June 02, 2008

2008 InfoWorld CTO 25: Bill Gruszka, Southern Polytechnic State University

Faced with an ever-changing, complex mobile user base, the CIO takes a different tack to assure security without having to fight users

It's clear that mobile computing is becoming an expectation, both through laptops and the emerging generation of Web-savvy handhelds such as the Apple iPhone and Nokia N95. But the mobile world is both highly fragmented and hard to control, given that users typically consider their devices to be personal ones that an outsider such as IT should not take over.

Universities face this reality perhaps more than any other business, and because students come and go -- and faculty often have more power than IT -- a "do what I say" approach to ensuring consistency and security won't fly. At the 4,400-student Southern Polytechnic State University in suburban Atlanta, CIO Bill Gruszka took a different path to secure his systems than trying to control the end points.

[ Discover what insights you can take advantage of from the other 2008 InfoWorld CTO 25 winners. ]

Gruszka implemented the standard approaches to wireless security, of course, but the realities of his heterogeneous, user-managed environment required he think beyond those approaches as well.

For example, in an open environment such as a campus, it's easy for data thieves to place their own access points to intercept people trying to log onto the campus network, thus stealing passwords and other information. By using the same SSID as the campus' access points, students' and faculty's devices would automatically connect to the rogues, unbeknownst to the users. So Gruszka put in a Meru Networks system of access points that "know" each other and zap rogue access points with jamming signals, so users never see them. This approach lets users access the wireless network without extra training, hassles, or tools, yet remain secure.

Another issue is assuring user authentication, so the network can appropriately limit users' access to approved resources. With an ever-changing mix of devices coming on campus -- "iPhones were big this year," Gruszka notes -- it was impossible to get one authentication client in place. And even if it had been possible, the overhead of distributing and helping users install it would overwhelm Gruszka's staff.

Gruszka had to take a multiprong strategy to address this problem. One answer: Use the open source SecureW2 802.1x client and the EAP/Tunneled TLS protocol. Apple Macs and most PCs ship with the drivers for the Secure W2 client, so that covered most laptop users out of the box. For the rest of the PC users and mobile device users, the university set up a secure Web page that requires users to log in via HTTPS.

Close

On Twitter now

Careers

Powered by Twitter

On Twitter now

additional resources
White Paper - How to Improve Delivery of Advanced Web Applications

White Paper

Virtual Workforce: The Key to Expanding The Business While Cutting Costs

Get the independent advice and expertise you need to support a virtual workforce.

Go inside:
The three-step approach to making a virtual workforce a reality.
The four flavors of client virtualization technologies.
The three key initiatives that solve IT challenges.
Download now »
White Paper: Successfully Secure Your Wireless LAN With Wi-Fi firewalls.

White Paper

Addressing Linux Threats Leveraging Fewer Resources

The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Read this 2 page white paper now to learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.

Download now »
White Paper - The 2009 Handbook of Application Delivery

White Paper

The 2009 Handbook of Application Delivery

Ensuring acceptable application delivery will become even more difficult over the next few years. As a result, IT organizations need to ensure that the approach that they take to resolving the current application delivery challenges can scale to support the emerging challenges. This handbook elaborates on the key tasks associated with planning, optimization, management and control and provides decision criteria to help IT organizations choose appropriate solutions.

Download now »
White Paper - Is Your Backup System Outdated?

White Paper

Mid-range Storage Considerations

A common misconception is that mid-range storage requirements are dramatically different than that of a larger enterprise. Mid-range storage users may require less capacity, but they have similar functionality and management requirements. This ESG paper examines mid-range storage needs and reviews a new solution that adjusts size while retaining value, performance and functionality.

Download now »

Today's Headlines: First Look Newsletter

Find out what will be news for the day, with our first-thing-in-the-morning briefing.

©1994-2010 Infoworld, Inc.