Departmental Firewall Project: A Campus-wide Security Initiative
by Michelle Collette
The Departmental Firewall Project, a security initiative funded by the President and the Provost to provide free firewall service across the University, kicked off in earnest in March of this year.
Firewall Migration Status
To date over 30 departmental networks have been migrated into the firewall infrastructure with another 40 migrations in the planning stages. A few of the migrated departments include: the Law School, School of Education, CSLI, School of Earth Sciences, Office of Research Administration, Procurement, School of Engineering Dean's Office, Vaden Health Services, Biological Sciences and the Controller's Office.
Currently, the project team is working with the School of Medicine, Computer Science and Stanford University Libraries and Academic Information Resources (SULAIR) to plan their migrations. By December of 2008, estimates are that the project team will have worked collaboratively with technical support staff (LNAs) from across campus to migrate approximately 300 networks into the Departmental Firewall infrastructure.
Migration Process
The process for migrating departmental networks behind the firewall was developed to provide network security across campus with a minimum of disruption to our clients. Thus far, feedback indicates we have been successful in achieving this goal.
Migrating a network behind the firewall occurs in two distinct phases:
- In Phase 1, project team members work with local technical support staff to identify the firewall rules they will need to permit essential network traffic through to departmental resources. Examples of these resources are web, mail and file servers or desktops that require remote accessibility. Once identified, firewall rules, also referred to as policies, are written to ensure their continuing functionality. Typically the migration itself results in a brief network outage taking less than a minute.
- In Phase 2, following the migration, all inbound traffic is logged and reviewed by the project staff and LNAs in order to identify further opportunities for enhancing the security of the rule set.
Firewall Only One Component of Computer Security
It's important to note that a firewall is only one component of information security. The firewall should never be considered a replacement for following good systems administration practices including patching, updating and sound account management. For more information on what you can do to secure your hosts, please refer to:
http://www.stanford.edu/group/security/securecomputing/
For More Information
For more information on the Departmental Firewall Project, please refer to:
https://www.stanford.edu/services/firewall/
You can also contact Michelle Collette at michelle.collette@stanford.edu.
