Unlocking access

When it comes to deciding to use a virtual private network, program managers are immediately confronted with choosing one of two possible types: One based on the IP Security protocol, or one based on Secure Sockets Layer. The Mississippi Department of Corrections went with SSL because its IT employees found that it worked better with mobile clients.The department keeps track of more than 50,000 offenders, about half of them scattered among three state prisons, six privately run prisons and 11 regional facilities and county jails. The other 27,000 are probationers and parolees scattered around the state.'We have probation officers in each of 70 counties,' said Jerry A. Horton, the department's manager of network services. 'We have to have information on all of the prisoners. They belong to us.'Maintaining access to this data is critical. Probation officers need to keep track of their charges and prison officials need to know where each prisoner is at any time. 'When you are moving prisoners, even within a facility, you have to keep track,' Horton said. 'If you put members of two rival gangs together, one of them is going to kill the other.'Unfortunately, accessing that data is not always simple.'The probation officers don't spend a lot of time in their offices,' Horton said. 'They have to be able to access this system no matter where they are.'Workers at county jails and privately run prisons add another layer of complexity. 'They have to have access to our inmate tracking system, but as they are not state employees, we run into security issues.'Decentralizing the tracking system to give each group access to its own data was not an option.'We didn't want to get into the business of importing and exporting data to other systems,' Horton said. 'That leads to all kinds of lag time.'The situation was manageable when the tracking system ran on a DOC mainframe and remote workers at jails and private prisons could use terminal emulation to connect.'But when we pulled the plug on that about two years ago, something had to change,' Horton said. 'We bought a system that ran on an Oracle database and suddenly we had problems.'A virtual private network was tried, based on IPSec. However, IPSec works best with site-to-site connections, where each connection has its own IP address. 'They could not make it work with more than one person connecting at a time' from each site, Horton said. 'Sometimes they needed 20 or 30 at a time.'And IPSec doesn't always work well with firewalls and access policies, making access by probation officers with mobile devices difficult.'I started doing some research, and came across the Secure Sockets Layer environment,' Horton said.About a year ago, DOC installed an SSL VPN from Aventail Corp. of Seattle to give some 500 remote and mobile workers access to the tracking system, the inmate banking system and other applications.'It gives a lot of freedom to our employees that we didn't have before,' Horton said.As work environments become more distributed and mobile, SSL is an increasingly popular choice for virtual private networking, said Aventail product manager Chris Witeck. 'IPSec VPNs are designed for fixed connections. They struggle a bit when you add mobility into the mix.'Controlling access based on the identity of the user, the location of the connection and the configuration of the client device also are difficult to do with IPSec.SSL VPNs are commonly associated with browser-based access to Web resources. But with an SSL client agent they can provide access to both Web and client-server applications. Aventail Connect Mobile gives users of personal digital assistants, cell phones and other devices running Windows Mobile access to network resources.IPSec still has the largest installed base, but Witeck said SSL has the lead in new installations and slowly is replacing IPSec. 'We're seeing a movement toward SSL as more people are being expected to work remotely with devices that are increasingly mobile.'Aventail has been making SSL VPNs for eight years, but saw the market take off about three years ago when it began packaging it as an appliance in the ST2 SSL VPN. It is a premises-based box that usually goes into the network edge, in the DMZ behind the firewall. A policy manager console lets administrators decide who is allowed to access which resources from what types of devices.The box interrogates each device, and depending on the device's type and configuration it is granted the appropriate level of access.Mississippi's DOC represents the trend driving adoption of SSL VPNs, Witeck said. 'They are pretty much early adopters for mobile applications, which has been a growth area for us.'In researching the VPNs, Horton narrowed the field to two small companies, Aventail and NetSilica Inc., a maker of application and Web security gateways.'We looked at both' on the network, he said. 'Aventail won out in that it seemed to be more flexible and would support PDAs and BlackBerrys.'The state's IT Services group, which runs and sets security policy for the statewide backbone, had a concern about the VPN. The SSL connection makes the target network visible to the local network from which the client is connecting. Aventail agreed to fix the problem in a future release of the product by allowing the client to block the local network's view, probably in mid-2007.'No one else was willing to work with us that way,' Horton said.The DOC is using a single mid-range EX-1600 box that handles up to 250 concurrent connections, with a license for 100 concurrent connections.'That has worked so far, but the numbers are getting close to the point where I'll have to add' to the license, Horton said.The number of VPN users is likely to grow even faster. Horton said he found that the box also will act as a WiFi gateway, and he intends to set it up to allow controlled Internet access from the department's wireless access points.He also did a pilot test of cellular wireless cards for notebooks. 'That worked very well with the Aventail box.'He wants to make that service available to mobile users, but will have to wait until the state finishes selecting a new cellular service provider. He tested the system with Cellular South and Cingular.'Both systems worked quite well with the Aventail box, but the two are not compatible with each other,' he said.