Uni fortifies Western Front with IDS
- 22 February, 2008 20:11
The University of Western Sydney (UWS) has today gone live with a managed Intrusion Detection System (IDS) for its 5000 users.
The UWS has 38,000 students and 3000 staff across six campuses. Its gigabit wireless and fixed network connects more than 5000 Linux, Mac and Windows workstations across the university grounds and in the surrounding campuses.
IT provides and manages network access and offers technical support for UWS staff and students, and handles the central database for human resources.
UWS IT security coordinator Darren Geddes said it will go live over the next few days with a managed Verizon/Cybertrust IDS
"Universities don't want to be denied access to anything and denial-by-exception doesn't work well in that environment, so we need an active IDS to monitor traffic," Geddes said.
The IDS will complement a Network Access Control (NAC) Nortel Tunnel Guard on its wireless Virtual Private Network (VPN), a Juniper firewall, and a CA antivirus.
The wireless NAC validates the security of end-users against a predefined list of trusted antivirus solutions to prevent network infection. Candidates made the list, which initially contained seven different antivirus vendors, based on market share and includes McAffee, CA, Trend Micro, AVG and a number of open-source solutions.
Geddes said the last major virus infection occurred six months ago, however IT isolated the attack within a single zone.
He said the proliferation of different antivirus products and version releases is the biggest challenge with wireless NAC maintenance because it blocks all nodes that do not match the exception list.
"The NAC works reasonably well, but it comes unstuck when two versions of an antivirus solution are stored in separate locations," Geddes said, adding the latest Tunnel Guard update should fix the problem by cross checking against a Nortel database.
The efficiency of a NAC comes down to good management and throughly investigating the requirements to choose the best solution.
Geddes said the roll out will be smooth given the success of a two month trial.
The latest Juniper firewall will be easier to manage locally than the previous version, according to Geddes, because it offers better visibility into the rule sets via an online portal dubbed Gaurdian, and has an inbuilt Intrusion Prevention System (IPS) which he configures to monitor preset alerts.
UWS IT staff will be required to update rule sets and exceptions lists, while Verizon will handle maintenance and patching.
Geddes said the most burning problem is vendor and version compatibility between security log files.
The logs are used by the UWS IT security team to collate data regarding a security breach, including virus infections and hacking attempts. However Geddes said the task takes significantly longer due to interoperability between the files, which requires hours of tedious reading.
"We have to trawl through consolidation of logs from different products, authentication and maintenance controller logs for Windows, and IDS and antivirus logs; it is painful because sometimes we have to cross reference all of them and the vendors keep changing log formats," Geddes said.
He said there is no available solution to the problem.
The network uses Cisco 6500 routers on its core network and a range of Nortel equipment to manage its wireless system.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Five trends affecting legal CIOs
CIO Roundtable: The changing face of security
Bitcoin malware count soars as cryptocurrency value climbs
Bouncing Back From CIO Unemployment
Union slams latest fibre-to-premise trial in Tasmania
Chandler Macleod recruits new user virtualization platform
One of Australasia’s largest and most successful recruitment and human capital management companies share their success story after recruiting a user virtualization platform, giving them control over the users and devices that have access to specific applications.
Evolving Threats Demand New Approaches to Security
As the world becomes increasingly hyperconnected, the opportunities for innovation are virtually limitless. At the same time, the complexity and risk associated with those opportunities is great. Security threats have the potential for enormous ramifications, but so does deploying a security strategy that compromises the user experience, performance, and the ability to innovate online. This paper will profile the emerging disruptive players, and identifies the essential steps to establishing a secure environment without compromising performance or experience.
Security in a Faster Forward World
Organizations today operate in a Faster Forward world, as they experience a shift towards an increasingly mobile workforce. Following this, an evolving stream of attackers are now targeting mobile devices where they can more easily access a larger number of high-value corporate and government assets. This paper will guide you through finding the right Web security partner that can improve efficiency while reducing risks and improving web experience.