2008 InfoWorld CTO 25: Bill Gruszka, Southern Polytechnic State University

Faced with an ever-changing, complex mobile user base, the CIO takes a different tack to assure security without having to fight users

 

It's clear that mobile computing is becoming an expectation, both through laptops and the emerging generation of Web-savvy handhelds such as the Apple iPhone and Nokia N95. But the mobile world is both highly fragmented and hard to control, given that users typically consider their devices to be personal ones that an outsider such as IT should not take over.

Universities face this reality perhaps more than any other business, and because students come and go -- and faculty often have more power than IT -- a "do what I say" approach to ensuring consistency and security won't fly. At the 4,400-student Southern Polytechnic State University in suburban Atlanta, CIO Bill Gruszka took a different path to secure his systems than trying to control the end points.

[ Discover what insights you can take advantage of from the other 2008 InfoWorld CTO 25 winners. ]

Gruszka implemented the standard approaches to wireless security, of course, but the realities of his heterogeneous, user-managed environment required he think beyond those approaches as well.

For example, in an open environment such as a campus, it's easy for data thieves to place their own access points to intercept people trying to log onto the campus network, thus stealing passwords and other information. By using the same SSID as the campus' access points, students' and faculty's devices would automatically connect to the rogues, unbeknownst to the users. So Gruszka put in a Meru Networks system of access points that "know" each other and zap rogue access points with jamming signals, so users never see them. This approach lets users access the wireless network without extra training, hassles, or tools, yet remain secure.

Another issue is assuring user authentication, so the network can appropriately limit users' access to approved resources. With an ever-changing mix of devices coming on campus -- "iPhones were big this year," Gruszka notes -- it was impossible to get one authentication client in place. And even if it had been possible, the overhead of distributing and helping users install it would overwhelm Gruszka's staff.

Gruszka had to take a multiprong strategy to address this problem. One answer: Use the open source SecureW2 802.1x client and the EAP/Tunneled TLS protocol. Apple Macs and most PCs ship with the drivers for the Secure W2 client, so that covered most laptop users out of the box. For the rest of the PC users and mobile device users, the university set up a secure Web page that requires users to log in via HTTPS.

That covered basic network access, but not more sensitive data stores and applications. In those areas, Gruszka wanted users to go through VPNs, but the multiplicity of devices raised the client issue again. Here, the solution was to handle the security at the network end, not at the end point. The university implemented an SSL-based VPN from Juniper Networks that automatically loads into laptops and handhelds when they access the network, using ActiveX or Java. When the user disconnects, it wipes out session data and cookies, so the disconnected device is cleansed of access information in case it is later lost or stolen. When users are connected via the VPN, an LDAP server manages their access privileges.

The self-provisioned approach is key to letting Gruszka impose consistent security policies in a mobile environment without having to get in the thankless business of managing his users' end points.

Galen Gruman is executive editor of InfoWorld.