Assessing risks and vulnerability

[paolap]

This is an odd one but it popped up at one of the data consolation meeting that Chloe held and has interesting aspects. I'm trying here to recall some of the observations:

• investing in private cloud storage could be ok for a small project but there's an inherent risk that costs can rise and become unsustainable in the future when the project is too invested to move out of it

• university (and probably even more so other institutions) have now to make sure they take steps to avoid foreign interference and data breaches, to avoid breaking the law and repetitional damage.

• data misuse, this is actually acutely felt by researchers and often (in my experience) put forward as a reason against sharing data
  Any other points?

I think it would be interesting once we completed other more critical parts of the book to look into some suggestions on how to conduct a risk assessment linked to the choice of data storage and delivery. It doesn't have to be complicated it can just be a set of questions that a user can consider, accompanied by a few common use cases.

Example guidelines:

• familiarise yourself with the host strategy for data security
• assess the potential growth of storage need of your data collection in time (you might be regularly retiring data while producing more, it's short or long term lived project, will the resolution of your data also grow with time, will change in audience size affect the costs?)
• come up with a plan to move out of private could storage should you need to in different scenarios: storage could become too expensive; cloud services aren't anymore capable of delivering data in suitable ways, cloud services provider close down...
• assess the potential interest in your data from a malignant entity (climate deniers?)

I'm sure some AI can come up with many more :-)

[hot007]

If publishing data - guarantee of longevity of published product? Most data ages and does not need to be available forever, but if DOI'd there are certain obligations...
https://www.nature.com/articles/d41586-024-00616-5

[hot007]

From a data storage perspective - ensuring data is writable by a very limited set of people - more than one, so that access isn't lost when a researcher moves institutions, retires etc., but that data can't be modified by bad actors.

[paolap]

These are both excellent points and we should make sure we also include them where is appropriate, if we didn't already (as the first about DOI in publishing session and the second in management of data). In this way we can connect data practices we suggest to lower risks.