Speaker Spotlight: 7 Things You Should Do to Improve Your User’s Security on eduroam

Eduroam has outgrown its roots as a convenience for visitors. Increasingly, it’s how all users – and not just visitors and mobile users – get connected. As a core part of the campus and student experience, it’s essential that institutions think about their eduroam provision as they would any other mission critical service. 

What was “good enough” five years ago may no longer be sufficient for a service that so much of the university’s activities depend on. Security and performance are key properties of any important service, and that includes eduroam.

Enterprise WiFi solutions are designed for deployment within the context of a single organization. This means they make assumptions that might not be appropriate for eduroam. 

Because eduroam is based on standards-based technologies, all these enterprise wireless products can work with eduroam. However, these assumptions can lead to configuration choices that might not be optimal for performance or security. 

Unfortunately, the technology is complex, and the issues can be subtle. This makes it hard for institutions to be confident they’re making the correct deployment and configuration choices.

It’s a great idea to talk to your peers, as they may have valuable experience and information, particularly if you’re using the same vendor(s). InCommon has a mailing list for eduroam administrators where you can pose questions and connect with others. If you’re not already subscribed, visit eduroam admins where you can subscribe directly to the list.

The Internet2 eduroam team also provides technical support. We’re always delighted to talk to institutions looking for advice and guidance. This is particularly true for performance and security issues because these can impact other institutions — not just your own.

It is possible to deploy eduroam at a small scale with few new resources. That’s because these deployments simply reuse systems (such as an existing wireless LAN controller or a RADIUS server) already being used for other services. This is where almost everyone starts out.

It is a great way to gain some early operational experience, but operating eduroam at scale, like any important service, requires careful planning and resourcing. There’s obviously infrastructure capacity to consider, but there are other non-technical issues that are just as important. 

How are you going to onboard and support thousands of users? What should be logged, and how long should you retain this? Does your network Acceptable Use Policy consider this style of access? Do you want to consolidate all WiFi access on the eduroam SSID, or broadcast multiple SSIDs?

As before, the best idea is to connect with your peers and the Internet2 eduroam team. Let their hard-won experience do the heavy lifting for you!

We often hear the same questions and concerns from institutions; many of these are addressed by this presentation. I hope we can explain the issues and offer solutions to these recurring questions so attendees can fine-tune their deployments with confidence.