Batten down the hatches

At the Merchant Marine Academy, better access control protects a wide-ranging network of seafaring mobile users

Network Access Control

CHALLENGE: The U.S. Merchant Marine Academy needed to ensure that notebook computers used by its mobile faculty and students did not pose a threat to its network. As a federal service academy, network security requirements are high, but as an institution of higher education, access should be as open as possible. The academy needed a tool to scan devices operating on the academy network and to enforce policies on patching, security settings and computer hygiene.

SOLUTION: Most tools only scanned devices for security compliance upon initial network log-in, but Lockdown Networks' Enforcer appliance performs periodic device scans as long as they remain on the network, either with or without client agents.
It works through most managed switches and scans for the presence and status of more than 40 security tools.

MISSION BENEFIT: Not only are potential problems spotted and stopped when notebooks return to campus after extended sea voyages, but configuration management on the network's servers is also less time-consuming. The academy's small IT staff is not so overwhelmed on Microsoft's patch

LESSONS LEARNED: 'I think everybody understands the importance of network access control,' said CIO Howard Weiner. The difficulty was finding a tool that would work for a network with a large number of servers, a mobile user base and a small IT staff. 'We had to look at solutions that are attuned to the resources we have.'
In the search, he found:
n Only recently has the NAC industry become democratized and has begun offering solutions for smaller organizations.

A smaller company such as Lockdown Networks might be more flexible and responsive to a customer in fitting a tool to an environment.

The biggest problem remaining at the academy is how to control access of unmanaged guest PCs not running the Enforcer agent. Because scanning capability is limited, access currently is granted only to the Internet and not the core network.

U.S. Merchant Marine Academy midshipmen spend about a year at sea during their course of study, and, as anyone who has read Melville or seen 'Master and Commander' knows, the sea can be dangerous.

But the ocean isn't the only threat to sailors who go to sea with PCs.

'In the last couple of years, the Internet has become an increasingly hostile place,' said Howard Weiner, the academy's CIO.

Notebook computers have been standard issue for students for a decade and are essential tools for schoolwork, both on land and sea. When students are away from the Kings Point, N.Y., campus and its managed network, they also use the computers for Web-based e-mail and general browsing.

'When these kids return to campus, their computers are a mess,' Weiner said. 'It's not just that the software stack is out of date, but their entire ecosystem has been compromised. They tell us they've been having problems, and when we take a look, more often than not we find they have some kind of spyware.'

Getting dirty

Faculty members, in demand by industry and the Defense Department as consultants, are another problem.

'They are extremely mobile,' Weiner said. 'They leave the network and the care we provide, and when they come back to us, they're dirtier than when they left.'

So how does an organization ensure that pesky end users don't undo the work of the IT department by bringing unclean, unkempt computers into the network?

Weiner was looking for a product that would scan end devices periodically and found what he needed in the Enforcer network access control appliance from Lockdown Networks Inc. of Seattle. It can run scans with or without a client agent at any time, not just on log-in, and a separate console allows central policy management of network access for almost any network device. 'Threats can come from anywhere, not just the PC,' said Dan Clark, VP of marketing for Lockdown Networks.

The Merchant Marine Academy, overseen by an agency of the Transportation Department, is one of five U.S. service academies. Its 1,000 students earn a bachelor of science degree, a commission in a military reserve organization and a Coast Guard merchant marine officer's license.

'You're talking about a ticket to go on any vessel,' Weiner said.

The midshipmen have an extended, 11-month academic year and are at sea much of their sophomore and senior years.

When he joined the academy as CIO in mid-2004, 'one of the top items on my agenda was security,' Weiner said.

It was not just mobile students and faculty that created security problems. Network servers were also a challenge.

'We have been concerned that when we put a server online, we know that its configuration is good,' Weiner said. 'If you don't, you're just courting disaster.'

But the small IT staff was having trouble keeping up with vulnerability patching and software upgrades. In early 2005, Weiner talked to Cisco Systems Inc. about its Network Admission Control products.

'It had a major shortcoming,' he said. 'It could only do admission controls on initial authentication to the network.' This could not ensure that devices remaining on the network for long periods, including servers, were in compliance with security policies. It also required other Cisco components.

Weiner was looking for something that would do periodic scans rather than log-in scans only. Until he found Lockdown Networks, 'we could not find anybody who had such a product.'

'Acceptable risk'

Getting hardware for trials can be difficult for federal organizations, but the academy staff assessed the Enforcer and decided to spring for it.

'We saw it was an acceptable risk to buy one and see how it would work,' Weiner said.

The Enforcer is intended for network devices rather than remote connections. It plugs into a managed switch and makes access policy decisions based on the user and the configuration of the device. The systems can evaluate up to 7,000 criteria to determine if a device gets access'and to what. Devices that need to be patched or updated, or need a thorough cleaning, can be quarantined or directed to a site where the proper updates are available.

Enforcer supports most major Layer 2 switch vendors and tests for the presence and status of security tools from more than 40 vendors. It can scan without an agent to have the least impact on the client device, or can be used with a light client application when network scanning is not practical or desirable.

One appliance can support up to 2,000 users, depending on the access policies being applied, Clark said. The number of concurrent sessions is not an issue because the device is not an inline filter, but only scans devices periodically and passes judgment on their condition.

The cost is $24,995 for a 1U appliance and $39,995 for a 2U appliance that provides redundancy. The academy purchased a single device and is running client agents on the computers it manages.

'It has done what we wanted it to do,' Weiner said. 'We have been able to ID returning midshipmen when they are in trouble and get them mitigated quickly.'

The biggest help has been in managing server configuration. The servers also have Enforcer agents running on them. Patches are pushed out using Microsoft Systems Management Server but, without periodic scanning, 'keeping up with Microsoft patch Tuesday had been a big challenge,' Weiner said.

The academy still faces challenges with populations outside its student body and faculty.

'As an institution of higher education, we must be simultaneously closed and open,' Weiner said. He must protect the core network while serving 'people who we didn't know existed yesterday, and who might be gone tomorrow.' Visitors and short-term students now get Internet access without access to the academy's core network.

About the Author

William Jackson is a Maryland-based freelance writer.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.