Subscribe to CIO Magazine »

Uni fortifies Western Front with IDS

Nurtured NAC keeps malware out

The University of Western Sydney (UWS) has today gone live with a managed Intrusion Detection System (IDS) for its 5000 users.

The UWS has 38,000 students and 3000 staff across six campuses. Its gigabit wireless and fixed network connects more than 5000 Linux, Mac and Windows workstations across the university grounds and in the surrounding campuses.

IT provides and manages network access and offers technical support for UWS staff and students, and handles the central database for human resources.

UWS IT security coordinator Darren Geddes said it will go live over the next few days with a managed Verizon/Cybertrust IDS

"Universities don't want to be denied access to anything and denial-by-exception doesn't work well in that environment, so we need an active IDS to monitor traffic," Geddes said.

The IDS will complement a Network Access Control (NAC) Nortel Tunnel Guard on its wireless Virtual Private Network (VPN), a Juniper firewall, and a CA antivirus.

The wireless NAC validates the security of end-users against a predefined list of trusted antivirus solutions to prevent network infection. Candidates made the list, which initially contained seven different antivirus vendors, based on market share and includes McAffee, CA, Trend Micro, AVG and a number of open-source solutions.

Geddes said the last major virus infection occurred six months ago, however IT isolated the attack within a single zone.

He said the proliferation of different antivirus products and version releases is the biggest challenge with wireless NAC maintenance because it blocks all nodes that do not match the exception list.

"The NAC works reasonably well, but it comes unstuck when two versions of an antivirus solution are stored in separate locations," Geddes said, adding the latest Tunnel Guard update should fix the problem by cross checking against a Nortel database.

The efficiency of a NAC comes down to good management and throughly investigating the requirements to choose the best solution.

Geddes said the roll out will be smooth given the success of a two month trial.

The latest Juniper firewall will be easier to manage locally than the previous version, according to Geddes, because it offers better visibility into the rule sets via an online portal dubbed Gaurdian, and has an inbuilt Intrusion Prevention System (IPS) which he configures to monitor preset alerts.

UWS IT staff will be required to update rule sets and exceptions lists, while Verizon will handle maintenance and patching.

Geddes said the most burning problem is vendor and version compatibility between security log files.

The logs are used by the UWS IT security team to collate data regarding a security breach, including virus infections and hacking attempts. However Geddes said the task takes significantly longer due to interoperability between the files, which requires hours of tedious reading.

"We have to trawl through consolidation of logs from different products, authentication and maintenance controller logs for Windows, and IDS and antivirus logs; it is painful because sometimes we have to cross reference all of them and the vendors keep changing log formats," Geddes said.

He said there is no available solution to the problem.

The network uses Cisco 6500 routers on its core network and a range of Nortel equipment to manage its wireless system.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: CA Technologies, Cisco, IPS, Juniper, Linux, Nortel, Trend Micro, University of Western Sydney, University of Western Sydney, Verizon, VIA
Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
  • Using an Expert System for Deeper Vulnerability Scanning
    This paper serves security professionals interested in better techniques for finding vulnerabilities, who have a solid understanding of networking principles and familiarity with the concepts related to hacking, vulnerabilities, and exploits. Read on for an in-depth view of the use of expert systems to achieve accurate and detailed vulnerability results.
    Learn more »
  • Swiss Nuclear Power Plant Improves Business Continuity
    Learn how Kernkraftwerk Leibstadt (KKL), a Swiss nuclear power plant, achieved 95% virtualization with 50% fewer servers in just two months by implementing a Vblock System. The solution ensures that KKL can reliably deliver the continuous electricity supply safely and cost effectively.
    Learn more »
  • The F5 DDoS Protection Reference Architecture part 2 of 3
    This whitepaper is the second in a three-part series on distributed denial of service attacks (DDoS) and multi-tier DDoS protection. This section details the design and capabilities of different forms of protection architecture designed for a variety of circumstances, while also providing alternative approaches. The paper also explains how to maintain availability, including network and application defense and DNS DDoS Mitigation.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index

Recent comments