Processing Sensitive Data via CSC Services

This page describes the current state (06/2026) of the available ”self-service” options for processing sensitive data at CSC. We hope that this information on data security can help data owners make decisions on which of the various processing environments fits their purpose.

Definitions

Sensitive Data

This document follows CSC’s definition of Sensitive Data. We assume the processing of data that should not leak but where a leak is not catastrophic, for example subsets of copyrighted data as opposed to company or state secrets.

Principal Investigator (PI)

A Principal Investigator or ”PI” is the leader of a scientific research project.

Project

A project is a set of resources managed by a Principal Investigator. This includes compute resources, storage, and authorized users.

Environments

CSC essentially provides three different environments for data processing in general.

1. High Performance Computing (HPC) for massive parallel processing and very large datasets
2. Self-service virtual machines which can support the processing of sensitive data
3. The Rahti container service

High Performance Computing (HPC)

The HPC systems at CSC are secured against unauthorized access and data leaks. Presently, however, the HPC systems are not suitable for the processing of very sensitive data, such as medical personal data or state secrets, and the processing of personal data requires caution.

Access

Principal Investigators can request projects and manage their members. Projects are assigned a space on the shared HPC file system that only project members have access to. Projects cannot by themselves give access to their project to other projects. PIs can, however, add any registered user on the HPC system to their project. Project members are required to use SSH keys to access the systems, and these keys need to have a passphrase. Access via passwords alone is not possible. The keys must be added to the project via a web interface that can only be accessed using Multi Factor Authentication (MFA).

Data security

As mentioned above, a project’s data is only accessible to the project in question. However, the data in the project space is not encrypted on the file system level. Moreover, the transmission of data between the compute nodes is not encrypted. If a malicious user is able to gain admin privileges, for example by exploiting a Zero Day Vulnerability, this user can read all other users’ data stored on the shared filesystems. To mitigate this risk, CSC’s System Administrators actively monitor the HPC system as well as the security announcements of the operating system. CSC has a policy to make sure that the physical disk drives are securely disposed of, in case of replacement.

Data security in LUMI

The LUMI Supercomputer has no additional security features in addition to the ones described above.

Data security in Roihu

In addition to the features described above, Roihu uses temporary SSH certificates that the user has to re-generate once per day using MFA.

Self-service virtual machines

Virtual machines are essentially operating systems running on top of software instead of hardware. This makes it possible to dynamically offer computing environments. CSC offers two types of virtual machines for self service: cPouta and SD-Desktop as part of the Sensitive Data Services described below. Both offerings are based on OpenStack but are very different in terms of data security. The main differences are summarized below. For details refer to the respective documentation. SD-Desktop is based on ePouta, a virtual private cloud that is also offered as a separate service, but is out of scope for this document, since ePouta is not ”self-service”.

cPouta

cPouta enables users to create and administer virtual machines (”VMs”) with full operating system access (”root”). The VMs are isolated against other user’s VMs and shell access can be restricted to a subset of project members. The superuser of the VM can configure it in any way he or she likes. The downside of this flexibility is that the superuser is also responsible for possible misconfigurations. CSC only takes responsibility of the underlying OpenStack management software. It should be noted that CSC’s cPouta admins have the theoretical ability to list all existing VMs and could take copies of them. This, however, forbidden by policy. cPouta VMs can be configured to be accessible to the internet and via Secure Shell (ssh).

Sensitive Data Services

CSC’s Sensitive Data Services are a collection of services specifically designed to process sensitive data. Data will be encrypted at upload and at rest and only visible to the virtual machines created by the same project. The machines are not connected to the internet, they are only accessible by a virtual desktop connection which requires multifactor authentication.  It is possible for the project’s PI to share the data with other projects. Only the PI can export result data from the isolated environment. Note that the encryption keys are managed by CSC, this means that in theory admins with very high priviledges could get access to them. A user can mitigate this by adding an extra layer of encryption to the data where the user controls the keys. However, this also has drawbacks: Data sharing between projects is not easily possible anymore and key handling is manual, lost keys can mean lost data.

Rahti

Rahti is CSC’s container environment based on OKD. Containers are not virtual machines. Containers can be used for web services which in turn might process sensitive data. Note that the user is responsible for keeping containers up-to-date. Rahti provides a separate Security Guide.

Overview of the features of the different environments

Table: Overview of the advantages and disadvantages of the different environments for data processing in general and sensitive data processing in particular

Discussion of the current solutions

With the exception of Sensitive Data Services, CSC’s systems are not designed to process sensitive data.

On the other hand, Sensitive Data Services might not be suitable for data processing in all cases, e.g., if massive parallel processing is required. However, CSC is working on solutions to make data transfer between SD Desktop and Roihu (and later LUMI) easier and to ensure that the data is processed on Roihu using encryption. We are also piloting another solution which should make data transfer between a user controlled environment (like a personal laptop) and LUMI more secure and manageable.

In case the Sensitive Data Services cannot be used for a given purpose involving sensitive data, the user can consider several options to mitigate risks:

• Pre-process the data in SD Desktop to reduce sensitivity and only then process the result in other systems, e.g., LUMI or Roihu.
  • Example: You could transcribe the spoken audio and use a text-only version in a given analysis. In the text, pseudonymize names, places etc. if appropriate.
  • Note that for instance the application of pseudonymization techniques can be time-consuming and/or may require technical skills.
• Encrypt the raw data at rest. Decrypt only during processing, and delete the processed data immediately.
  • Note that this process requires a good understanding of encryption technology and put a lot of the burden onto the user to manage encryption keys, copy data, etc.
• If you only require storage space, note that your own institution may also have a system for storing sensitive data, so check your IT guidelines.
• In the case of a project dealing with sensitive data and involving specific technical requirements, you may consider ePouta, a virtual machine service with a MPLS VPN connection between the local network of your institution and CSC (this needs to be set up manually).
  • Unlike cPouta (described above), ePouta is not self-service but a relatively heavy solution, to be used only when necessary. Moreover, your institution may already have set up a suitable project on ePouta, so please contact the IT support at your own institution first.

Viimeksi muokattu 2026-10-28