SC26: The Fastest Clusters Still Keep Their Most Valuable Data in Files

SC26, the International Conference for High Performance Computing, Networking, Storage, and Analysis, runs November 15 to 20 at McCormick Place in Chicago. Most of the week’s talk will be about accelerators, interconnects, and how many petabytes a file system can feed per second. Those are the right questions for the people who build clusters.

They are not the questions an attacker asks. An attacker looks at the same cluster and sees a single namespace holding years of simulation output, curated training corpora, genomic datasets, export-controlled engineering models, and research that has not been published yet. That pile of files is the reason the cluster exists, and it is usually protected by Unix permissions and the assumption that everyone on the network is a colleague.

Parallel file systems such as Lustre were designed to move data between storage and thousands of compute nodes as fast as the hardware allows. That design choice is deliberate. Clients are trusted, metadata paths are optimized, and anything that slows I/O gets pushed out of the data path.

The result is an environment where a single valid account can usually read a very large share of the namespace. A compromised researcher credential, a misconfigured service account on a login node, or a scheduler job with broader access than it needs can pull terabytes without tripping anything. On a system built to sustain heavy reads around the clock, a bulk copy looks like an ordinary Tuesday.

Universities and national labs add another layer: shared infrastructure. One file system often serves many projects, some open, some sponsored under contract terms, some carrying export controls or Controlled Unclassified Information requirements. Separating those projects with directory permissions and good intentions is common, and it is hard to prove to a sponsor or an auditor.

If you are evaluating storage at SC26, throughput numbers are only half the conversation. A few questions show quickly whether a platform can also protect what it stores:

The controls that matter most for research data live in the storage data path, because that is the one place every read and write has to pass. Attribute-based access control decides each operation against the user, the project, and the data’s classification, so one credential cannot traverse everything. Behavioral detection on live data catches the bulk read or mass encryption while it is happening rather than after the files are gone. An immutable, per-operation audit record turns a breach investigation from guesswork into a list of files. Snapshots and targeted remediation let you recover exactly what changed.

BrickStor SP for Lustre brings that model to parallel file storage: native Lustre throughput for AI training, simulation, and sensor processing, with ABAC, AES-256 encryption using FIPS 140-3 validated cryptography, STIG-aligned hardening, and support for workloads at different sensitivity levels on shared infrastructure. It runs under the same management, policy, and audit framework as the rest of the BrickStor platform, so the cluster and the enterprise file shares that feed it follow one set of rules.

On Monday, November 16, from 12:00 to 4:00 pm CT, RackTop is a sponsor at Bites, Brews, & Bird-Eye Views, the partner showcase Cambridge Computer hosts before the exhibit hall opens. It is at the VU Rooftop, 133 E Cermak Rd, in the Hilton Chicago McCormick Place, which connects to the convention center by skybridge. Register through Cambridge Computer using the link on our SC26 event page. Stop by the RackTop table to talk with our engineers about your cluster, your sponsors’ requirements, and how to secure research data without giving up throughput.

Can’t make Monday? Schedule a meeting with the team for any day of the conference week.