access to sensitive data. We have described a set of security controls to consider when implementing such a system, as well as a reference cloud architecture. Four use cases involving public sector partnerships illustrate how this architecture has been applied in practice to emergent public policy applications that require access to sensitive data.
In the future, we hope that the security controls and architecture we have documented become part of turnkey solutions from major cloud providers, to further improve the accessibility of these technologies, especially for organizations with limited technical and IT staff. Additionally, we hope that new use cases involving private/public sector partnerships are made possible by these technologies. When handled securely, sensitive data have the potential to improve public policy and lives [5, 6].

Footnote

1
The term “Secure Data Enclave” is used to describe managed systems at the University of Chicago (https://securedata.uchicago.edu/), the University of California – Los Angeles (https://ccpr.ucla.edu/services/computing/support/secure-data/), and Columbia University (https://cuit.columbia.edu/sde).

A.1 Sample Security Pledge

Security Pledge for the Use of Confidential Data from <<INSERT DATA OWNER HERE>> (“Data Owner”)
I, _______________________________________, (“Approved User”) through my involvement with and work on << Insert Approved Project Title Here >> will have access to the sensitive and confidential data provided by the Data Owner to be used in producing research and analysis results. I understand that access to this data carries with it the responsibility to guard against unauthorized use and the possibility of unauthorized access or use. To treat information as confidential means not to divulge it to anyone who is not an Approved User, or to cause it to be accessible to anyone who is not an Approved User.
I understand that disclosing confidential information directly or allowing non-authorized access to such information may subject me to criminal prosecution and/or civil recovery.
I agree to fulfill my responsibilities on this project in accordance with the following guidelines:
(1)
I agree not to permit anyone access to these data, either electronically or in hard copy, unless to another Approved User.
(2)
I agree not to attempt to identify individuals, families, or households.
(3)
I agree that in the event an identity of an individual, family, or household is discovered inadvertently, I will (a) make no use of this knowledge, (b) advise << Insert Data Owner Point of Contact >> of the incident, (c) safeguard or destroy the information as directed by << Insert Data Owner Point of Contact >>, (d) not inform any other person of the discovered identity.
Approved User: Witness:
Name: _______________________________ Name: ________________________________
Signature: ____________________________ Signature: _____________________________
Date: ________________________________ Date: _________________________________

Acknowledgments

We thank Michael Hicklen and Kyle Hancock for their contributions to the AWS reference architecture. We thank the many organizations and individuals who have partnered with us to prototype, test, and refine the Secure Data Enclave concept as well as its practical implementation: Amazon Web Services Inc., the Rhode Island Department of Labor and Training, the Rhode Island Department of Education, the Rhode Island Department of Taxation, the Rhode Island Office of the Governor, the Center for Innovative Technology, the Commonwealth of Virginia's Office of the Chief Data Officer, and Qlarion Inc.; Eric Schwenter, Casey Burns, Chris Johnson, Chuck Fuller, Scott Jensen, Jim Lucht, Abby McQuade, Amelia Roberts, Stephen Osborn, Scott Gausland, Elizabeth Texeira, Santiago Guerrero, Carlos Rivero, David Ihrie, Lynn McDaniel, Dawn Virts, Adam Roy, and Robert Reynolds.

