2008 InfoWorld CTO 25: Bill Gruszka, Southern Polytechnic State University

It's clear that mobile computing is becoming an expectation, both through laptops and the emerging generation of Web-savvy handhelds such as the Apple iPhone and Nokia N95. But the mobile world is both highly fragmented and hard to control, given that users typically consider their devices to be personal ones that an outsider such as IT should not take over.

Universities face this reality perhaps more than any other business, and because students come and go -- and faculty often have more power than IT -- a "do what I say" approach to ensuring consistency and security won't fly. At the 4,400-student Southern Polytechnic State University in suburban Atlanta, CIO Bill Gruszka took a different path to secure his systems than trying to control the end points.

[ Discover what insights you can take advantage of from the other 2008 InfoWorld CTO 25 winners. ]

Gruszka implemented the standard approaches to wireless security, of course, but the realities of his heterogeneous, user-managed environment required he think beyond those approaches as well.

For example, in an open environment such as a campus, it's easy for data thieves to place their own access points to intercept people trying to log onto the campus network, thus stealing passwords and other information. By using the same SSID as the campus' access points, students' and faculty's devices would automatically connect to the rogues, unbeknownst to the users. So Gruszka put in a Meru Networks system of access points that "know" each other and zap rogue access points with jamming signals, so users never see them. This approach lets users access the wireless network without extra training, hassles, or tools, yet remain secure.

Another issue is assuring user authentication, so the network can appropriately limit users' access to approved resources. With an ever-changing mix of devices coming on campus -- "iPhones were big this year," Gruszka notes -- it was impossible to get one authentication client in place. And even if it had been possible, the overhead of distributing and helping users install it would overwhelm Gruszka's staff.

Gruszka had to take a multiprong strategy to address this problem. One answer: Use the open source SecureW2 802.1x client and the EAP/Tunneled TLS protocol. Apple Macs and most PCs ship with the drivers for the Secure W2 client, so that covered most laptop users out of the box. For the rest of the PC users and mobile device users, the university set up a secure Web page that requires users to log in via HTTPS.