Segmentation Case Study: State University

The Customer
 

Large state university

This large state university serves the higher education needs of more than 100,000 students, with more than 17,000 faculty and staff across its 24 campuses. 

The Challenge

Centralizing the network infrastructure of 600+ buildings

A prominent state university wanted to incorporate building automation systems securely into a statewide smart campus initiative. The team responsible for the university’s physical plant and OT systems was concerned about a lack of segmentation protecting these devices and applications. They were also concerned about what would happen to the university’s IT network if it was removed from its existing air-gap state. As a result, the team undertook an ambitious effort to centralize its building automation systems and improve security.                         

The university’s project leader explained, “Up until about two years ago, all the campuses were pretty much on their own. We were hosting the main application server, but the individual campus controllers were sitting on IT networks, and not always segmented on separate VLANs from the rest of the campus traffic.” This meant a successful attack on a single building’s control systems could easily spread to a campus’s IT network or vice versa.                                                             

There was an additional economic reason for the project, as well. “The university wanted to do energy management and see where we could cut costs,” the project leader explained, “but we weren’t getting any data from the campuses because they were all standalone systems. So we needed to connect them, but we needed to do it securely. With the connections coming from those remote campuses into our data center, they could create a backdoor into our network for a potential attack.”                                         

The ambitious project to bring everything onto a shared network infrastructure covered more than 600 buildings across 24 campuses. The department’s facilities automation team was selected to execute the project. However, the sheer complexity of the university’s automation systems and the number of vendors involved presented another enormous challenge.                                         

“We’re managing elevator systems, HVAC, vibration analysis, lighting, electrical distribution, and electrical metering. Then we have all our main utilities, including steam generation, electrical distribution, and wastewater treatment. We deal with roughly 260+ contractors who work on these systems across all the various companies.”                         

All those vendors needed access to the network — without introducing risk or interfering with one another’s control systems.

Wanted: east-west traffic visibility and centralized policies

Tempered Networks, a security provider focused on smart control systems and Internet of Things networks, was used to address the north-south connections between the remote campuses and the university’s primary data center. With that challenge under control, the university still faced the problem of protecting the more than 300 servers running within the data center.                                             

“We were looking at solutions that supposedly handled east-west traffic, but none were as clean and simple as we wanted,” the university’s project leader recalled.                                              

 “We needed to find something easy to manage with a single pane of glass and a way to create rule sets based on application type. That’s when [Akamai] came into the picture.”

The team discovered Akamai when they came across their free Infection Monkey breach and attack simulation tool. Infection Monkey helps data center operators assess the resilience of their environments to post-breach attacks and lateral movement.

A distributed and integrated platform that simplifies security                       

“Some people are dead set on firewalling and think it will solve everything,” the project leader observed. “With central firewall management, you still have to set up the rules for each firewall individually. With Akamai, we can create an application group and say, “We want these systems to talk only to each other.”

Firewalls also present cost, resource, and manageability issues. “The management of all those firewalls would just be a nightmare. We'd probably need half a dozen people just to get the system deployed and make sure there are no issues, then at least two dedicated people just to manage it.”                                           

Moreover, firewalls lack the flexibility to set and modify policies at the application level.

“With [Akamai], we can listen for a while and understand what’s happening between systems and why they may need to communicate. With firewalls, it’s all or nothing. A firewall is just going to block port-to-port, and that’s it.”

Microsegmentation with centralized, easy management 

The speed and ease with which team members can create and deploy rules was cited as another significant benefit. 

“The first day we fired it up, we installed it on a couple of boxes, and then tried creating a policy to block one vendor from being able to see another. And just like that, it locked the first vendor out. That proved to me that this product was what we’ve been looking for,” the project leader noted.                                                                         

Akamai’s microsegmentation tools and methodology don’t require an expert. “Having something simple enough that anybody on our team can take advantage of it was a big seller for me.”