More than 20 years ago, the world’s first large-scale virus attack originated at the Cornell University, and ended up crippling an estimated 6000 computers in universities and military organisations around the world. The irony? The virus—Morris—was not written with a malicious intent. It was meant to gauge the size of the Internet.
A little over four years ago, the Management Development Institute (MDI), Gurgaon, faced online excommunication when the xxxxx@xxxxx.com virus, made the institute’s mail server its victim. Thousands of infected mails originating from the institute found their way out and landed in the nets of spam filters of servers across the world. This led to them to block all mail coming from MDI It took a long while and significant effort to restore the infected system and revive the institute’s mail service.
These two incidents make the following points—one, that academic institutions are connected and IT-dependent entities, and two, that there are inherent IT vulnerabilities that they have to deal with. The first incident illustrates that students, the main customers of educational institutions, will test the limits of every resource they can access, legally or illegally. And the second, that the awareness of need for a comprehensive IT security plan in an educational institute is fairly low. It is, in fact, often a reactive process.
Higher education institutions are hotbeds of higher thinking and innovation. They are the breeding grounds of tomorrow’s professionals and academicians. Whatever happens within the four walls of these institutions has a direct implication on the world outside. Therefore, the data inside is precious. It needs to be protected, without affecting the pace of innovation.
Identify the User
Before you can protect the institute infrastructure, you need to understand IT users in the institution and identify their specific needs. After that, you can deploy appropriate IT security infrastructure. In their case study titled “Dealing With Network Security in Academic Institutions,” Ivan Dolezal , Jiri Grygarek, Ondrej Jakl and Karel Krecmer of VSB–Technical University and Institute of Geonics of the Czech Academy of Sciences, Ostrava, Czech Republic, have identified three types of IT users in an educational institution—standard users, research workers and students.
The standard users are the people running the institute—the management and administrative staff. They use standard productivity software, like an office suite, e-mail and the Internet. These users have standard IT security requirements that can be automated.
The research workers—and we are not talking just scientific researchers here—are a diversified group. They have varied needs, and could be using some of the most resource-heavy applications, involving crunching extensive data, remote access, heavy rendering, and more. The intellectual capital generated and managed by this category of users is critical and sensitive and needs to be managed in a way that does not hamper their work.
The students are, the most difficult set of users. Says Sriram Bharatam, IT consultant, “You give students today laptops and a wireless network with unlimited bandwidth, the first thing they are going to do is download lots of movies, music and games.” And we have already seen how they can unleash chaos with their experiments. The fact that they are the most numerous users makes the task of managing security much more complicated.
Know Your Weakness
Once you know the user and you know what to protect, you need to understand
how it can be compromised. Partha Sarathy Mohanty, vice president —Technical, MGRM Net Ltd. says, “Databases comprising of student, teacher, management and alumni information is a cache of confidential information that requires authorised, role based access as well as constant monitoring
through audit trails, logs and alerts. The need is to have robust solutions that ensure data security and integrity at every transaction level.” For that, you need to know where your weaknesses lie.
WEBSITE: From virus to denial of service (DoS) attacks, a lot can happen if there is lack of security. Choose the best hosting services.
E-MAIL: Extensively used in campuses, e-mail can be prone to virus attacks and phishing, where someone else steals your online identity and/or data, and uses it for malicious intent. Put in proper safeguards to scan mails for dangerous payloads and attachments. Monitor mails for scams, junk messages and chain mails that can overwhelm systems or compromise security.
DATA: This is the veritable Achilles heel. Backups, file-sharing, and general lack of protection wreck havoc. Again, don’t use ad hoc measures.
NETWORK: Who is using it, for what, for how long—these are critical questions. If you don’t have answers to them, there could be potential trouble.
Careful Planning
Once the threats have been identified, the solutions become manageable. After the 2005 attack on MDI’s mail servers, the institute took immediate corrective measures. Professor Sangeeta Bhardwaj, chairperson, Computer Centre, MDI, explains, “We now have a comprehensive IT security policy and processes in place. Since that incident, there hasn’t been a single IT security breach”
Institutes in India are realising the value of planning for security. Dr K. Mohan, senior director, Information Technology and Learning Resource Centre at the Indian School of Business says, “IT security in higher education is a very sensitive matter. Policies and systems must be designed and considered focusing on changing needs of academic and research community, yet not compromising
the network security.”
