Batten down the hatches

U.S. Merchant Marine Academy midshipmen spend about a year at sea during their course of study, and, as anyone who has read Melville or seen 'Master and Commander' knows, the sea can be dangerous.But the ocean isn't the only threat to sailors who go to sea with PCs.'In the last couple of years, the Internet has become an increasingly hostile place,' said Howard Weiner, the academy's CIO.Notebook computers have been standard issue for students for a decade and are essential tools for schoolwork, both on land and sea. When students are away from the Kings Point, N.Y., campus and its managed network, they also use the computers for Web-based e-mail and general browsing.'When these kids return to campus, their computers are a mess,' Weiner said. 'It's not just that the software stack is out of date, but their entire ecosystem has been compromised. They tell us they've been having problems, and when we take a look, more often than not we find they have some kind of spyware.'Faculty members, in demand by industry and the Defense Department as consultants, are another problem.'They are extremely mobile,' Weiner said. 'They leave the network and the care we provide, and when they come back to us, they're dirtier than when they left.'So how does an organization ensure that pesky end users don't undo the work of the IT department by bringing unclean, unkempt computers into the network?Weiner was looking for a product that would scan end devices periodically and found what he needed in the Enforcer network access control appliance from Lockdown Networks Inc. of Seattle. It can run scans with or without a client agent at any time, not just on log-in, and a separate console allows central policy management of network access for almost any network device. 'Threats can come from anywhere, not just the PC,' said Dan Clark, VP of marketing for Lockdown Networks.The Merchant Marine Academy, overseen by an agency of the Transportation Department, is one of five U.S. service academies. Its 1,000 students earn a bachelor of science degree, a commission in a military reserve organization and a Coast Guard merchant marine officer's license.'You're talking about a ticket to go on any vessel,' Weiner said.The midshipmen have an extended, 11-month academic year and are at sea much of their sophomore and senior years.When he joined the academy as CIO in mid-2004, 'one of the top items on my agenda was security,' Weiner said.It was not just mobile students and faculty that created security problems. Network servers were also a challenge.'We have been concerned that when we put a server online, we know that its configuration is good,' Weiner said. 'If you don't, you're just courting disaster.'But the small IT staff was having trouble keeping up with vulnerability patching and software upgrades. In early 2005, Weiner talked to Cisco Systems Inc. about its Network Admission Control products.'It had a major shortcoming,' he said. 'It could only do admission controls on initial authentication to the network.' This could not ensure that devices remaining on the network for long periods, including servers, were in compliance with security policies. It also required other Cisco components.Weiner was looking for something that would do periodic scans rather than log-in scans only. Until he found Lockdown Networks, 'we could not find anybody who had such a product.'Getting hardware for trials can be difficult for federal organizations, but the academy staff assessed the Enforcer and decided to spring for it.'We saw it was an acceptable risk to buy one and see how it would work,' Weiner said.The Enforcer is intended for network devices rather than remote connections. It plugs into a managed switch and makes access policy decisions based on the user and the configuration of the device. The systems can evaluate up to 7,000 criteria to determine if a device gets access'and to what. Devices that need to be patched or updated, or need a thorough cleaning, can be quarantined or directed to a site where the proper updates are available.Enforcer supports most major Layer 2 switch vendors and tests for the presence and status of security tools from more than 40 vendors. It can scan without an agent to have the least impact on the client device, or can be used with a light client application when network scanning is not practical or desirable.One appliance can support up to 2,000 users, depending on the access policies being applied, Clark said. The number of concurrent sessions is not an issue because the device is not an inline filter, but only scans devices periodically and passes judgment on their condition.The cost is $24,995 for a 1U appliance and $39,995 for a 2U appliance that provides redundancy. The academy purchased a single device and is running client agents on the computers it manages.'It has done what we wanted it to do,' Weiner said. 'We have been able to ID returning midshipmen when they are in trouble and get them mitigated quickly.'The biggest help has been in managing server configuration. The servers also have Enforcer agents running on them. Patches are pushed out using Microsoft Systems Management Server but, without periodic scanning, 'keeping up with Microsoft patch Tuesday had been a big challenge,' Weiner said.The academy still faces challenges with populations outside its student body and faculty.'As an institution of higher education, we must be simultaneously closed and open,' Weiner said. He must protect the core network while serving 'people who we didn't know existed yesterday, and who might be gone tomorrow.' Visitors and short-term students now get Internet access without access to the academy's core network.