An experience of monitoring university network security using a commercial service and DIY monitoring

Monitoring network security of a university is one of the most important jobs for the network managers. Without the monitoring, it is hard to keep the network safe. It is common that the security policy of a university has the term which states that monitoring network security is a mandate. However it is very hard to monitor every part of a university's network by the limited number of staff and a limited amount of time and expense. In order to cope with these problems, we bought a commercial network security monitoring service for the doorway of our campus network and we are doing Do It Yourself (DIY) monitoring with free software for the inside of the network. By the commercial monitoring service, we could reach 24 hours a day and 365 days a year monitoring at the doorway. By the DIY monitoring, we could realize the precise monitoring of inside network, which is hard to realize by the commercial monitoring, because there are Network Address Translations (NATs). If an incident was found by the combination of these monitoring, we could deal with it as fast as we can. By these efforts, there was no serious incident such as unauthorized manipulation of important web pages by crackers and leaking serious personal information by using P2P file sharing software last year. In this paper, we report the experience of our monitoring.