Professor Basav Roychoudhury, Rajiv Gandhi Indian Institute of Management,
Shillong, observes, “Security is never a closed chapter as far as computer systems is concerned. One advantage of adopting a well established packaged solution like an ERP is that, since it is widely used it is more reliable. Deploying an integrated ERP solution vis-à-vis getting separate applications to serve distinct areas and then trying to integrate them into a single whole—eliminates exposing several unseen security loopholes. While we have made the system totally accessible based on user roles within our own network, we are still conservative about making the same accessible through the Internet. We have set up secure VPNs for certain number of users who would be able to access the system from outside of our network.”
NIIT, which pioneered IT training, has taken a strong, yet balanced approach to security. Pankaj Dikshit, general manager, NIIT Ltd. says, “NIIT has a host of student service applications and portals connected to a centralised operations management system hosted at a centralised data centre. A pan-India wide area network (WAN) connects all education centres and offices over an MPLS based VPN network. This secure network is the backbone on which the education operations management platform and all web applications reside.” And the measures don’t stop at that. At every level of access there are conditions that ensure a strong security base, and yet allow smooth access.
Take the Right Measures
It always pays to be ahead of the curve as far as IT security is concerned. A well-thought, democratically evolved and security-savvy IT policy is a must. It should lay down access rules, not just for students and staff, but also the occasional visitor that may use the infrastructure.
Get in the experts. The DIY approach to technology is ad hoc at best and completely inadequate at worst. Also keep internal management to a minimum, use managed infrastructure and cloud computing. Leave only the basic aspects of technology to be managed in-house.
Test often. Even if there is a security infrastructure in place, it needs to be continuously checked for efficacy. In fact, employ the the in-house hackers to test the security setup from time to time.
The best laid plans can succumb to the increasingly virulent attacks. Awareness has to be increased and a disaster management policy needs to be put in place.
Collaborative learning, shared research, and seamless access to information resources are the realities that academic institutions are going to live with. Technology has to be the enabler for that, not a deterrent.
Write in your views and opinions about the story on any other issues relating to higher
education. Send them to the Editor, EDU at xxxxx@xxxxx.com-leaders.com
To read more about IT security:
Case study :www.mirlabs org,IT security & Academic Values:www. net.educase.edu, University Business magazine: www.universitybusiness.com
50
EDU TECH
November 2009
TECHNOLOGY Security
EYE STOPPER MORRIS
Robert Morris, 23- year-old graduate student at Cornell, unleashed the first internet worm. He was suspended, fined and jailed. However, he went on to get a PhD from Harvard and is currently a professor at MIT. CIH
Chernobyl virus also known as CIH or Spacefiller took off on the 13th anniversary of the Chernobyl nuclear disaster in April 1999. It was conceived by a University graduate from Taiwan called Chen Ing Hau (CIH). One of the most harmful viruses, it overwrites critical information on infected system drives.
Higher education institutes in India have to realise that IT security is no longer optional. It is essential
ore than 20 years ago, the world’s first large-scale virus attack originated at the Cornell
University, and ended up crippling an estimated 6000 computers in universities and military organisations around the world. The irony? The virus—Morris—was not written with a malicious intent. It was meant to gauge the size of the Internet.
A little over four years ago, the Management Development Institute (MDI), Gurgaon, faced online excommunication when the xxxxx@xxxxx.com virus, made the institute’s mail server its victim. Thousands of infected mails originating
from the institute found their way out and landed in the nets of spam filters of servers across the world. This led to them to block all mail coming from MDI It took a long while and significant effort to restore the infected system and revive the institute’s mail service.
BY NUPUR CHATURVEDI
Feature_4_Technology.indd 50 10/29/2009 8:14:04 PM
51
EDU TECH
November 2009
These two incidents make the following points—one, that academic institutions
are connected and IT-dependent entities, and two, that there are inherent
IT vulnerabilities that they have to deal with. The first incident illustrates that students, the main customers of educational institutions, will test the limits of every resource they can access, legally or illegally. And the second, that the awareness of need for a comprehensive IT security plan in an educational
institute is fairly low. It is, in fact, often a reactive process.
