Security measures safeguard Penn State's computer networks

University Park, Pa. -- Maintaining a culture of openness when more than 80,000 inquiring minds have access to your computer network poses a unique security dilemma for universities like Penn State. But by implementing security measures, the University is taking steps to protect itself against rapidly evolving global threats.

An overview of Penn State's computer and network security was presented to the Board of Trustees today (Sept. 9) by Gary Augustson, vice provost for information technology, and Kathy Kimball, senior director of security operations and services within Penn State's Information Technology Services (ITS).

Securing computing and network systems in higher education poses distinct challenges, Augustson explained. Whereas most businesses have the ability to lock down their networks and restrict access to external users, a multi-campus university like Penn State -- with more than 100,000 devices connected to the network -- does not have that luxury.

"Our world is, by definition, one of openness," said Augustson. "And we restrict access to information as the exception rather than the rule."

Both hardware and software are inherently flawed because they are created by human beings -- "and human beings make mistakes," said Kimball. Flaws in critical components can leave computers open to hostile intent. Compounding this problem is the fact that the connectivity of computer networks and the Internet has broadened the reach of even the most geographically distant perpetrators, while also broadening their potential victim base.

"With networked computers, an insecurity that is exploited in one can affect everyone that has the same security problem globally," said Kimball.

And the sophistication and speed of the global threat increases day after day.

To cope with this hostile environment, Penn State has launched a three-pronged security strategy: provide education and awareness, be vigilant about incident response and implement technical controls.

Since network defenses are not foolproof and much of the burden of security falls to the average user, Penn State has implemented a comprehensive education and awareness program for both system administrators and the general user population. The program comprises free or low-cost seminars and presentations, a library of Web-based training materials and the "Take Control" campaign, which encourages the use of personal security measures such as firewalls and antivirus software.

The University's second security strategy is to implement and maintain a robust computer incident-response capability that is able to cope effectively with the evolving threat. Approximately 9,000 incidences per year -- from minor abuse complaints such as chain letters to extremely large-scale break-ins involving multiple systems -- are reported to the University's ITS staff. Using tools consistent with those used by the best law enforcement agencies, Kimball's team has full computer forensics capabilities that allow them to preserve and analyze computer evidence in a manner acceptable for law-enforcement purposes.

Rounding out Penn State's strategy, technical security measures are being adopted to deal with rapidly escalating network threats. Three of the technical means employed by the University are automated virus handling, scanning for system flaws and intrusion detection and prevention.

While these measures have been useful tools that allow system administrators to safeguard the University, Kimball's future goals are to further automate both the detection and prevention phases, to optimize the University's ability to block an unknown attack before it has a chance to damage the network, and to implement better network access controls to detect problem machines before they are joined to the network.

For more information about Penn State's computer and network security measures, visit the ITS Web site at http://its.psu.edu/