Uni fortifies Western Front with IDS
- 22 February, 2008 20:11
- Comments
The University of Western Sydney (UWS) has today gone live with a managed Intrusion Detection System (IDS) for its 5000 users.
The UWS has 38,000 students and 3000 staff across six campuses. Its gigabit wireless and fixed network connects more than 5000 Linux, Mac and Windows workstations across the university grounds and in the surrounding campuses.
IT provides and manages network access and offers technical support for UWS staff and students, and handles the central database for human resources.
UWS IT security coordinator Darren Geddes said it will go live over the next few days with a managed Verizon/Cybertrust IDS
"Universities don't want to be denied access to anything and denial-by-exception doesn't work well in that environment, so we need an active IDS to monitor traffic," Geddes said.
The IDS will complement a Network Access Control (NAC) Nortel Tunnel Guard on its wireless Virtual Private Network (VPN), a Juniper firewall, and a CA antivirus.
The wireless NAC validates the security of end-users against a predefined list of trusted antivirus solutions to prevent network infection. Candidates made the list, which initially contained seven different antivirus vendors, based on market share and includes McAffee, CA, Trend Micro, AVG and a number of open-source solutions.
Geddes said the last major virus infection occurred six months ago, however IT isolated the attack within a single zone.
He said the proliferation of different antivirus products and version releases is the biggest challenge with wireless NAC maintenance because it blocks all nodes that do not match the exception list.
"The NAC works reasonably well, but it comes unstuck when two versions of an antivirus solution are stored in separate locations," Geddes said, adding the latest Tunnel Guard update should fix the problem by cross checking against a Nortel database.
The efficiency of a NAC comes down to good management and throughly investigating the requirements to choose the best solution.
Geddes said the roll out will be smooth given the success of a two month trial.
The latest Juniper firewall will be easier to manage locally than the previous version, according to Geddes, because it offers better visibility into the rule sets via an online portal dubbed Gaurdian, and has an inbuilt Intrusion Prevention System (IPS) which he configures to monitor preset alerts.
UWS IT staff will be required to update rule sets and exceptions lists, while Verizon will handle maintenance and patching.
Geddes said the most burning problem is vendor and version compatibility between security log files.
The logs are used by the UWS IT security team to collate data regarding a security breach, including virus infections and hacking attempts. However Geddes said the task takes significantly longer due to interoperability between the files, which requires hours of tedious reading.
"We have to trawl through consolidation of logs from different products, authentication and maintenance controller logs for Windows, and IDS and antivirus logs; it is painful because sometimes we have to cross reference all of them and the vendors keep changing log formats," Geddes said.
He said there is no available solution to the problem.
The network uses Cisco 6500 routers on its core network and a range of Nortel equipment to manage its wireless system.
Recommended
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
-
Larry Page wants to see your medical records
-
Dual-Persona Smartphones Not a BYOD Panacea
-
After two-year hiatus, EFF accepts bitcoin donations again
-
CIOs struggle to deliver timely mobile business apps: survey
-
Spiceworks' free management software gets integrated MDM
-
Integrated Computing Platforms: Infrastructure Builds for Tomorrow’s Data Centre
Integrated Computing Platforms, such as EMC VSPEX RAs, provide a solution by eliminating the time (and cost) of designing, testing, and engineering integrated environments with components built independently of one another. These validated architectures are ready for production environments upon delivery, and offer a single point of support should IT require it. Learn more on how a leading IT vendor has aligned product innovation with an IT market need to improve efficiency, performance, and value for SMBs. -
Best Practices for Migrating to SharePoint 2013
This white paper details a number of best practices for migrating to SharePoint 2013. These best practices also apply to migrations to most earlier versions of SharePoint. Download now. -
Advanced Malware Exposed
This handbook shines a light on the dark corners of advanced malware, both to educate as well as to spark renewed efforts against these stealthy and persistent threats. By understanding the tools being used by criminals, we can better defend our nations, our critical infrastructures and our citizens. This ebook will provide readers with a new understanding of the rapidly developing cyber threat landscape and practical insights into how they can protect their data and computing infrastructures. Download now.
Get exclusive access to Invitation only events CIO, reports & analysis. 