Higher education institutions are hotbeds of higher thinking and innovation.
They are the breeding grounds of tomorrow’s professionals and academicians.
Whatever happens within the four walls of these institutions has a direct implication on the world outside. Therefore, the data inside is precious. It needs to be protected, without affecting the pace of innovation.
Identify the User
Before you can protect the institute infrastructure, you need to understand IT users in the institution and identify their specific needs. After that, you can deploy appropriate IT security infrastructure. In their case study titled “Dealing
With Network Security in Academic Institutions,” Ivan Dolezal , Jiri Grygarek, Ondrej Jakl and Karel Krecmer of VSB–Technical University and Institute of Geonics of the Czech Academy of Sciences, Ostrava, Czech Republic, have identified three types of IT users in an educational institution—
standard users, research workers and students.
The standard users are the people running the institute—the management and administrative staff. They use standard productivity software, like an office suite, e-mail and the Internet. These users have standard IT security requirements that can be automated.
The research workers—and we are not talking just scientific researchers here—are a diversified group. They have varied needs, and could be using some of the most resource-heavy applications, involving crunching extensive data, remote access, heavy rendering, and more. The intellectual capital generated
and managed by this category of users is critical and sensitive and needs to be managed in a way that does not hamper their work.
The students are, the most difficult set of users. Says Sriram Bharatam, IT consultant, “You give students today laptops and a wireless network with unlimited bandwidth, the first thing they are going to do is download lots of movies, music and games.” And we have already seen how they can unleash chaos with their experiments. The fact that they are the most numerous users makes the task of managing security much more complicated.
Know Your Weakness
Once you know the user and you know what to protect, you need to understand
how it can be compromised. Partha Sarathy Mohanty, vice president —Technical, MGRM Net Ltd. says, “Databases comprising of student, teacher,
management and alumni information is a cache of confidential information
that requires authorised, role based access as well as constant monitoring
through audit trails, logs and alerts. The need is to have robust solutions that ensure data security and integrity at every transaction level.” For that, you need to know where your weaknesses lie.
WEBSITE: From virus to denial of service (DoS) attacks, a lot can happen if there is lack of security. Choose the best hosting services.
E-MAIL: Extensively used in campuses, e-mail can be prone to virus attacks and phishing, where someone else steals your online identity and/or data, and uses it for malicious intent. Put in proper safeguards to scan mails for dangerous payloads and attachments. Monitor mails for scams, junk messages
and chain mails that can overwhelm systems or compromise security.
Security TECHNOLOGY
WHAT’S NEW
InfoScan TS Elite
SCAN IMPORTANT sentences, phrases, store them for later reference, and even consult the in-built dictionary. The Elite is a handy tool to use in the library or to scan notes. It can scan up to 500 pages of text, and even read it aloud. You can store and transfer the scans onto any PC or PDA using USB or infra-red. The pen can handle five languages – English, French, German, Spanish and Portuguese.
LiveScribe Pulse Smartpen
FORGET MULTI-TASKING with your iPod to record lectures, while scribbling your notes with a pen. Use a LiveScribe Pulse Smartpen.
It’s a pen that records lectures while you make notes with it on a special paper. The special bit is that it comes with a tiny infrared camera that records your strokes. Later, when you touch the pen to your notes, it can read that and match it to what was said at that point. The 1GB model can hold more than 100 hours
of lectures.
Projected Time
WHEN THERE is a presentation on, keeping an eye on the clock is, well, impossible. The Netherlands-based firm Nextime has the solution—a projection wall clock. A glance during the presentation is all you need to know when to start wrapping it up. In India, it is retailed by interior
store Urban Décor, in Bangalore and is also
available online.
$ 119.95
Rs. 13,400
$ 150
Feature_4_Technology.indd 51 10/29/2009 8:14:08 PM
52
EDU TECH
November 2009
TECHNOLOGY Security
DATA: This is the veritable Achilles heel. Backups, file-sharing, and general lack of protection wreck havoc. Again, don’t use ad hoc measures.
