Indiana Wesleyan University Case Study

You can't protect what you can't see

One issue Madl quickly noticed was a lack of visibility into traffic or data entering or leaving the network. Even the firewalls, which had basic URL filtering and some DNS sinkhole technology, didn’t provide enough visibility into what was happening on endpoints. Yet the ability to see the traffic was critical for filtering content and deploying controls rapidly.

When looking for new technology, Madl first considered the obvious choices from vendors like Cisco and Cloudflare. They have effective filtering technology, but the products proved too expensive for a university strictly funded by enrollment, he said. More research led him to DNSFilter, a content filtering technology designed to block online threats and inappropriate content. It was a much more affordable option and would meet the university’s needs.

The DNSFilter tool could address the university’s two groups of users, employees and students, differently. For employees, the university’s small IT team pushed an agent out via its mobile device management system on all employee devices – phones, laptops and desktops. The agent alters the DNS settings on the host, funneling everything through the DNSFilter cloud. The agent then converts the DNS settings to point to DNSFilter for any query the machine makes – web queries but also other programs installed on the machine that point home, like antivirus. This helps Madl’s team not only from a web traffic perspective; it identifies traffic from anything on the device that “phones home” and makes an internet connection.

Through that agent, DNSFilter can enforce compliance and safety policies. Employees have access to the internet except for malicious and inappropriate sites. DNSFilter also helps to ensures that employees use university-sanctioned software and tools like VPNs and file sharing.

Madl highlighted AppAware as a particularly useful DNSFilter feature. AppAware detects and blocks risky applications, which has helped put controls on the applications used by employees.

Protecting students is a little trickier since the university doesn’t want to infringe on personal rights and preferences. Because of that issue, the DNSFilter instance for students doesn’t install agents on endpoints. Instead, the university uses DNSFilter controls at the firewall, edge, and directory/DNS levels to prevent users on its network from accessing malicious and adult sites. As students access the internet, they cross the university firewall and are assigned an IP address for the network, along with DNS settings. If the site can’t connect to the internet for any reason, it is forwarded to DNSFilter, which applies the appropriate policies.