College of Engineering Prohibited and Restricted Technology

ETS manages a shared network that is common to all College of Engineering faculty, staff, and students. All network equipment attached to the ETS-managed network must be managed by ETS. No self-managed network devices are permitted. This includes but is not limited to routers, switches, bridges, bastion hosts (aka jump hosts), firewalls, and VPN. No equipment can be attached to an OSU network without the express permission of ETS Networking.

For the effective management and security of the ETS managed network, a one-to-one relationship between endpoint and network lines pulled directly to the ETS managed switches is required. Under certain specific technical circumstances, exceptions may be made, but all space planning and remodeling budgets should include adding network lines if equipment is introduced into an existing space that requires network connectivity beyond the current capacity of the wired connections within the room.

OSU’s Office of Technology and Digital Innovation maintain the EDURoam (and related) wireless networks that blanket the campus. Wireless access points and related hardware used to create wireless networks are not permitted to operate in the same space as the global networks.

Exceptions: The college has researchers working specifically with networking (wired and wireless) technology and there are cases where such equipment is required. In all such cases, the faculty person initiating the research must open a service request with ETS via the ETS service portal so that appropriate limitations and compensating controls can be put in place prior to the equipment being acquired and deployed.

The university Purchasing Policy requires the use of the official marketplace (i.e. BuckeyeBuy) contracted vendors. Non-catalog requests are only allowed “[w]hen goods and services are not available from internal suppliers or on the MarketPlace, when special instructions cannot be provided any other way, or when an emergency dictates the order be expedited, a non-catalog/special request may be placed.” All purchases must adhere to this policy, including IT purchases such as hardware (full systems and components), software, and service contracts.

Additionally, ETS has support advantages when working with Dell and HP as system vendors. All purchases must evaluate an equivalent system from one of those vendors for suitability. In some cases, recent experiences by ETS staff may short-circuit this process. Since all computer-related purchases must include ETS in the purchasing process, the sooner ETS is involved, the more efficient the process.

All client and server systems must have current, vendor-supported firmware that is actively supported by a vendor who releases security updates as needed per sections IT4.5.1 and IT10.5.1 of the ISCR.

Hardware that is not covered by a warranty or service contract might still be eligible for ETS support and use on university and college networks if a compliant level of vendor support still exists for the system and all its components.

A system excluded from ETS support due to non-compliance with university standards and policies might be eligible for self-management per the College of Engineering Policy for System Asset Administration but would still be subject to all required compensating controls including complete network isolation.

NOTA BENE: Without exception, any client or server system used in conjunction with a TCP must be covered by an active warranty or support contract or have active and verifiable vendor support for system updates.

All client and server systems must have current, vendor-supported operating systems per sections IT4.5.1 and IT10.5.1 of the ISCR. Systems that require an un-supported operating system must be isolated from the ETS networks and is subject to additional compensating controls.

Some operating system vendors offer extended-support contracts after main-stream support for the OS ends. Costs associated with support contracts are the responsibility of the system asset custodians. ETS may not be able to support all such situations and custodians should request a consultation from the ETS service portal well ahead of the OS’ end-of-life date.

A system excluded from ETS support due to non-compliance with university standards and policies might be eligible for self-management per the College of Engineering Policy for System Asset Administration but would still be subject to all required compensating controls including complete network isolation.

NOTA BENE: Apple has a history of ending OS support on older hardware. This directly impacts MacOS devices and may result in hardware end-of-life earlier than similarly aged systems that run other operating systems.

The majority of Docker implementations require system-level access to the hosting operating system. This creates a variety of security concerns. If Docker functionality is required, ETS has a rootless Docker solution that has successfully deployed on multiple research servers. See the "Docker" section under "Software" below.

Multi-OS systems are prohibited on COE system assets regardless of management state. These systems pose significant risks to data integrity, system stability, and cybersecurity. Such configurations increase the attack surface, making system assets more vulnerable to malware, data breaches, and unauthorized access. Furthermore, there is an inability to meet a collection of ISCR specified controls on multi-OS systems. ETS has a support model for Docker-based containerization and OSU offers a container-based service offering. A service request can be submitted to the ETS service portal to initiate a discussion on how these services can alleviate the perceived need for a multi-OS system.

Note that this includes (not exclusively): multi-OS boot disks, external boot media, Apple Parallels (refer to section 5.3), VMware Fusion, and Oracle VirtualBox.

WSL and WSL2 have specific design factors that increase the available attack vectors on the local system. Most notably circumvention of the local firewall, which is required per IT10.9.1 of the ISCR. An acceptable alternative to WSL/WSL2 is separate hardware dedicated to an ETS supported Linux installation. To request more information please use the ETS Helpdesk contact information found at the bottom of this page.

OSU and ETS have standard tools for remote access to OSU assets. For Linux this includes SSH and FastX. For Windows this includes RDP. Unless there is a specific business need for an alternate solution, all access tools such as, but not limited to, TeamViewer (refer to "TeamViewer" in the Software section of this document), AnyDesk, Chrome Remote Desktop, RustDesk, SplashTop, ScreenConnect, NoMachine, LogMeIn, and all versions of VNC are prohibited due to security concerns such as the increased risk associated with using multiple access tools, administrative access components of some applications, and a history of security issues associated with certain applications. All requests for exceptions must be made via the ETS service portal and cite a specific business activity that is compromised when using the standard tools.

Docker when installed on Windows requires Windows Services for Linux which is prohibited for the reasons detailed above. Docker when installed on Linux usually assumes a system-level install with full root access to the hosting operating system. This configuration subjects the hosting OS to the vulnerabilities of the hosted containers. As a more secure configuration, ETS offers a rootless-Docker configuration that meets OSU security requirements.

Like other virtual machine hosting software, Parallels opens the hosting operating system to additional security risks. Guest OS client health and shared resources with the parent OS significantly increase the surface area for malicious attach. Meeting ISCR compliance is not possible on a dual OS system. In Engineering, one piece of hardware is generally required to run a single operating system.

TeamViewer is prohibited from College of Engineering system assets regardless of management state. This is for two reasons. First, TeamViewer is more than a remote connectivity tool. It allows for remote administration of the device and such activity is restricted to ETS staff. Remote Desktop (Windows) and SSH/FastX (Linux), the supported tools, provide remote access without remote administration. These are freely available to all College of Engineering system assets. Second, TeamViewer has a concerning security history. Even if an exception state exists where remote management capabilities may be required for a specific business purpose, an application other than TeamViewer should be selected. Consultation with ETS staff can identify an appropriate tool for any given use case.

Internet browsers are software that must pass Terms and Conditions as well as Accessibility and Security requirements. There are supported browsers already installed on endpoints in the ETS managed environment. Use of alternate browsers must be requested and approved on a case-by-case basis. Until properly vetted, alternate browsers may be subject to enforcement practices including, but not limited to, remote uninstallation and/or execution blocking by ETS management software. To request more information please use the ETS Helpdesk contact information found at the bottom of this page.

Common alternate non-approved browsers:

• Brave Browser
• Wave Browser
• Shift Browser
• OneStart

Reverse proxy services (software that exposes local applications to the public internet) are not permitted in the ETS managed environment. These services inherently bypass institutional firewalls and security controls which create significant risks, including unauthorized access, data leakage, and potential compromise via remote code execution; in so doing, their use violates university security policies. Applications requiring external access must be hosted on approved, secure platforms that enforce proper authentication, encryption, and access controls.
Common example of such reverse proxy software:

• Gradio