The rail riders of vancou- ver, British Columbia, are in for the ride of their lives when, later this year, a new generation of automated, driverless SkyTrains—complete with smart-card ticketing systems—come hurtling down the tracks. But all that high-tech wizardry is nothing compared with the trail of security magic the railway projects IT team had to lay down so data could travel smoothly—and arrive safely—over the often bumpy routes of telecommunications links.
Whats so tricky about transporting data over those miles of links? The fact that the network is made up of moving targets. As construction on the line expands, seven of the projects 10 offices, located in trailers, are shuttled right down the line to where the new train tracks will be laid. And not only do the offices pick up and move from station to station, the work force, too, is a constantly moving target, alternately swelling and shrinking with completed tasks much like the approaching and receding clatter of a train demonstrating the Doppler effect. Add to the mix mobile users dialing in to access sensitive information such as financial documents, and youve got a ticket for security disaster, high telecommunications cost and inconvenience.
With more than 200 dispersed users, Erik Whiteway, the projects contractor at Scopeworks Technology Inc., in Vancouver, decided to implement a VPN that allows users in remote offices to connect to the corporate network safely and securely. By using VPNs to create a tunnel through the public Internet—rather than frame relay or leased lines—Whiteway was also able to cut costs. And to further ensure the security of transactions, Whiteway implemented strict rules and procedures for who can open specific files and how each user may access the network.
All that security was necessary to protect what is one of the largest projects of its kind in the past 10 years in Canada, with a budget of $1.17 billion. “Its a high-profile project, and it is possible that someone may want to attack this system, whether for malicious reasons or just to get information,” said Whiteway, who is also serving as IS manager for the 2-year-old project run by Rapid Transit Project 2000 Ltd. “It made sense to use a VPN [virtual private network] in order to provide multiple sites in various areas with access to mission-critical files.”
Rapid Transit isnt alone in looking to VPNs to handle security and cut costs when it comes to linking mobile users, central headquarters and remote offices. According to the Robert Francis Group Inc., in Westport, Conn., an increasing number of users this year will demand mobile connectivity, forcing IT managers to implement end-to-end administration systems for network security that facilitate the setup and maintenance of complex systems including VPNs and wireless business applications.
With mobile connectivity on the rise, corporations are realizing that traditional, fixed links such as leased lines and frame relay do not provide the flexibility of VPNs, which can be used from any device that has a client installed because they take advantage of the open, distributed infrastructure of the Internet.
Thats particularly true at Rapid Transit. In the last two years, the project has grown from one office with 20 users to a large, mobile network with more than 200 users in 10 offices. By using PowerVPN, from Symantec Corp., of Cupertino, Calif., Rapid Transit is able to position mobile offices along the tracks of the new SkyTrain line, allowing users working on the project to remotely access Oracle Corp. financial applications, in-house financial tools, Primavera Systems Inc.s Project Planner scheduling systems and Microsoft Corp.s Outlook e-mail program. Project members also use the VPN to access the Rapid Transit intranet, which contains customized human resource applications, press releases and news clips.
While Whiteway could have linked his three main offices to the companys Windows NT network through the phone company, he said it would have cost more than $3,000 per connection per month for the three main offices. Using the VPN and standard Internet links, he is able to provide the same connectivity for about $2,200 a month for all 10 offices. The three main offices each have a T-1 line, while the shifting remote offices take advantage of anything from dial-up to ISDN to asymmetric digital subscriber line connections, depending on whats available.
The network itself, located at Rapid Transits construction office in downtown Vancouver, is protected by three Raptor firewalls from Symantec Corp. While Whiteway and other IT managers monitor the firewall logs daily, he says hes never seen anything worse than a port scan on the network. There has also been no evidence of a successful hack on the Rapid Transit network, he added.
Scalability, of course, was a big issue for Rapid Transit because of the companys rapidly changing number of users. So far, Whiteway says, he hasnt had any problems.
For now, Whiteway has limited the installation of VPN clients to NT workstations located at remote offices for all office employees. Whiteway himself takes advantage of the VPN by accessing it wirelessly using his cell phone and a laptop, but no one outside of IT is allowed to access the network from their home machines. Thats because he fears the security holes that could open up because of telecommuting.
When Rapid Transit launches its second SkyTrain line later this year, Whiteway says hell consider a Windows 2000 upgrade, which will allow him to take advantage of the operating systems robust Kerberos security options. Whiteway is also thinking about upgrading his Oracle financials to the Version 11 databases—all in the name of laying down the best possible roads to a secure network.
After all, he says, security is only one part of the technology mix in the sense that you want to make sure the trains are running on time. “I believe theres a savings in actually keeping your network current with both hardware and software,” Whiteway said. “Its a way to ensure security stays up-to-date.”
