NSW seeks to build unhackable netbook network

The NSW Department of Education is using asset-tracking software, RFID tags, and BIOS-embedded filtering smarts to roll out 240,000 netbook computers into what CIO Stephen Wilson calls "the most hostile environment you can roll computers into" - the local high school.

The rollout of Lenovo netbooks, funded under the Federal Government's Digital Education Revolution initiative, is a massive logistical and IT security challenge, and the solution Wilson and his team has put together to fix these issues could well be applicable to any corporate IT department.

Over four years, some 240,000 Lenovo netbooks will be offered to students in year nine. The netbooks can be kept until year 12, or permanently should the student finish his or her studies at the school. Netbooks are also being offered to teachers.

To take receipt of the netbooks, students and parents are asked to sign forms in which they acknowledge their responsibility to take care of the machines and use them appropriately.

They are armed with an enterprise version of the new Windows 7 operating system, Microsoft Office, the Adobe CS4 creative suite, Apple iTunes, and content geared to students. Although the netbooks are loaded with many hundreds of dollars of software, 2GB RAM and a six-hour battery, the cost to the NSW Department of Education is less than $500 a unit.

Underneath the covers of the netbooks - and within the network that controls them - lies a great deal more smarts to ensure that the total cost of ownership of each machine does not blow out.

Wilson said that while private schools and other states have taken a "carte blanche" approach to handing out laptops as part of the Digital Education Revolution, the DET rollout is "among the more systematic, automated and paperless" projects ever embarked upon.

Security smarts

At the physical layer, each netbook is password-protected and embedded with tracking software at the BIOS level of the machine.

That is administered through an enterprise services bus, which also connects the Remedy suite for asset management, Active Directory for authentication and Aruba's Airwave for wireless network management.

If a netbook were to be stolen or sold, the department can remotely disable it over the network. Even if the hard drive of the machine was swapped out or the operating system wiped, it would be useless to unauthorised users.

Already, it has noted the loss or damage of just six netbooks out of the 20,000 rolled out since August - and have tracked a teacher using their device on a field trip in New Zealand.

While there is a serial number and barcode on each computer, the department said that thieves or students might be able to remove them. To combat this, it is using passive RFID chips on every machine that will enable them to be identified "even if they were dropped in a bathtub".

Being passive, an RFID reader needs to be within close proximity of the device to read it. (Active RFID transmitted a signal back to base.)

The department used the AppLocker functionality within Windows 7 to dictate which applications are installed.

Web access on the netbooks is filtered according to a corporate security policy (using McAfee's SmartFilter technology) plus an additional SOCKS-based proxy client, which provides web filtering at the network layer.

The devices also use Microsoft's Forefront Antivirus technology.

Upgrades

With such a huge fleet of computers in the hands of students, Wilson said it would be "unrealistic" for the department to offer technical support for software applications.

The netbooks were built so that the department can remotely upgrade and patch the devices over a wireless network.

It used Microsoft's System Centre Configuration Manager tool to distribute software down to devices.

The update service switches off once a student finishes year 12.

Wilson said there was no way such a large fleet of machines could be managed at such low cost without the smarts embedded within Microsoft's new operating system.

"There was no way we could do any of this on XP," he said. "Windows 7 nailed it for us."