Office of the
Chief Information Officer

Home

Index to Current and Past Years

Contact Us

Ilee Rhimes

Securing Ohio State's Computing and Technology Resources

Autumn quarter is a good time to update the university community on the collaborative steps that central and local technology staff are taking to secure Ohio State's computing and technology resources.

The campus computing environment includes more than 30,000 computers, of which approximately 10,000 are owned and maintained by individuals (primarily students) in the residence halls. The remaining 20,000 computers are managed by more than 150 different campus groups, ranging from colleges with hundreds of computers to research areas with half a dozen.

Integral to the computing environment is the campus network, which connects more than 250 campus building containing classrooms, offices, public and departmental computing labs, research labs and server facilities, at speeds of 10 or 100 megabits per second.

To protect these vast assets, Staff from central information technology areas deploy and administer the campus's cybersecurity program, which encompasses the areas of incident response, monitoring, vulnerability scanning, consulting, education and training. IT staff in local units complement central oversight by deploying and administering many distributed programs that help to secure their portions of the campus network (using firewalls and intrusion detection) and individual computers (by setting secure passwords, applying patches, and enabling anti-virus scanning).

Consequently, collaboration between local and central IT staff is critical to maintaining a secure technology environment. Jointly, these specialists are committed to:

• Proactively installing patches, implementing firewalls and using anti-virus systems.
• Responding quickly and effectively to fix computer security problems when they occur and, as the problems become known, passing on alerts about security issues to all computer administrators throughout campus.

Central IT will continue to improve network security by:

• Detecting compromised computers that are negatively affecting the network by consuming excess bandwidth, running backdoor network services, scanning other machines or initiating denial of service attacks.
• Scanning to identify computers not yet compromised but susceptible to one or more computer viruses attacks. Depending on the circumstances, these may be prohibited from accessing the network to prevent infection.
• Blocking network traffic that comes in to or goes out of the university using certain services or ports. These blocks effectively prevent the transmission of certain viruses to or from the campus network.
• Increasing the frequency at which the McAfee virus scanning tool checks for updates from once per week to once per day. The current distribution should help ensure that the users of this anti-virus software stay up to date.

Central IT recommends that colleges and departments continue to improve their network security by:

• Installing firewalls: consider putting all computers, including those carried-in, behind a firewall.
• Ensuring that all computers, including those in student computing facilities, are patched and virus free.
• Implementing policies for secure logon ID and password protection.
• Being responsive to rebuilding compromised computers.
• Addressing the "carry-in" situation to be sure that laptops and other portable computing devices are patched and virus free.
• Considering the use of a Virtual Private Network (VPN) for access to the unit's computing resources from off-campus.

Our Enterprise Networking group within the offices of the CIO will continue to monitor these activities. They will meet regularly with campus networking staff responsible for security to discuss strategies for a campus-wide firewall and to ensure that a greater percentage of computers are kept up-to-date with security software and patches. We will need to continue to collaborate as a community to respond to these critical issues.