These days, security has become a loaded word. Security has increased just about everywhere—on subways and buses, in airports, and at courthouses. Security is critical on information networks, too. As many school IT specialists have learned the hard way, hackers, viruses, spam, and spyware lurk behind every corner. To combat these multiple threats, many districts are investing in integrated security appliances, devices that combine a variety of applications into one piece of hardware. Find out whether these all-in-one tools might be the right approach to increasing security in your district.
1. Why do districts need to worry about security?
Recent private-sector surveys reveal that 82 percent of corporations were hit by viruses, worms, or other attackers this past year, and one-third of those said that their networks were breached by unauthorized users. School networks are even more vulnerable because they are, by their very nature, open environments. Hackers, therefore, pose an especially critical threat to school networks. To make matters worse, the time it takes between the discovery of network vulnerabilities by a cyber miscreant and the appearance of code to exploit them has dropped from months to weeks to mere days.
2. How do integrated security appliances protect networks?
Integrated security appliances work on the premise that two heads are better than one, incorporating three or four (and sometimes more) "heads" of technology into one device. Most integrated appliances include technology for firewalls, which harden the perimeter of a network by blocking traffic that fails to meet certain requirements; virtual private networks (VPNs), private networks that use encryption to transmit data within public networks; and some form of intrusion prevention technology, which prevents network attacks by intercepting and forwarding packets of data in real time. Many devices also incorporate software designed to prevent specific network threats—programs more commonly known as antivirus, antispam, and antispyware. In September 2004, market research firm IDC dubbed these threat-specific tools unified threat management appliances and noted that they comprise the fastest-growing segment of the integrated security market.
Integrated appliances are worthwhile from a funding standpoint, too. Because eligibility for technology funding through federal programs like No Child Left Behind and E-Rate hinges on compliance with the Children's Internet Privacy Act, investing in appliances that block certain kinds of content makes financial sense. Districts can employ these appliances to make sure that objectionable material never makes it through the network's door.
3. Where do integrated appliances sit on the network?
Network managers can install integrated security appliances just about anywhere on a network, but the most effective place to put them is at the perimeter of a local area network (LAN). In this position, the integrated appliance forms a first line of defense against security threats and enables users to log on to the LAN without fear of attack. Once the appliance is up and running, it can dissect and validate incoming and outgoing data packets before allowing them to pass. Better still, in districts that have a separate LAN for each school, appliances securely seal off each network from the others, providing every school with in-depth defense while simultaneously containing attacks and malicious code.
Juniper NetScreen 50 supports 64,000 concurrent user sessions.
4. Are they easy to install?
On the surface, integrated appliances are like clock radios—plug them in, set basic parameters, and you're good to go. In reality, however, maximizing the technology's efficiency requires a little more effort. For starters, network administrators must configure each of the appliances, keeping in mind that in some cases double protections aren't bad. If, for instance, a LAN employs Cisco routers that come with their own security, some administrators may scale back the number of security protocols they apply at the appliance level. In another scenario, if a LAN or portions of a LAN are already protected by a firewall, administrators must decide whether to turn off the firewall functions on the perimeter appliance or let them run as a form of checks and balances. The bottom line: If you're going to do any sort of fine-tuning with your integrated appliance, make sure you pick an appliance that comes with a software-based, easy-to-use configuration tool.
5. What about maintenance?
After you conquer configuration and initial setup, integrated security appliances require constant maintenance. Appliances, particularly those with firewall and intrusion prevention technologies, must receive a steady stream of data from vendors and researchers about the latest threats so they can protect against them. In many cases, this data is nothing more than a series of lists instructing the appliance what kinds of traffic to block from a LAN. In some cases, however, the data includes specific information about security threats. Most vendors charge an additional monthly maintenance fee of between $50 and $500 for these updates, which are sent from company headquarters and applied by network administrators on their own time. Districts with larger budgets might consider hiring a managed security solution provider, an outsourced service that includes installation, regular updates, and troubleshooting.
6. What if there's a virus outbreak? Will my district be protected?
Many vendors—particularly those who sell UTM appliances—charge monthly maintenance fees to keep antivirus and antispyware signatures up to date. Generally, these update files are available once or twice a week. Network administrators can install them by hand or program the appliances to retrieve and install the files automatically. Still, even a top-of-the-line integrated appliance with all of the latest signatures isn't a license for end users to be complacent. Particularly in a district where the majority of users access the network remotely, it's important to make sure that users update the antivirus software on their desktops or laptops regularly, and that all computers are running the latest and greatest versions of their operating systems for maximum protection.
7. Are there downsides to having multiple security protections in one box?
The upside to integrated appliances is indisputable—compared to point solutions that target singular security problems, integrated boxes are cheaper and easier to use. Still, security appliances have their disadvantages. For one, the firewall and VPN technology incorporated into some of these devices isn't nearly as sophisticated as the protections customers can buy separately. What's more, with UTM devices in particular, antispam and antivirus updates sometimes lack the thoroughness that point solutions do. If your district has had problems in the past with spam, viruses, or worms, it may make sense to purchase an integrated appliance and reinforce it with point solutions. After all, you can never be too careful.
8. There are so many security devices out there. How do I tell them apart?
Not all integrated appliances are created equal. If you're spending the money on an integrated appliance, you should choose a device that includes nothing less than the triple threat protection of firewall, VPN, and intrusion prevention. Vendors that specialize in boxes meeting these requirements include Cisco, Juniper Networks, SonicWall, and WatchGuard. For additional protections like antivirus, antispam, and antispyware, UTM appliances are the best investments. The IDC study that created this category praised appliances from vendors such as Fortinet, Symantec, and ServGate, to name a few. For more answers to your security questions, check out Cyber Security for the Digital District (www.securedistrict.org).
Matt Villano is a California-based freelance writer who specializes in educational technology.
Pick His Brain
One educator advocates an all-in-one approach to security.
Todd Hickling, manager of information resources for Fauquier County Public Schools in Warrenton, Va., relies on integrated appliances to protect his network.
"We have more than 4,000 computers in our district, and going around to each one and loading it with the latest security software can be a daunting task," he says. "Our best bet was a gateway at the top of the network to do the bulk of the work for us. If you can buy an all-in-one box to secure your network, if that box does a great job for a decent price, I'm all for the simplicity of it. In our school system, we squeeze every dime out of every computer, router, switch, vehicle, or whatever. I like multitasking whenever possible. Naturally, then, an integrated appliance was the way to go."
Buyer's Checklist
Face the music: Security is something in which you must invest.
- Before you purchase any security technologies, understand your system's vulnerabilities (see "How To Perform a Security Audit").
- Remember that point security solutions are expensive; integrated security appliances generally cost less and do more.
- Place integrated appliances at the LAN perimeter for optimal protection.
- Be aware that installing integrated appliances is harder than it seems; buying a device that's easy to install could save you thousands of dollars in consulting fees.
- Be sure to factor in extra costs for maintenance and monthly upgrades of security signatures
- Look for an appliance that offers-at a minimum-firewall, virtual private network, and intrusion prevention capabilities.
