Get Connected: An Approach to ResNet Services

14 As happens on many college campuses at the beginning of an academic year, thousands of students move into campus housing on Indiana University’s Bloomington and Indianapolis campuses within a threeday period. More than 96 percent arrive with at least one personal computer (and possibly also a PDA, cell phone, and gaming system), and most expect to connect to the campus network within a few hours, if not minutes, of arrival. Indiana University Information Technology Services (UITS) is charged with ensuring these connections within a reasonable amount of time and without compromising network security.1 Many ResNet professionals concur that the task of connecting more than 13,000 computers to the network seems especially daunting in an environment where one compromised machine can cripple an entire network, as happened with the Blaster computer worm in 2003. In a nationwide 2005 ResNet survey conducted by the ResNet Applied Research Group and published by the EDUCAUSE Center for Applied Research (ECAR), IT security “including spyware, adware, and viruses” was reported as the biggest challenge facing ResNet professionals.2 Approaches to network access policy and control, quarantine, and mitigation vary greatly across institutions of higher education, ranging from no network policy and no access control to a variety of both home-grown and commercial solutions. According to the 2005 ResNet survey conducted by the ResNet Applied Research Group, about 22 percent of responding universities lack a network registration and access control process for their ResNets.3 Of those that do offer network registration and access control, nearly half develop in-house solutions. Regardless of whether the solutions are commercial or custom built, few universities actively scan their ResNets for security threats after initial registration, and few solutions employed (less than 30 percent) can quarantine noncompliant computers for self-remediation. Commercial solutions for network access control and network mitigation typically offer several advantages to smaller institutions, in particular a reduced need to employ software developers and network engineers to maintain, monitor, and manage the university/ResNet network. For the 35 percent of universities that employ fewer than two full-time people to support their residential networks, staffing can be a critical issue.4 The trade-off when purchasing a commercial solution comes in the lack of ability to customize the solution, plus both large initial capital investment and ongoing maintenance required for network appliances and software. Universities with large amounts of bandwidth may also find that some commercial network mitigaIndiana University explains what to do when 13,000 unknown computers connect to your network in three days