# What is good Cyber Security Advice?

This is a request for cybersecurity advice. I motivate why Lesswrong would benefit from a [repository](https://www.lesswrong.com/tag/repository-1) of such advice and why that is relevant for alignment projects (I'm working on one) and propose a structure for answers. 

In [Six Dimensions of Operational Adequacy in AGI Projects](https://www.lesswrong.com/posts/keiYkaeoLHoKK4LYA/six-dimensions-of-operational-adequacy-in-agi-projects), Yudkowsky asks for

> *Strong opsec:*  Operational security adequate to prevent the proliferation of code (or other information sufficient to recreate code within e.g. 1 year) due to e.g. Russian intelligence agencies grabbing the code.

And defines the following levels:

> **Token:**  Random people are not allowed to wander through the building.
> 
> **Improving:**  Your little brother cannot steal the IP.  Stuff is encrypted.  Siloed project members sign NDAs.
> 
> **Adequate: ** Major governments cannot silently and unnoticeably steal the IP without a nonroutine effort.  All project members undergo government-security-clearance-style screening.  AGI code is not running on AWS, but in an airgapped server room.  There are cleared security guards in the server room.
> 
> **Excellent:**  Military-grade or national-security-grade security.  (It's hard to see how attempts to get this could avoid being counterproductive, considering the difficulty of obtaining trustworthy command and common good commitment with respect to any entity that can deploy such force, and the effect that trying would have on general mindsets.)

Security is also one of the [Asilomar AI Principles](https://futureoflife.org/open-letter/ai-principles/):

> 6) **Safety:** AI systems should be safe and secure throughout their operational lifetime, and verifiably so where applicable and feasible.

I am a member of the AI Alignment project [aintelope](https://www.lesswrong.com/posts/c2tEfqEMi6jcJ4kdg/brain-like-agi-project-aintelope) and work to properly secure the project as we grow. Right now, we have security at the token level (as defined above): A private Github project, a private Slack group, and some token vetting of people with access.  

How can we do better? What resources are there? First, I looked at Lesswrong. There are the tags [Computer Security & Cryptography](https://www.lesswrong.com/tag/computer-security-and-cryptography) and [Security Mindset,](https://www.lesswrong.com/tag/security-mindset) which have some relevant posts, including [Security Mindset and Ordinary Paranoia](https://www.lesswrong.com/posts/8gqrbnW758qjHFTrH/security-mindset-and-ordinary-paranoia), and [Secure homes for digital people](https://www.lesswrong.com/posts/vit9oWGj6WgXpRhce/secure-homes-for-digital-people). There is also [Work on Security Instead of Friendliness?](https://www.lesswrong.com/posts/m8FjhuELdg7iv6boW/work-on-security-instead-of-friendliness) which is about the relation between AI Alignment and Security. But there is little material that helps me secure our project. I think this community, with many people working on alignment projects, needs to have better resources for security. 

Please post best practice resources as answers in the below format. Select sources that you think have high quality. Use regular comments for discussion. Please upvote if you agree with the assessment based on quality. If you disagree with the level, use the factual agreement up/down.

**Level:** Token, Improving, Adequate, or Excellent

**Linked Title** (The title of the resource with a link to the source; for books, include the ISBN; consider linking to a review)

**Description:** A short description; may be copied from a review 

**Alternative Material** (optional, but bonus points if you provide these): Two alternative sources that you are familiar with that are not as good as your preferred source. This is in the spirit of the rules from [The Best Textbooks on Every Subject](https://www.lesswrong.com/posts/xg3hXCYQPJkwHyik2/the-best-textbooks-on-every-subject).