Security Case Study

WSU Brings Its Network Back from the Breaking Point

• By Bridget McCrea
• 08/28/09

For years Washington State University relied on a licensed software application to protect the institution's computers from spam and viruses. The system worked fine for a while but began to show its weaknesses as technology and Internet usage increased across the campus.

"We started running up against capacity issues," said Tom Ambrosi, chief information security officer for the Pullman, WA-based university. Other challenges pointing Ambrosi in the direction of a new IT security platform included power space issues in the institution's data center and the need to either invest in an upgrade or completely replace the existing system.

With the second option making the most sense, Ambrosi began investigating available solutions. After looking at a few, he turned to a hosted solution that one university department was already using successfully.

Developed by Proofpoint, the on-demand solution provides unified e-mail security and data loss prevention against inbound threats such as spam and viruses. The Proofpoint system also prevents leaks of confidential and private information across all protocols, encrypts sensitive e-mails, and analyzes messaging infrastructures.

"Proofpoint was already a proven concept for one of our departments," said Ambrosi. "The more we looked at it for a campus-wide option, the more we liked it." The fact that Proofpoint was a hosted solution also made it attractive financially for the school, which like many others is watching its budget closely in today's economic climate.

"The solution was basically revenue-neutral for us," Ambrosi explained, adding that the institution's previous online security solution required in-house IT personnel for support and for equipment maintenance. "In the end, the new solution turned out to be less expensive than what we were previously spending."

Founded in Pullman in 1890, Washington State University's statewide system includes campuses in Spokane, the Tri-Cities, and Vancouver, as well as regional learning centers, extension offices in every county, and distance degree programs accessible worldwide. It serves about 25,000 students.

To get its new IT security system up and rolling, the university brought Proofpoint in to evaluate its current infrastructure. The process took about 30 days and found the two entities working together to see if the school's equipment would work well with the new solution. "It turned out that our current equipment (some of which was previously purchased in anticipation of a licensed solution) would be just fine," said Ambrosi.

Once the evaluation was completed, deployment of the hosted solution took "less than a month," according to Ambrosi. "It was fairly painless, and it went smoothly." With the new system in place, Washington State University was able to start scanning all of its inbound e-mail (and some outbound messages) across all of its departments. The messages are scanned for spam and viruses at the e-mail gateway, which "detects and blocks a lot more e-mail than our previous solution did," said Ambrosi.

In fact, the system is blocking so many messages that during its first few months in service Ambrosi received concerned calls from users who weren't getting their typical volume of e-mail. "Some of the support calls that came in during the first month or so were from users who thought their e-mail wasn't working," he explained. "When in fact they just weren't getting all of the spam that they were used to dealing with."

For those users who actually want to read their spam messages, Proofpoint provides individual quarantine areas where the spam is stored and accessible. "We have some folks who want to see every piece of mail that they receive," said Ambrosi. "They can go into their quarantined areas, see what's there, and determine if any of it is worth reading and/or keeping."

Once those early issues were worked out, Ambrosi said, the new IT security system was well received by all users. And because 70 percent to 80 percent of the mail destined for users "no longer reaches the campus anymore," he said, the institution no longer has to deal with capacity issues within its e-mail infrastructure. "All that burden has been taken off our internal IT system," said Ambrosi, "and placed on Proofpoint, whose servers deal with the e-mail before it even reaches our campus."

In the near future, Ambrosi said, Washington State University plans to beef up its online security system further by adding outbound e-mail scanning across more of its departments. He said the institution is also looking at Proofpoint's personal information scanning features (social security numbers and credit card information, for example) in order to further beef up its IT security function.

"We'd like to be able to scan all of the outbound e-mail," said Ambrosi, "to make sure none of that personal information leaves the university."