NETWORK: Who is using it, for what, for how long—these are critical questions. If you don’t have answers to them, there could be potential trouble.
Careful Planning
Once the threats have been identified, the solutions become manageable. After the 2005 attack on MDI’s mail servers, the institute took immediate corrective measures. Professor Sangeeta Bhardwaj, chairperson, Computer Centre, MDI, explains, “We now have a comprehensive
IT security policy and processes in place. Since that incident, there hasn’t been a single IT security breach”
Institutes in India are realising the value of planning for security. Dr K. Mohan, senior director, Information Technology and Learning Resource Centre
at the Indian School of Business says, “IT security in higher education is a very sensitive matter. Policies and systems must be designed and considered focusing
on changing needs of academic and research community, yet not compromising
the network security.”
Professor Basav Roychoudhury, Rajiv Gandhi Indian Institute of Management,
Shillong, observes, “Security is never a closed chapter as far as computer systems is concerned. One advantage of adopting a well established packaged solution like an ERP is that, since it is widely used it is more reliable. Deploying
an integrated ERP solution vis-à-vis getting separate applications to serve distinct
areas and then trying to integrate them into a single whole—eliminates exposing several unseen security loopholes.
While we have made the system totally accessible based on user roles within our own network, we are still conservative
about making the same accessible
through the Internet. We have set up secure VPNs for certain number of users who would be able to access the system from outside of our network.”
NIIT, which pioneered IT training, has taken a strong, yet balanced approach to security. Pankaj Dikshit, general manInstitutes
in India Need to
Learn to Balance Their IT Security How aware are Indian institutions about IT security? There are extremes that I have seen. An institute might have state-of-the-art technology infrastructure. But if you visit their campus—as a participant of a short term program, as a person visiting someone in the management or staff, or even as a partner or vendor—you won’t be able to access the Internet because their security policy is extremely stringent. At the other extreme are institutes with no security to speak of. When you go to an international institute, security policies have usually been thought through and drafted clearly. For instance, if I go in, I get a guest ID with a limited level of access. Is it tougher to manage security in a wireless environment? With wireless, the rules of the game have changed. Today’s reality includes terrorists who enter unsecured wireless networks, and unfortunately, the responsibility of that rests with the institute. So awareness levels have to increase. What areas an institute must keep in view when looking at IT security? Most institutes have some form of a web server on which runs their website. This could have applications like an admissions module, a recruitment module, an alumni module, an intranet, or a knowledge management module, and so on. Larger institutes also have a learning
resource centre, a sort of digital library. All these applications need to provide controlled access. The library, for instance, will have a subscription model and only certain subscribers should be able to access it.
If there is no security, a lot of data pilferage and unauthorised bandwidth usage can happen, and the institute could end up with a fat bill. People could actually compromise the network sitting inside the campus. This needs to be checked by setting up conditions for access—within the campus and from outside the campus. People from outside the campus can also take advantage of vulnerabilities and penetrate the network.
Strangely, people in India still don’t value data. They don’t realise that the data centre that is offering them a steal of a deal could actually be offering them substandard and unsecure service.
So while there is use of technology, most people don’t know how to tame it, and the knowledge levels to use it are not there. Given that this is academic institutions we are talking about, where academicians are usually two or three generations ahead in theory but way behind in the practice, a lot of discussions
happen, but not enough decisions. So what is the way forward? The browser is the new application interface. In my opinion, all you should bother about is the Internet access. Beyond that, all the data and applications should be managed by someone else. You should only be building on top of that. If you can, use a third party. People are only now starting to see the merits
in that.
SRIRAM BHARATAM
CEO and Founder Iridum Interactive Ltd
Feature_4_Technology.indd 52 10/29/2009 8:14:08 PM
ager, NIIT Ltd. says, “NIIT has a host of student service applications and portals connected to a centralised operations management system hosted at a centralised
data centre. A pan-India wide area network (WAN) connects all education
centres and offices over an MPLS based VPN network. This secure network
is the backbone on which the education
operations management platform and all web applications reside.” And the measures don’t stop at that. At every level of access there are conditions that ensure a strong security base, and yet allow smooth access.