References

[1]
Y. LeCun, Y. Bengio, and G. Hinton. 2015. Deep learning. Nature 521 (2015), 436–444. DOI:
[2]
Office of the Press Secretary, The White House. 2016. Announcing Over $80 million in New Federal Investment and a Doubling of Participating Communities in the White House Smart Cities Initiative. Accessed July 7, 2021 from: https://obamawhitehouse.archives.gov/the-press-office/2016/09/26/fact-sheet-announcing-over-80-million-new-federal-investment-and
[3]
Commission on Evidence-Based Policymaking. 2017. The promise of evidence-based policymaking. Accessed November 19, 2021 from: https://www2.census.gov/adrm/fesac/2017-12-15/Abraham-CEP-final-report.pdf
[4]
D. Schatsky and R. Chauhan. 2018. How CDOs can promote machine learning in government. Deloitte Insights. Accessed November 19, 2021 from: https://www2.deloitte.com/us/en/insights/industry/public-sector/chief-data-officer-government-playbook/five-uses-machine-learning-government-for-cdos.html
[5]
J. S. Hastings, M. Howison, T. Lawless, J. Ucles, and P. White. 2019. Unlocking data to improve public policy. Communications of the ACM 62, 10 (2019), 48–53. DOI:
[6]
J. S. Hastings. 2019. Fact-based policy: How do state and local governments accomplish it? The Hamilton Project (Brookings Institution), Policy Proposal 2019-01. Accessed November 19, 2021 from: https://www.hamiltonproject.org/assets/files/Hastings_PP_web_20190128.pdf
[7]
B. A. Plale, E. Dickson, I. Kouper, S. H. Liyanage, Y. Ma, R. H. McDonald, J. A. Walsh, and S. Withana. 2019. Safe open science for restricted data. Data and Information Management 3, 1 (2019), 50–60. DOI:
[8]
M. Wilson, S. Crompton, B. Matthews, and A. Orlov. 2011. Enforcing scientific data sharing agreements. In Proceedings of the 2011 IEEE 7th International Conference on eScience. 271–278. DOI:
[9]
US Census Bureau. 2021. Federal statistical research data centers. Accessed July 20, 2021 from: https://www.census.gov/about/adrm/fsrdc.html
[10]
Centers for Disease Control and Prevention. 2021. Research data center. Accessed July 20, 2021 from: https://www.cdc.gov/rdc/index.htm
[11]
J. Lane and S. Shipp. 2007. Using a remote access data enclave for data dissemination. International Journal of Digital Curation 2, 1 (2007), 128–34. DOI:
[12]
M. Angell, S. Gold, M. Howison, V. Kidd, D. Molitor, C. Burns, C. Johnson, M. Kahn, S. Venzke, S. Deneault, D. Doweiko, S. Dziembowski, B. Kumar, P. O'Donnell, C. Patel, A. Reidl, B. Tardiff, J. S. Hastings, S. Jensen, A. Pellegrino, A. Roberts, and R. Sarathy. 2020. Delivering unemployment assistance in times of crisis. Digital Government: Research and Practice 2, 1 (2020), 5:1–5:11. DOI:
[13]
Amazon Web Services. 2021. Active directory domain services on AWS – quick start. Accessed July 26, 2021 from: https://aws.amazon.com/quickstart/architecture/active-directory-ds/
[14]
Amazon Web Services. 2021. Rebuild a workspace – Amazon workspaces. Accessed August 4, 2021 from: https://docs.aws.amazon.com/workspaces/latest/adminguide/rebuild-workspace.html
[15]
Amazon Web Services. 2021. AWS transfer family. Accessed August 4, 2021 from: https://aws.amazon.com/aws-transfer-family/
[16]
Center for Internet Security. 2021. Amazon web services benchmarks. Accessed July 26, 2021 from: https://www.cisecurity.org/benchmark/amazon_web_services/
[17]
Amazon Web Services. 2021. How CloudTrail works – AWS CloudTrail. Accessed July 26, 2021 from: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html
[18]
Rhode Island Office of the Governor. 2021. Rhode Island to launch virtual career center powered by google cloud as part of “back to work RI” initiative. Accessed September 2, 2021 from: https://www.ri.gov/press/view/39624
[19]
Rhode Island Department of Education. 2021. Rhode Island students SAIL into summer leaning. Accessed September 2, 2021 from: https://www.ride.ri.gov/InsideRIDE/AdditionalInformation/News/ViewArticle/tabid/408/ArticleId/696/Rhode-Island-Students-SAIL-Into-Summer-Learning.aspx
[20]
Rhode Island Department of Education. 2021. Rhode Island launches statewide incentive program to increase the number of students prepared for college. Accessed October 13, 2021 from: https://www.ride.ri.gov/InsideRIDE/AdditionalInformation/News/ViewArticle/tabid/408/ArticleId/511/Rhode-Island-Launches-Statewide-Incentive-Program-to-Increase-the-Number-of-Students-Prepared-for-Co.aspx
[21]
Office of the Chief Data Officer of Virginia. 2021. Virginia secure analytics and governance environment (SAGE). Accessed September 2, 2021 from: https://www.cdo.virginia.gov/resources/datasage/
[22]
M. Howison, A. Shen, and A. Loomis. 2013. Building software environments for research computing clusters. In Proceedings of the 27th Large Installation System Administration Conference (LISA'13), 3–8 November 2013, Washington, DC, USA

Cited By

View all
  • (2024)Recommending Career Transitions to Job Seekers Using Earnings Estimates, Skills Similarity, and Occupational DemandDigital Government: Research and Practice10.1145/36782615:3(1-19)Online publication date: 13-Sep-2024

Recommendations

Comments

Information & Contributors

Information

Published In

cover image Digital Government: Research and Practice
Digital Government: Research and Practice  Volume 5, Issue 2
June 2024
91 pages
EISSN:2639-0175
DOI:10.1145/3613590
Issue’s Table of Contents

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 19 June 2024
Online AM: 02 February 2024
Accepted: 21 January 2024
Revised: 03 November 2023
Received: 18 February 2023
Published in DGOV Volume 5, Issue 2

Check for updates

Author Tags

  1. Data governance
  2. data management
  3. data sharing
  4. security controls
  5. managed services
  6. remote workspaces
  7. scientific collaboration
  8. public policy

Qualifiers

  • Technical-note

Funding Sources

  • National Science Foundation Convergence Accelerator
  • RAPID

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)1,453
  • Downloads (Last 6 weeks)174
Reflects downloads up to 20 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Recommending Career Transitions to Job Seekers Using Earnings Estimates, Skills Similarity, and Occupational DemandDigital Government: Research and Practice10.1145/36782615:3(1-19)Online publication date: 13-Sep-2024

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Full Access

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media