Dean Lowe's Letter to the Medical School
Subject:
Important message regarding wireless (WiFi) network security at the School
of Medicine
Date: January 10, 2004
New federal and state laws mandate that we significantly strengthen the
security of information systems that we operate at the School. In the
coming year we will be introducing new policies, procedures, technology
and services designed to enhance IT security within the School of Medicine.
One area of particular concern that requires urgent attention is the proliferation
of "unofficial" wireless (802.11 or WiFi) access points within
the School. These ad hoc wireless networks are inherently insecure and
are a major point of vulnerability for the School's IT infrastructure.
Because our data network interacts with both the Hospital and University
networks the risks associated with ad hoc wireless access points at the
School also extends into these environments.
To address this issue, effective Monday January 12, only the School's
Office of Information Resources and Technology (IRT) will be permitted
to install and operate NEW wireless network access points or wireless
networks on the School's data network. Over the coming months IRT will
be replacing ALL existing wireless access points at the School with new
wireless technology that significantly enhances network security. Just
as there is now only one centrally-managed wired network at the School,
over the coming months we will be migrating to a single, centrally managed
wireless network.
We recently completed an extensive survey of "unofficial" wireless
networks operating within the School and believe that we have the location
and affiliation of most of these access points. IRT will work with the
operators of each of these access points to begin the process of replacing
them, free of charge, with more secure 802.11-based technology.
IMPORTANT: To ensure that we have a complete list of all currently operating
wireless access points and wireless networks within the School, we are
asking that any person responsible for the operation or maintenance of
an 802.11-based wireless network within the School complete a registration
form at:
http://med.stanford.edu/irt/networking/wireless/register.html (This link no longer valid)
IMPORTANT: Only those wireless access points and wireless networks that
are registered with IRT by Monday January 26th will be permitted to continue
operation and ONLY wireless access points and networks registered with
IRT by that date will be replaced free of charge.
This change in IT security policy at the School of Medicine is unlikely
to negatively impact operations as: (a) we will allow registered WiFi
networks to continue operation until they are replaced by the School's
WiFi network technology and (b) IRT's assuming the responsibility of operating
and maintaining a secure, centrally-managed, WiFi network will provide
a superior level of WiFi service overall.