Take the Right Measures
It always pays to be ahead of the curve as far as IT security is concerned. A well-thought, democratically evolved and security-savvy IT policy is a must. It should lay down access rules, not just for students and staff, but also the occasional
visitor that may use the infrastructure.
Get in the experts. The DIY approach to technology is ad hoc at best and completely
inadequate at worst. Also keep internal management to a minimum, use managed infrastructure and cloud computing. Leave only the basic aspects of technology to be managed in-house.
Test often. Even if there is a security infrastructure in place, it needs to be continuously checked for efficacy. In fact, employ the the in-house hackers to test the security setup from time to time.
The best laid plans can succumb to the increasingly virulent attacks. Awareness has to be increased and a disaster management
policy needs to be put in place.
Collaborative learning, shared research, and seamless access to information
resources are the realities that academic institutions are going to live with. Technology has to be the enabler for that, not a deterrent.
Write in your views and opinions about the stories in this magazine or on any other issues relating to higher
education. Send them to the Editor, EDU at
xxxxx@xxxxx.com-leaders.com
To read more about IT security:
Case study :www.mirlabs org,IT security & Academic Values:www. net.educase.edu, University Business magazine: www.universitybusiness.com What’s Online
VIRUSES,WORMS,PORNOGRAPHY,CHAT,TERRORMAILSAreyourstudentssafefromthese?InternetthreatsAsaneducationalinstitution,youhavearesponsibilitytoprotectyourstudentsfromunsafesurfingthatcanleadtoviruses,worms,spywareandmore.YouneedtopreventunhealthyInternetactivitieslikepornography,adultchatandillegalP2Psurfing.Cyberoam-theonlyIdentity-basedUTMFirewall-freesyoufromexternalandinternalsecuritythreats.ProtectyourstudentsandyourinstitutionNow.DeployCyberoam.CyberoamAdvantage-IndividualInternetaccessrightsanywhereinthenetwork-Controlsnon-academic,nonproductivesurfing-PinpointsuserinMultipleUser-SingleMachinescenario-SavesbandwidthabusebyblockingP2P,Chatandmore-Detaileduser-wiseon-appliancereporting-EaseofManagementPartialClienteleSVNITOsmaniaUnivNMIMSAIIMSSymbiosisBITRanchiSIMSTestimonials:“IwasimpressedattheeaseofconfigurationofCyberoam.Apersonwithlittleornoproductknowledgecanconfigureitquiteeasily.Italsoprovedtobeanexcellentcontentfilteringsolutionreducingtheloadonbandwidthconsiderably”“TheCyberoamsecurityappliancehassolvedallourmajorworriesregardingthemisuseofInternetfacilitiesbystudents.Ithelpsusmanagebandwidthatuserlevel,blockharmfulsites,chatting,gamesandgivesuscompletevisibilityonstudentonlineactivitiesandtheirwebsurfingpatterns.”NITRourkelaLDEngineeringCollege-AhmedabadProf.BVBuddhadev,HOD-ComputerDept.Dr.SaratKumarPatra,NITRourkelaWeb&ApplicationFilteringBandwidthManagementMultipleLinkManagementIntegratedReportingStatefulInspectionFirewall/VPNGatewayAnti-Virus&xxxxx@xxxxx.com:xxxxx@xxxxx.com
Feature_4_Technology.indd 53 10/29/2009 8:14:12 PM50
EDU TECH
November 2009
TECHNOLOGY Security
EYE STOPPER MORRIS
Robert Morris, 23- year-old graduate student at Cornell, unleashed the first internet worm. He was suspended, fined and jailed. However, he went on to get a PhD from Harvard and is currently a professor at MIT. CIH
Chernobyl virus also known as CIH or Spacefiller took off on the 13th anniversary of the Chernobyl nuclear disaster in April 1999. It was conceived by a University graduate from Taiwan called Chen Ing Hau (CIH). One of the most harmful viruses, it overwrites critical information on infected system drives.
Higher education institutes in India have to realise that IT security is no longer optional. It is essential
ore than 20 years ago, the world’s first large-scale virus attack originated at the Cornell
University, and ended up crippling an estimated 6000 computers in universities and military organisations around the world. The irony? The virus—Morris—was not written with a malicious intent. It was meant to gauge the size of the Internet.
