University of East Anglia Graduates to a Stronger DDI and Security Foundation with Infoblox
“While firewalls provide critical perimeter protection, a comprehensive defense-in-depth strategy necessitates Infoblox Threat Defense.”
- Aaron Hayward, Head of Network Services, University of East Anglia
OVERVIEW
The University of East Anglia (UEA), a public research university in Norwich, England, was established in 1963 on a 360-acre campus west of the city center.
UEA consists of four faculty divisions and 26 schools serving more than 18,000 students supported by 4,200 faculty and staff. Recognized as one of the United Kingdom’s most-cited research institutions worldwide, UEA is home to a distinguished community that includes three Nobel Prize winners, the co-discoverers of hepatitis C and D genomes, the co-inventor of the Oxford-AstraZeneca COVID-19 vaccine, numerous Fellows of the Royal Society and Fellows of prominent U.K. scientific and teaching academies.
THE SITUATION
State-of-the-Art Research in Need of State-of-the-Art Networking and Security
To maintain its high level of research, UEA requires a networking infrastructure that is always available, resilient, secure and adaptable. Delivering on those goals falls to Aaron Hayward, head of Network Services for the University, and his eight colleagues. “For high-performance computing and our research academics, we’re focused on refining the networking technology and processes we use to ensure they are streamlined and state of the art,” he notes. For Aaron, this effort led to a complete overhaul of how he and his team control DNS, DHCP, and IP address management (DDI), the critical network services at the heart of all modern network interactions, while simultaneously addressing security concerns.
Customer: University of East Anglia
Industry: Education
Location: Norwich, England
Partner: KHIPU
Objectives: Rearchitect DNS, DHCP, and IP address management (DDI) to improve agility and strengthen security, Enhance the University’s security posture systemwide, Align all aspects of DDI with industry best practices
Results: Resilient and adaptable foundation for DDI and security, adhering to industry best practices, Greater DDI management efficiency by enabling team members to manage tasks simultaneously, Higher cyber risk scores and improved detection of tunneling and other threat activity
Products: NIOS DDI, Infoblox Threat Defense™
THE CHALLENGES
A Bespoke DDI Solution That Grew to Be Unmanageable
When Aaron joined UEA in December 2021, he inherited a DDI solution that had been constrained by budget-driven decisions, limiting its effectiveness and adaptability. Like many university IT environments, UEA’s networking organization had maturing skillsets and knowledge about DDI.
To control costs and maintain independence, UEA opted for a bespoke DDI implementation that its technicians could manage on their own rather than a more traditional configuration that would likely require external expertise. Over t ime, the University’s bespoke system required a custom-built portal to operate, which the technical staff then built in house. However, this portal introduced an additional limitation for the IT team—only one technician at a time could access it. This restriction caused routine bottlenecks given that managing DNS records, DHCP leases, and IP address allocations are dynamic, high-volume processes that require frequent changes. Additionally, the portal was difficult to use and provided little visibility into devices, users and locations, further complicating network management.
When Aaron arrived, he discovered one problematic consequence of the University’s highly customized DDI system made it challenging to implement industry best practices. For instance, internal DNS records had been copied to the external DNS infrastructure. This is a common occurrence in many IT organizations with limited DDI management resources. Other challenges included tracking DNS records, IP address utilization and subnet mapping. As a result, networking staff had no clear picture of which devices were associated with which servers or the current status of IP address allocations.
However, the biggest challenge associated with UEA’s critical network services solution arose whenever the DDI vendor released a software update. “Updates and patches were difficult to implement because of the bespoke configuration. Things would break and we couldn’t fix them,” Aaron recalls. A major obstacle was updating databases for the University’s 65,000 IP addresses. The networking team struggled for 10 months to upgrade to the vendor’s latest DDI version. “We just couldn’t get it right,” Aaron says.
As the struggles continued, upper management gave Aaron and his colleagues an ultimatum: fix the existing DDI solution or find one that works. Along with this mandate, the team knew that any new solution needed to also enhance UEA’s security.
THE SOLUTION
Placing DDI and Security on a Solid Foundation
When it came to managing critical network services, Aaron felt UEA needed to start from scratch—from the foundation. “If the foundation isn’t solid, then you can’t build on top of that. We needed to get the foundation right for the network.”
