POLICY:

Authorized users of Georgia State University computer systems networks and data repositories may be permitted to use wireless technology to connect to those systems, networks or data repositories for the conduct of University related business only through authenticated and centrally managed access methods.

Rationale:

Increase in the availability of wireless technology and the ease of deployment has significantly increased the potential for unauthorized access to University information systems. Deployment of the Student Wireless system established a framework for authenticated access across the campus. Establishing policy centrally and configuration and management of access points by a central authority allow a minimum number of penetrations of the security of the network.

Standards & Procedures:

Standards:

Access Method. All access through wireless access points connected to the University network infrastructure (regardless of duration) will be by Virtual Private Network (VPN) tunnel, or Wireless Gateway, and authentication using Novell userid and password. Mobile access points will be permitted to operate only from network ports configured by University Computing and Communications Services (UCCS) for this purpose. Existing local procedures for access must comply no later than June 30, 2004.

Configuration, Installation, and Management. All fixed wireless access points connecting to the University network infrastructure will be configured, installed and managed by UCCS. UCCS will provide periodic update information to the University community on approved vendors and models of access points. Existing access points must, as a minimum, provide 802.11b service and be configurable to block broadcast of SSID. Non-compliant access points must be replaced no later than June 30, 2004.

Unauthorized Access Points. UCCS will periodically check the campus for unauthorized fixed and mobile access points, immediately disable the network ports supporting those access points and advise the operating department of necessity to comply with this policy.

Procedures:
Access Georgia State's Network via Wireless Connection

Revisions:

Revised for compliance with ISAT Senate Committee recommended formatting
(January 2003)

Approval Date(s):

Reviewed by IST:
Reviewed by Information Security Subcommittee:
Reviewed by ISAT Senate Committee:
Approved: ISAT Senate Committee/October 16, 2003
Approved: Provost/January 5, 2004
Version number: 2.0.0
Effective Date: January 5, 2004

SUMMARY OF CHANGES/ADDITIONS/DELETIONS

This policy was originally adopted by the ISAT Senate Committee as a Standard associated with the Remote Access Policy. It has been rewritten as a policy to reflect change in philosophy of how to effectively utilize wireless technology as well as to significantly decrease the potential for unauthorized access to the University Information Systems through uncontrolled and unprotected access points.