Secured infrastructure and simplified management for Penn State University

The facilities automation services (FAS) group at Penn State needed to centralize and isolate plant services across university buildings statewide — a seemingly impossible task, given that building-specific systems were on the same flat network as servers for HR, finance, etc. A lack of adequate segmentation and isolation completely exposed the entire network to lateral attacks.

“I took over this infrastructure when it was a flat, Layer 2 network across the main campus about four years ago,” explained Tom Walker, system design specialist and head of the FAS group. The network had grown organically over the years and added a new routed Layer 3 network, consisting of more than 600 switches and routers across 24 physical campuses.

The university’s large vendor ecosystem only made things worse, as manually configuring remote VPN access for outside vendors was both complicated and ineffective. On-site vendors increased security risks by adding their own switches, access points, and wireless routers to the Layer 2 network.

As if the FAS group didn’t have enough on their hands, frequent broadcast storms and 100,000-plus weekly HVAC and other alarms further limited their availability for larger security concerns.

Finding a solution that met the FAS team’s requirements wasn’t easy.

“We looked at creating separate VLANs or [private VLANS] within the buildings, doing MAC filtering, doing access control lists, or doing building-level firewalls,” Walker explained.

Quick, cost-effective deployment: Tom and his team connected 50 buildings in just five days and all buildings in 75 days, deploying 10 times faster than alternative solutions. They now manage their own updates and changes from a single pane of glass.

Enhanced network security: The Airwall overlay network allowed the FAS group to isolate and cloak all systems within their BAS infrastructure, eliminated the need for public IP addresses,  and segmented network access control for employees, contractors, and vendors — reducing their total attack surface by almost 90%.

Superior network availability: Isolating and segmenting their BAS allowed the team to eliminate broadcast storms, increase network performance, and reduce alarms by 50% in the first two months, freeing them up to focus on proper data tolerance.

As the FAS group continues to expand campus properties, they’re finding that they can connect to increasingly remote sites across separate networks using Tempered’s broad connectivity options. Most recently, they connected a building in the middle of a cornfield using cellular, where it would have cost over $100,000 to establish a fiber connection. “We’re able to deploy in places that we weren’t able to get to before,” Walker explained.