A little over four years ago, the Management Development Institute (MDI), Gurgaon, faced online excommunication when the xxxxx@xxxxx.com virus, made the institute’s mail server its victim. Thousands of infected mails originating
from the institute found their way out and landed in the nets of spam filters of servers across the world. This led to them to block all mail coming from MDI It took a long while and significant effort to restore the infected system and revive the institute’s mail service.
BY NUPUR CHATURVEDI
Feature_4_Technology.indd 50 10/29/2009 8:14:04 PM
51
EDU TECH
November 2009
These two incidents make the following points—one, that academic institutions
are connected and IT-dependent entities, and two, that there are inherent
IT vulnerabilities that they have to deal with. The first incident illustrates that students, the main customers of educational institutions, will test the limits of every resource they can access, legally or illegally. And the second, that the awareness of need for a comprehensive IT security plan in an educational
institute is fairly low. It is, in fact, often a reactive process.
Higher education institutions are hotbeds of higher thinking and innovation.
They are the breeding grounds of tomorrow’s professionals and academicians.
Whatever happens within the four walls of these institutions has a direct implication on the world outside. Therefore, the data inside is precious. It needs to be protected, without affecting the pace of innovation.
Identify the User
Before you can protect the institute infrastructure, you need to understand IT users in the institution and identify their specific needs. After that, you can deploy appropriate IT security infrastructure. In their case study titled “Dealing
With Network Security in Academic Institutions,” Ivan Dolezal , Jiri Grygarek, Ondrej Jakl and Karel Krecmer of VSB–Technical University and Institute of Geonics of the Czech Academy of Sciences, Ostrava, Czech Republic, have identified three types of IT users in an educational institution—
standard users, research workers and students.
The standard users are the people running the institute—the management and administrative staff. They use standard productivity software, like an office suite, e-mail and the Internet. These users have standard IT security requirements that can be automated.
The research workers—and we are not talking just scientific researchers here—are a diversified group. They have varied needs, and could be using some of the most resource-heavy applications, involving crunching extensive data, remote access, heavy rendering, and more. The intellectual capital generated
and managed by this category of users is critical and sensitive and needs to be managed in a way that does not hamper their work.
The students are, the most difficult set of users. Says Sriram Bharatam, IT consultant, “You give students today laptops and a wireless network with unlimited bandwidth, the first thing they are going to do is download lots of movies, music and games.” And we have already seen how they can unleash chaos with their experiments. The fact that they are the most numerous users makes the task of managing security much more complicated.
Know Your Weakness
Once you know the user and you know what to protect, you need to understand
how it can be compromised. Partha Sarathy Mohanty, vice president —Technical, MGRM Net Ltd. says, “Databases comprising of student, teacher,
management and alumni information is a cache of confidential information
that requires authorised, role based access as well as constant monitoring
through audit trails, logs and alerts. The need is to have robust solutions that ensure data security and integrity at every transaction level.” For that, you need to know where your weaknesses lie.
WEBSITE: From virus to denial of service (DoS) attacks, a lot can happen if there is lack of security. Choose the best hosting services.
E-MAIL: Extensively used in campuses, e-mail can be prone to virus attacks and phishing, where someone else steals your online identity and/or data, and uses it for malicious intent. Put in proper safeguards to scan mails for dangerous payloads and attachments. Monitor mails for scams, junk messages
and chain mails that can overwhelm systems or compromise security.
Security TECHNOLOGY
WHAT’S NEW
InfoScan TS Elite
SCAN IMPORTANT sentences, phrases, store them for later reference, and even consult the in-built dictionary. The Elite is a handy tool to use in the library or to scan notes. It can scan up to 500 pages of text, and even read it aloud. You can store and transfer the scans onto any PC or PDA using USB or infra-red. The pen can handle five languages – English, French, German, Spanish and Portuguese.
LiveScribe Pulse Smartpen
FORGET MULTI-TASKING with your iPod to record lectures, while scribbling your notes with a pen. Use a LiveScribe Pulse Smartpen.