Fortunately, Aaron didn’t have to start from scratch to find a viable DDI foundation. He and his team were guided to the right solution by strategic partner KHIPU, a renowned U.K. networking and security services provider and reseller of Infoblox solutions. As UEA’s troubled DDI implementation grew more acute, KHIPU recommended Infoblox. Aaron first saw Infoblox NIOS in action during a demonstration at an annual workshop held by Jisc, a U.K. nonprofit dedicated to helping higher education and research institutions achieve digital transformation. Notably, Jisc was itself an Infoblox customer. If Infoblox worked for Jisc, Aaron reasoned, “Potentially, it would be a good solution for us.”
Infoblox NIOS not only met but exceeded expectations. The solution enabled Aaron and his team to achieve their first major goal, implementing industry best practices across all aspects of critical network services. With NIOS DDI and its centralized web console, UEA is able to simplify and automate DNS, DHCP, and IP address functionality across its network infrastructure while improving network speed and resiliency in the bargain.
NIOS DDI is also helping UEA accomplish another key milestone: rearchitecting its DDI platform to bolster security and support both current and future integrations with the University’s automation tools, public cloud environments, firewalls and other security solutions. The first priority when reconfiguring the network was segregating internal and external DNS within the University’s 65,000 IP addresses—an extremely intricate task that UEA successfully completed without disrupting service delivery. The institution’s NIOS solution includes eight servers for processing internal DNS queries and four servers that handle external traffic.
To strengthen security, UEA deployed Infoblox Threat Defense™. Aaron was attracted to the solution for its unique DNS-layer technology, which augments the University’s existing security investments. “While firewalls provide critical perimeter protection, a comprehensive defense-in-depth strategy necessitates Infoblox Threat Defense.” With Infoblox, UEA proactively safeguards all students, faculty and researchers from the widest range of malware, ransomware and data exfiltration threats that rely on DNS pathways. The solution also gives UEA’s technicians centralized visibility and control over every device connected to the University’s network.
THE RESULT
Moving Beyond Best Practices to Next-Level DDI and Security
In choosing Infoblox, UEA realized benefits far beyond the initial goals of rearchitecting the platform while adhering to DDI best practices. For starters, the NIOS solution’s intuitive web portal enables multiple team members to manage DDI tasks simultaneously, reducing the time required to maintain and synchronize DNS and IP address data. The Infoblox Portal represents an enormous improvement over the University’s previous homegrown solution. “The teams appreciate its speed, efficiency and user-friendly graphical interface,” Aaron notes.
The portal gives Aaron and his colleagues the ability to set permissions for performing DDI tasks and to monitor changes—who entered them and when. The solution’s rich dashboards and reporting features provide technicians with clear visibility into all assets across the network. These capabilities enable UEA to better understand the current state of DDI elements, such as subnets and IP address allocation, leading to more informed decision-making. “We use the grid view to visualize subnet allocations, allowing for quick identification of available address spaces. This visual approach offers greater clarity than relying solely on numerical data or utilization percentages,” Aaron says.
UEA’s implementation of Infoblox Threat Defense, while still in its early stages, has already had a significant impact on security. “It has strengthened our security posture by providing improved visibility, and by adopting Infoblox’s default block categories, we have definitely moved the needle in the right direction,” Aaron observes.
UEA is still assessing the full impact of Infoblox’s security features on end users as it continues to activate the solution’s many security capabilities. The DNS tunneling feature was the first to be enabled, and the results were immediate. “Infoblox has opened our eyes to what’s happening,” says Aaron. The system detects ongoing tunneling activity and can block once the data is verified and authorization to do so is granted. He believes that the solution’s dashboards and analytical tools will help him make the case to University administration for turning on additional features, such as the automated blocking of suspicious domains. “It’s something we can easily present to senior management, using a data-led approach to clearly illustrate the threats we’re facing and to justify the need for enabling additional features.”
Infoblox’s solution will support UEA’s transition to hybrid and multi-cloud environments as those initiatives progress. In the meantime, UEA is excited to leverage Infoblox’s APIs to drive automation and integration across its broader ecosystem. Aaron envisions a future where UEA’s firewalls, security information and event management (SIEM) tools and endpoint protection systems work seamlessly with Infoblox to detect threats earlier, apply advanced analytics and accelerate incident response. “That will free up my team to take on more strategic tasks,” Aaron explains. Reflecting on his experience with Infoblox—whether evaluating the new DDI services or security capabilities—Aaron offers a simple summary: “It just works.”