Why complete network visibility is critical for public safety

Door locks. HVAC systems. Multiple locations. Extensive connected IT networks. Controlling all of these elements plays an integral part in keeping a government agency secure. It isn’t always just about keeping the inside secure, it’s also about keeping the outside public safe.

Take for example, the Nevada Department of Corrections, which is responsible for the management of inmates throughout the state. NDOC houses over 13,000 convicts across more than 17 facilities, and it partners with other state and local programs for vocational training and rehabilitative services for incarcerated individuals prior to reintegration.

Every device that enters any of NDOC campuses, every door that opens, every computer that is used has to be strategically managed for security purposes -- particularly at the network level. Every person and appliance that accesses the network must be identified. The bring-your-own-device concept should not exist in such an environment. Outside phones or laptops that show up on NDOC's network are a major security hazard and push the boundaries of acceptable use. If a network failure or error results, the complications can be severe for inmates, staff and the public.

But what if it does happen? At NDOC, remote management failures, downtime and the inability to spot a vulnerability across the network were pushing the under-resourced team to extreme limits. Plus, a growing number of servers and locations meant that the network wasn’t being managed as a whole, so new locations weren’t integrated with the existing IP address management (IPAM) solution. 

This isn’t a new issue. Government agencies often struggle with ensuring their networks can be managed centrally -- often because agencies grow at a faster rate than their IT budgets. As a result, they piece together solutions or use Band-Aids to temporarily plug up holes. But the reality is that agencies can’t afford to have gaps, especially at the points where the outside world meets an organization’s network: domain name services (DNS),  Dynamic Host Configuration Protocol (DHCP) and IPAM.  Holes don’t just leave the agency exposed, they can put the staff and public at risk.

As the NDOC looked for a network automation and security solutions, it asked the following questions, which other agencies can use to evaluate products and services:

• Does the solution provide a 360-degree view of the network, assessing potential internal and external threats?
• Can solution identify threats and maintain the network’s availability at the same time?
• Does it provide flexibility and customization, such as ability to add on new locations and integrate with existing servers -- remote or onsite?
• Can it be managed centrally?
• What is the total cost of ownership (TCO)?
• Is any downtime required in order to change and implement a new solution?

NDOC's goal was  to manage its Linux-based locations centrally (previously impossible with its existing technology), while reducing TCO and saving time. Previously, non-IT staff at individual facilities had to figure out why a workstation wasn’t functioning, which was time-consuming and frustrating. These staff members should have been focused on managing inmates, not troubleshooting a network that was already proving costly to maintain. Changing this dynamic was a priority. The team ended up choosing a solution with delegated DNS management, flexible IPAM that supported Linux, and active/passive DHCP failover.

The IT team also thought about future requirements, such as automating more network switches, and determine how existing configurations factor into play. Is capacity planning fully optimized? Are unused network resources being identified? The team also wanted to look at the on-demand discovery of devices and the network's ability to detect unauthorized devices and track changes in real-time.

At every level, these assessments helped NDOC make the decision to switch solutions. As a result, the agency is now able to view and control all of its network locations on a centralized platform. IT staff can perform certain tasks faster, such as implementing static DHCP reservations, and have reported a reduced TCO now that non-IT staff is no longer involved. Additionally, NDOC gained the ability to conduct more comprehensive searches to find an IP address. After immersive training to better prepare them to handle any issues, the IT team learned to create and manipulate advanced configurations.

As state-run facilities operate with set and often compromised budgets, it’s critical that agencies look for the most effective solutions that will allow them to grow, but not empty their pockets. Making a solid assessment in advance will help agencies prioritize needs and determine if they can be met. The end result can save an agency money and time, both of which are often scarce.