It’s a pen that records lectures while you make notes with it on a special paper. The special bit is that it comes with a tiny infrared camera that records your strokes. Later, when you touch the pen to your notes, it can read that and match it to what was said at that point. The 1GB model can hold more than 100 hours
of lectures.
Projected Time
WHEN THERE is a presentation on, keeping an eye on the clock is, well, impossible. The Netherlands-based firm Nextime has the solution—a projection wall clock. A glance during the presentation is all you need to know when to start wrapping it up. In India, it is retailed by interior
store Urban Décor, in Bangalore and is also
available online.
$ 119.95
Rs. 13,400
$ 150
Feature_4_Technology.indd 51 10/29/2009 8:14:08 PM
52
EDU TECH
November 2009
TECHNOLOGY Security
DATA: This is the veritable Achilles heel. Backups, file-sharing, and general lack of protection wreck havoc. Again, don’t use ad hoc measures.
NETWORK: Who is using it, for what, for how long—these are critical questions. If you don’t have answers to them, there could be potential trouble.
Careful Planning
Once the threats have been identified, the solutions become manageable. After the 2005 attack on MDI’s mail servers, the institute took immediate corrective measures. Professor Sangeeta Bhardwaj, chairperson, Computer Centre, MDI, explains, “We now have a comprehensive
IT security policy and processes in place. Since that incident, there hasn’t been a single IT security breach”
Institutes in India are realising the value of planning for security. Dr K. Mohan, senior director, Information Technology and Learning Resource Centre
at the Indian School of Business says, “IT security in higher education is a very sensitive matter. Policies and systems must be designed and considered focusing
on changing needs of academic and research community, yet not compromising
the network security.”
Professor Basav Roychoudhury, Rajiv Gandhi Indian Institute of Management,
Shillong, observes, “Security is never a closed chapter as far as computer systems is concerned. One advantage of adopting a well established packaged solution like an ERP is that, since it is widely used it is more reliable. Deploying
an integrated ERP solution vis-à-vis getting separate applications to serve distinct
areas and then trying to integrate them into a single whole—eliminates exposing several unseen security loopholes.
While we have made the system totally accessible based on user roles within our own network, we are still conservative
about making the same accessible
through the Internet. We have set up secure VPNs for certain number of users who would be able to access the system from outside of our network.”
NIIT, which pioneered IT training, has taken a strong, yet balanced approach to security. Pankaj Dikshit, general manInstitutes
in India Need to
Learn to Balance Their IT Security How aware are Indian institutions about IT security? There are extremes that I have seen. An institute might have state-of-the-art technology infrastructure. But if you visit their campus—as a participant of a short term program, as a person visiting someone in the management or staff, or even as a partner or vendor—you won’t be able to access the Internet because their security policy is extremely stringent. At the other extreme are institutes with no security to speak of. When you go to an international institute, security policies have usually been thought through and drafted clearly. For instance, if I go in, I get a guest ID with a limited level of access. Is it tougher to manage security in a wireless environment? With wireless, the rules of the game have changed. Today’s reality includes terrorists who enter unsecured wireless networks, and unfortunately, the responsibility of that rests with the institute. So awareness levels have to increase. What areas an institute must keep in view when looking at IT security? Most institutes have some form of a web server on which runs their website. This could have applications like an admissions module, a recruitment module, an alumni module, an intranet, or a knowledge management module, and so on. Larger institutes also have a learning
resource centre, a sort of digital library. All these applications need to provide controlled access. The library, for instance, will have a subscription model and only certain subscribers should be able to access it.
If there is no security, a lot of data pilferage and unauthorised bandwidth usage can happen, and the institute could end up with a fat bill. People could actually compromise the network sitting inside the campus. This needs to be checked by setting up conditions for access—within the campus and from outside the campus. People from outside the campus can also take advantage of vulnerabilities and penetrate the network.
Strangely, people in India still don’t value data. They don’t realise that the data centre that is offering them a steal of a deal could actually be offering them substandard and unsecure service.
So while there is use of technology, most people don’t know how to tame it, and the knowledge levels to use it are not there. Given that this is academic institutions we are talking about, where academicians are usually two or three generations ahead in theory but way behind in the practice, a lot of discussions
happen, but not enough decisions. So what is the way forward? The browser is the new application interface. In my opinion, all you should bother about is the Internet access. Beyond that, all the data and applications should be managed by someone else. You should only be building on top of that. If you can, use a third party. People are only now starting to see the merits
in that.
