The University of Western Sydney (UWS) has today gone live with a managed Intrusion Detection System (IDS) for its 5000 users.
The UWS has 38,000 students and 3000 staff across six campuses. Its gigabit wireless and fixed network connects more than 5000 Linux, Mac and Windows workstations across the university grounds and in the surrounding campuses.
IT provides and manages network access and offers technical support for UWS staff and students, and handles the central database for human resources.
UWS IT security coordinator Darren Geddes said it will go live over the next few days with a managed Verizon/Cybertrust IDS
"Universities don't want to be denied access to anything and denial-by-exception doesn't work well in that environment, so we need an active IDS to monitor traffic," Geddes said.
The IDS will complement a Network Access Control (NAC) Nortel Tunnel Guard on its wireless Virtual Private Network (VPN), a Juniper firewall, and a CA antivirus.
The wireless NAC validates the security of end-users against a predefined list of trusted antivirus solutions to prevent network infection. Candidates made the list, which initially contained seven different antivirus vendors, based on market share and includes McAffee, CA, Trend Micro, AVG and a number of open-source solutions.
Geddes said the last major virus infection occurred six months ago, however IT isolated the attack within a single zone.
He said the proliferation of different antivirus products and version releases is the biggest challenge with wireless NAC maintenance because it blocks all nodes that do not match the exception list.
"The NAC works reasonably well, but it comes unstuck when two versions of an antivirus solution are stored in separate locations," Geddes said, adding the latest Tunnel Guard update should fix the problem by cross checking against a Nortel database.
The efficiency of a NAC comes down to good management and throughly investigating the requirements to choose the best solution.
Geddes said the roll out will be smooth given the success of a two month trial.
The latest Juniper firewall will be easier to manage locally than the previous version, according to Geddes, because it offers better visibility into the rule sets via an online portal dubbed Gaurdian, and has an inbuilt Intrusion Prevention System (IPS) which he configures to monitor preset alerts.
UWS IT staff will be required to update rule sets and exceptions lists, while Verizon will handle maintenance and patching.
Geddes said the most burning problem is vendor and version compatibility between security log files.
The logs are used by the UWS IT security team to collate data regarding a security breach, including virus infections and hacking attempts. However Geddes said the task takes significantly longer due to interoperability between the files, which requires hours of tedious reading.
"We have to trawl through consolidation of logs from different products, authentication and maintenance controller logs for Windows, and IDS and antivirus logs; it is painful because sometimes we have to cross reference all of them and the vendors keep changing log formats," Geddes said.
He said there is no available solution to the problem.
The network uses Cisco 6500 routers on its core network and a range of Nortel equipment to manage its wireless system.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.