Securing the Academic Network: Intrusion Prevention
- By Susan F. Moyer
- 04/01/04
An academic network is one of the most difficult networks to secure and maintain.
It must be open and accessible—much more so than networks in corporate,
government, or private sectors. The academic network is designed to facilitate
the flow of knowledge. Faculty and students must be able to pursue intellectual
inquest with minimal restraint.
This poses a difficult dilemma for campus network administrators. The open
nature of academic networks inevitably comes into conflict with the requirements
of network security. Campus networks contain highly sensitive information—personnel
and financial data on students and their families, academic and administrative
records, and high-value research and intellectual property. Network administrators
must find the balance point between open access and security.
Striking this balance is critical, but it’s not the only security challenge
campus IT departments face. Other high-priority issues include:
- Liability. The explosive growth of Peer-to-Peer (P-to-P) file sharing on
campus has introduced significant security and liability concerns, most notably
in the area of copyright infringement. P-to-P networks and file sharing have
opened the door to charges of copyright violations and high-profile litigation.
Student-launched network attacks also raise liability concerns. Campus IT
departments must avoid being found complicit in enabling illegal student activity.
- Distributed authority. IT staff are directly responsible for information
security, yet lack the authority to dictate security policies. Often each
academic department creates its own access policies, yet the campus IT group
typically bears ultimate responsibility for the security and functioning of
the network. The IT group must operate in an environment of decentralized
network authority, while maintaining centralized responsibility for the health
of the network.
- Budgets and bandwidth. Growing demand for bandwidth continually strains
budgets and resources. Sh'estring IT budgets are the norm on college campuses.
Yet the educational process is now dependent on the Internet. With wireless
networks sprouting up in dormitories and P-to-P usage increasing exponentially,
network management and bandwidth costs are on the rise.
- Varied skill sets. Campus IT staffs are overwhelmed with responsibilities
and typically operate with limited resources and skill-sets. Students are
often recruited to help ease the burden, but they may not have the requisite
skills or depth of experience.
These challenges must
be managed within an
educational culture built on thefree exchange of
information and ideas.
Maintaining the integrity and security of confidential information on the network,
while allowing access to thousands or tens of thousands of users, creates unique
problems for the campus IT staff and network administrators.
Network Security at Susquehanna
Susquehanna University is located in central Pennsylvania and serves a student
body of approximately 1,800. We maintain 30 network servers (file servers, domain
controllers, DHCP servers, etc.) with close to 3,000 end-point workstations
among students, faculty, and laboratories.
Security is one of the 14-person IT group’s primary concerns. We undergo
an extensive third-party audit every two years and continually update our network
and policies based on the audit results. Although we have long relied on a firewall
to provide basic perimeter security, a recent audit recommended implementing
an intrusion detection system (IDS) to better monitor and respond to network
attacks and other potentially harmful traffic.
Policies in Perspective
University policy prohibits all music and DVD sharing. This is solely driven
by liability and copyright issues. The IT group simply can’t be perceived
as fostering an environment that facilitates the duplication and transfer of
copyrighted material.
Although we can’t lock down the workstations on our network with the same
control non-academic organizations can, we require student-owned machines to
meet certain requirements. Before we issue student machines Internet Protocol
(IP) address and allow them on the network, their workstations must:
- Register on the campus network;
- Conform to a standardized naming convention;
- Provide us with their unique hardware address.
This gives us the ability to pinpoint any specific problems or suspicious activity
and take appropriate action. We also periodically scan all workstations for
malicious applications and services, such as hacking software. If any such programs
are found, we terminate the network connection to the non-compliant machine.
Intrusion Detection and Prevention
Because we have very little control over student and faculty workstations, we
maximize our usage of the firewall and IDS to secure the network. The IDS solution
we implemented, StillSecure Border Guard, is both an IDS and an intrusion prevention
system (IPS). The IPS features allow us to terminate harmful traffic before
it enters or exits the network. It continuously monitors all traffic at our
connection to the Internet and can instantaneously identify and terminate attacks
and malicious traffic.
Like a firewall, the IDS/IPS system lets us create rules that govern the types
of traffic permissible on the network. When impermissible traffic is detected,
the system treats it just like an attack and takes appropriate action. This
allows us to automatically block any traffic that might expose the university
to liability claims, such as file sharing and P-to-P activity.
The IPS also allows us to customize and automate the response to each detected
attack or questionable packet of traffic. Depending on the severity of attack
or policy violation, we can instantly terminate the traffic, block the machine
that is sending or receiving the data, or simply alert network administrators
that suspicious activity is occurring.
The system maintains a significant amount of background information on each
individual attack, for example, the systems being targeted, the consequences
of a successful attack, and the vulnerabilities the attack exploits. This history
is extremely beneficial for determining how we should respond to each attack—it
gives us the information we need to make the right decision.
Between our firewall and the IDS/IPS, we have been saved from the viruses and
attacks that have brought other colleges in the area to their knees.
An Ongoing Battle
Educational institutions are in many respects at greater risk than other organizations.
Their limited budgets and resources prohibit the implementation of adequate
security measures. The decentralized and diverse nature of collegiate networks
present complex IT challenges.
These challenges must be managed within an educational culture built on the
free exchange of information and ideas. Successful IT solutions, like intrusion
detection/prevention systems, offset stretched or insufficient resources by
automating processes, reducing the workload, and increasing staff efficiency.