SRIRAM BHARATAM
CEO and Founder Iridum Interactive Ltd
Feature_4_Technology.indd 52 10/29/2009 8:14:08 PM
ager, NIIT Ltd. says, “NIIT has a host of student service applications and portals connected to a centralised operations management system hosted at a centralised
data centre. A pan-India wide area network (WAN) connects all education
centres and offices over an MPLS based VPN network. This secure network
is the backbone on which the education
operations management platform and all web applications reside.” And the measures don’t stop at that. At every level of access there are conditions that ensure a strong security base, and yet allow smooth access.
Take the Right Measures
It always pays to be ahead of the curve as far as IT security is concerned. A well-thought, democratically evolved and security-savvy IT policy is a must. It should lay down access rules, not just for students and staff, but also the occasional
visitor that may use the infrastructure.
Get in the experts. The DIY approach to technology is ad hoc at best and completely
inadequate at worst. Also keep internal management to a minimum, use managed infrastructure and cloud computing. Leave only the basic aspects of technology to be managed in-house.
Test often. Even if there is a security infrastructure in place, it needs to be continuously checked for efficacy. In fact, employ the the in-house hackers to test the security setup from time to time.
The best laid plans can succumb to the increasingly virulent attacks. Awareness has to be increased and a disaster management
policy needs to be put in place.
Collaborative learning, shared research, and seamless access to information
resources are the realities that academic institutions are going to live with. Technology has to be the enabler for that, not a deterrent.
Write in your views and opinions about the stories in this magazine or on any other issues relating to higher
education. Send them to the Editor, EDU at
xxxxx@xxxxx.com-leaders.com
To read more about IT security:
Case study :www.mirlabs org,IT security & Academic Values:www. net.educase.edu, University Business magazine: www.universitybusiness.com What’s Online
VIRUSES,WORMS,PORNOGRAPHY,CHAT,TERRORMAILSAreyourstudentssafefromthese?InternetthreatsAsaneducationalinstitution,youhavearesponsibilitytoprotectyourstudentsfromunsafesurfingthatcanleadtoviruses,worms,spywareandmore.YouneedtopreventunhealthyInternetactivitieslikepornography,adultchatandillegalP2Psurfing.Cyberoam-theonlyIdentity-basedUTMFirewall-freesyoufromexternalandinternalsecuritythreats.ProtectyourstudentsandyourinstitutionNow.DeployCyberoam.CyberoamAdvantage-IndividualInternetaccessrightsanywhereinthenetwork-Controlsnon-academic,nonproductivesurfing-PinpointsuserinMultipleUser-SingleMachinescenario-SavesbandwidthabusebyblockingP2P,Chatandmore-Detaileduser-wiseon-appliancereporting-EaseofManagementPartialClienteleSVNITOsmaniaUnivNMIMSAIIMSSymbiosisBITRanchiSIMSTestimonials:“IwasimpressedattheeaseofconfigurationofCyberoam.Apersonwithlittleornoproductknowledgecanconfigureitquiteeasily.Italsoprovedtobeanexcellentcontentfilteringsolutionreducingtheloadonbandwidthconsiderably”“TheCyberoamsecurityappliancehassolvedallourmajorworriesregardingthemisuseofInternetfacilitiesbystudents.Ithelpsusmanagebandwidthatuserlevel,blockharmfulsites,chatting,gamesandgivesuscompletevisibilityonstudentonlineactivitiesandtheirwebsurfingpatterns.”NITRourkelaLDEngineeringCollege-AhmedabadProf.BVBuddhadev,HOD-ComputerDept.Dr.SaratKumarPatra,NITRourkelaWeb&ApplicationFilteringBandwidthManagementMultipleLinkManagementIntegratedReportingStatefulInspectionFirewall/VPNGatewayAnti-Virus&xxxxx@xxxxx.com:xxxxx@xxxxx.com
Feature_4_Technology.indd 53 10/29/2009 8:14:12 PM
Comments