Wireless networking in buildings - is there policy/guidelines?

There has been some discussion recently regarding the connection of clerk office computers in our Stake Center to the existing Family History Center's network -- it has a broadband connection to the internet. The purpose is to expedite the ever-increasing time involved with MLS send/receives. Is there official church policy and/or guidelines regarding the use of wireless networking in the buildings? With the proper security in place, it seems like it would be a much more efficient use of money than running wiring throughout the building.

Feedback from those with an official take on this is appreciated!

I believe FM is responsible for setting up the clerk computers so they can connect to the wireless. I believe you should have your stake clerk who deals with computer issues contact FM to get the computers connected to the wireless. Unfortunately, I don't think that will solve the problem you are asking about though. I called Tech support at church headquarters about a month ago and they told me that they were working on getting MLS to send/receive over the internet instead of the phone line, but it's not there yet. They didn't give me a ETA, but I'm guessing it may be awhile. Maybe someone else here has more info on this.

Jay

If you've installed Desktop 5.5 on the admin computers, then you MAY connect them to an existing church network. (I'm assuming your FHC is a valid church network with a Cisco PIX box acting as filter. I say "assume" because I've seen some that are not.) Desktop 5.5 was a set of CDs that came out in the last few months that was a Image (as in wipe your drive) that loaded a new setup.

I'd give the clerk support line a call for guidance. My understanding is that FM only has to get involved if you're going to be knocking holes in the walls to run the wires. (I'll take wired over wireless any day.) Wireless is an option if the church has installed it's official wireless setup. (again assuming that someone hasn't done "their own thing".) It's possible that you'd need to buy/order the equipment though FM, so that's why I suggest calling for guidance.

jayaskre wrote:I called Tech support at church headquarters about a month ago and they told me that they were working on getting MLS to send/receive over the internet instead of the phone line, but it's not there yet.

AFAIK, the current hang-up is cost justifying installing broadband into buildings that don't currently have a church network. If you've got a church network in the building (for a FHC, Institute or church employee office) then it's just a matter of getting you connected. I'm not sure if all the ins and outs on the last part are all smoothed out, but it's in the do-able phase.

RussellHltn wrote:AFAIK

What's AFAIK?

mkmurray wrote:What's AFAIK?

as far as I know

ericb wrote:There has been some discussion recently regarding the connection of clerk office computers in our Stake Center to the existing Family History Center's network -- it has a broadband connection to the internet. The purpose is to expedite the ever-increasing time involved with MLS send/receives. Is there official church policy and/or guidelines regarding the use of wireless networking in the buildings? With the proper security in place, it seems like it would be a much more efficient use of money than running wiring throughout the building.

Feedback from those with an official take on this is appreciated!

This won't answer your question exactly but read this Q&A:

Tom

RussellHltn wrote:If you've installed Desktop 5.5 on the admin computers, then you MAY connect them to an existing church network. (I'm assuming your FHC is a valid church network with a Cisco PIX box acting as filter. I say "assume" because I've seen some that are not.) Desktop 5.5 was a set of CDs that came out in the last few months that was a Image (as in wipe your drive) that loaded a new setup.

I'd give the clerk support line a call for guidance. My understanding is that FM only has to get involved if you're going to be knocking holes in the walls to run the wires. (I'll take wired over wireless any day.) Wireless is an option if the church has installed it's official wireless setup. (again assuming that someone hasn't done "their own thing".) It's possible that you'd need to buy/order the equipment though FM, so that's why I suggest calling for guidance.

This is correct. If your building currently has a Church approved Internet currently (generally a Family History Center in the building) then you can have your Stake Technology Specialist connect via wireless to it if the stake will purchase the wireless cards. You do need to have desktop 5.5 installed as this provides some a/v protection and a software firewall. MLS should transmit over the Internet with no problem. This will only work with currently installed Internet and it is important that you keep your FM tucked in.

DJC wrote:you can have your Stake Technology Specialist connect via wireless to it if the stake will purchase the wireless cards.

Just to clarify, the wireless network needs to be an approved network, not something you buy at a local computer store. (The cards for the computers might be obtained that way, but I think the AP as well as the wireless client has to be official.) The stake will need to fund the install.

RussellHltn wrote:Just to clarify, the wireless network needs to be an approved network, not something you buy at a local computer store. (The cards for the computers might be obtained that way, but I think the AP as well as the wireless client has to be official.) The stake will need to fund the install.

That is exactly right.

Also, another installation procedure is to have a router in the clerks office for the computers and that router has a cable that goes to the FHC (FHL) room to connect to the DSL.

Just another implementation that I've seen.

First I've heard of that. I guess it provides some protection against probing from the FHC computers, but otherwise, I don't see the point.

