University College Falmouth scans computers remotely

For a network manager, there is no challenge quite like balancing security needs with the desires of hundreds of students who want to freely access the internet to download music and play games.

‘It is certainly a job that keeps you on your toes,’ says Chris Whitwood, network manager at University College, Falmouth.

In recent months, Whitwood has noticed a definite increase in the number of students connecting to the college network using mobile and wireless devices, and expecting to be able to access resources using their own laptops and WiFi technology. It would not be practical to simply forbid access, says Whitwood, so the college has beefed up its security policies in response.

Students accessing the corporate network are scanned and monitored by an intrusion detection system that can block access if a student’s laptop is infected with a virus or other malicious code. Once a laptop has been blocked, the student can contact a 24-hour IT support centre where they can get advice on how to clean up their computer.

However, the college has still found itself caught out by infected machines in the past – so is evaluating a network access control application from Cisco that could scan any machine connecting to the network and permit or block access based on pre-defined criteria.

‘It will mean we can say that if their machine is not running an up-to-date anti-virus system and Service Pack 2, say, they simply will not be able to access the network,’ says Whitwood.

The college also uses filtering and blocking software to prevent access to many internet services – including all illegal peer-to-peer sites. Whitworth says that his approach to keeping on top of emerging security threats is always to err on the side of caution.

‘I would say that we have always been draconian in our security policies, and that is not going to change,’ he says.

For 2007, Whitwood’s priorities are to implement the network access control system – if the evaluation indicates that the system is worthwhile – and to beef up the security of the college’s voice over IP (VoIP) network.

‘We have been using VoIP for years, and we do try to ensure it is as secure as it can be,’ says Whitwood. ‘It is little things like monitoring it with the IDS and making sure it is on its own secure local area network, with only one, well-protected server facing outside that.’