Another is could be in the event of broadband becoming faster and faster the current Wireless (Fastest is 100 Mbits/s while with Cat 5e it is 1 Gbit/s) but again, most broadband connections don't even get close to those speeds. So security was most likely the reason.

we have in our branch a FHC with wireless system. when it was installed a connect spot was also put by the clerks office. i have asked slc several times about getting the clerks computer online but have been told "someday" but not now. the also said they would send out an offical announcement.
have we missed something from someone?
we are ready and willing to go

RussellHltn would know more about this but from what I've gathered you need to get the Desktop 5.5 for your stake and then you can connect the computer up to the internet.

You can connect up to the wireless access points in your branch building provided that your FHC is using a Church Headquarters provided firewall (CCN connection), that you have desktop 5.5 installed on your clerk machines, and you pay for any wireless cards for the clerk machines out of the branch or stake budget. There should be more of an official policy statement in the near future.

i just called the globelhelpdesk and they said to email cservices @ldschurch.org for desktop 5.5. so i have and will wait and see what happens. we may get into the 21th century yet

I'm not sold on connecting the clerk computers to the internet. All it would take is a one-time intruder to the information they hold. Wouldn't THAT make a headlline.

Perhaps I'm overly cautious, but I tend to think of what could happen with a faulty install or that one time it messed up and someone got in.

It's not THAT long of a wait on the dial-up on ours, perhaps 5 minutes or so usually.

Just my 2¢ worth!
Skip

avskip wrote:I'm not sold on connecting the clerk computers to the internet. All it would take is a one-time intruder to the information they hold. Wouldn't THAT make a headlline.

Just for kicks and grins I checked the law recently passed in my state. Since we don't record SSN, Driver's License number, or any kind of financial account number, password, etc, it fails the definition of "personal information" to require disclosure if there is a security breach. (Your mileage may vary.)

Since the MLS data seems to be encrypted, about the only way anyone is going to get anything is if someone exports the data from MLS.

Also keep in mind that the machine is behind a church supplied firewall.

That's not to say there is NO risk, but apparently the risk is at acceptable levels.

Personally, I'd really like to see the ability to run MLS as a "user". It's really, really hard to infect a system when the user doesn't have administrative privileges to make changes to the OS.

Also, remember that dial up line, while slow, is still transferring data over the Internet. Having the dial up line does eliminate an "always on" connection to local unit PC's, but if local units are behind a hardware firewall, a software firewall(desktop 5.5) and turn the computers off when not in use, they should be as secure as they are currently. At least that is my opinion.

While the phone line is over the Internet, it's so heavily filtered that it's not usable as an Internet connection. For all practical purposes, it's a VPN and quite secure.

Allowing the clerk's computer to browse the Internet opens up a rather large security issue. I think one of, if not the biggest vector for malware is a poisoned website or file. Any browsing to that site can cause the malware to install itself into the computer where it can then "phone home" for instructions or send any data it's found. Since most firewalls will permit outbound connections, it can usually get though. The trend now is not just OS vulnerabilities being exploited, but application vulnerabilities as well. Adobe had a problem with V7 of the reader that could allow a malicious PDF file to run arbitrary code. Quicktime also had that issue (Apple software causing a PC vulnerability - oh! the irony! :rolleyes: )

While the PIX filtering of inappropriate websites is a major help, not all such websites are caught. It also doesn't help if a valid website is hacked and a poised file is substituted for a valid one. Since the corruption could be subtle, it might take awhile before the intrusion is discovered.

So while I'm sure Internet access will be a big help, I personally remain leery about the current setup, if for no other reason then all MLS users have local admin rights on the machine, which means anything that manages to get into the machine can do anything it wants.

The default internet settings could be increased similiar to Windows Server 2003's settings. This would require to place all approved websites on a trusted list and anything that isn't trusted is blocked. For a ward computer I would thing that the lds sites should be the only approved sites anyway.

thedqs wrote:The default internet settings could be increased similar to Windows Server 2003's settings. This would require to place all approved websites on a trusted list and anything that isn't trusted is blocked.

Blocked or highly restricted? (That is, the rest of the Internet is placed in the "Restricted" category.) Highly Restricted would help, but keep in mind there have been some vulnerabilities that can get past that. One of them was a flaw in the way an image was process. Simply loading a JPEG or GIF from a site could compromise the computer (both IE and Firefox had this issue.)

As for blocking everything except LDS sites, there are any number of non-LDS sites that are useful in doing the work. White Pages for doing telephone number lookups, software and hardware vendors to download driver and other updates are some I can come up with off the top of my head.

The yellow/whitepages is a good point, but as for the software/hardware driver downloads and other updates I'd think that another account for the Ward Tech Speciallist could be created with less restrictions. (Usually those with more technical expertise can avoid compromissing situations)

thedqs wrote:I'd think that another account for the Ward Tech Speciallist could be created with less restrictions.

That still leaves the automatic updates such as anti-virus Windows. I'm sure there are alots of reasons to go to non-church sites. For example there are a number of member church sites for church-related software. I'm sure if we give the ward clerks a chance, they'll come up with a good list of sites they use to further the work.