Education
We find out whether your campus networks, student and staff devices, records and web systems are safe from attackers, and fix what we find. Schools and universities are open by design: thousands of personal devices, visitors, researchers and decades-old equipment. We build networks that stay open for learning and closed to attackers.
Colleges, universities and schools run some of the most open networks anywhere. Students bring several devices each, researchers run unusual equipment, visitors arrive daily, and the same buildings often house hospitals, labs and administration. Attackers target them for research data, student records and payroll.
We design campus networks for that reality: Wi-Fi 6E for dense lecture halls, 802.1X and network access control that identify every device, eduroam for visiting scholars, and segmentation that keeps a student laptop away from the finance office.
What we see in your industry
- Student devices outnumber students. Residence halls fill with consoles and streaming boxes that cannot do 802.1X, and lecture halls need hundreds of connections at once.
- Education records are protected. FERPA (20 U.S.C. 1232g) limits who may see student education records, institutions in the Title IV student aid programs must follow the FTC Safeguards Rule (16 CFR Part 314), and schools that receive E-rate discounts must filter and monitor under CIPA (47 U.S.C. 254(h)).
- Research, administration, hospital partnerships and guests all share the same walls. Segmentation keeps a compromised student laptop away from payroll and grants.
- Visiting scholars expect eduroam, the federation that lets them sign in with the credentials from their home university.
Identity is the foundation. A shared campus password cannot tell a student from a stranger. Managed devices authenticate with certificates under 802.1X, registered consoles get per-device keys, and guests use encrypted open networks, so each group lands on the right segment automatically.
Records carry legal duties. FERPA, at 20 U.S.C. 1232g, protects student education records. Institutions that take part in the Title IV federal student aid programs have agreed in their Program Participation Agreement to comply with the FTC Safeguards Rule, 16 CFR Part 314, which requires a written information security program for student financial information. Public schools and libraries that receive E-rate discounts must also certify compliance with the Children's Internet Protection Act, 47 U.S.C. 254(h). Knowing which systems hold those records, and who can reach them, is the first step.
Federation is the academic standard. eduroam lets a scholar sign in on any member campus with the credentials from their home university, using RADIUS proxying over TLS between institutions. We run the servers, the realm configuration and the monitoring.
Density is an engineering problem. A lecture hall of 600 laptops needs the right channel plan, the 6 GHz band and enough uplink capacity behind the access points; we design from measured client counts, not from guesses, and test with real devices before term begins.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a university's 802.1X, eduroam and Wi-Fi 6E campus, a 30‑school district's CIPA-filtered and segmented network (illustrative), and the offices of an online-education leader.
Zero Trust for Mid-Size Firms: A Practical Path Using NIST SP 800-207 and the CISA Zero Trust Maturity Model
Zero trust is not a product you buy. NIST SP 800-207 defines it as a set of principles, and CISA's Zero Trust Maturity Model gives a staged way to apply them. This article translates both for a mid-size firm with limited staff and a mix of cloud and office systems.
Work like yours
Two floors, 100+ people, every system in one hand
A leader in online technology education.
2 floors, 100+ employeesRead the case
A campus where 10,000 devices join Wi-Fi 6E securely, and visiting scholars sign in with their home credentials
A private university in the northeastern United States, with residence halls, labs and a teaching hospital partnership, a leader in its segment.
about 24,000 students and staff, 1,100 access points, 9,800 simultaneous devices at peak, 40 buildings, eduroam roamingRead the case
Thirty schools, one managed network: CIPA-filtered, segmented and readable by a three-person IT team
A public school district in the Southeast, a leader in its segment.
30 schools, ~22,000 students, ~3,000 staff, 10 Gb/s fiber to each school, 1:1 Chromebooks, Wi-Fi 6Read the case
A county government's segmented network and passkeys: from flat to default-deny in two budget cycles
A county government in the United States with a population of several hundred thousand, a leader in its segment.
About 25 departments, 2,500 staff, 60 buildings, segmented by department, passkeys for all staffRead the caseHow we help
Managed IT Services
Your entire IT operation, run by engineers who have operated infrastructure for global enterprises.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you secure Wi-Fi for thousands of student devices?
Yes. Our campus case covers about 24,000 students and staff and 9,800 simultaneous devices on Wi-Fi 6E. Managed laptops use 802.1X with EAP-TLS certificates, and devices that cannot do 802.1X, such as consoles, are registered on per-device keys.
What is eduroam and can you set it up?
Eduroam is the federation that lets visiting scholars sign in with their home university's credentials. We configure the institution's RADIUS servers to proxy visitors' requests to their home institutions over RadSec, and to authenticate the university's own users when they visit elsewhere.
How do you keep a student laptop away from payroll and grants?
Segmentation. Research, administration, residence halls, building systems and partner networks sit in separate segments enforced by firewalls between them. Dynamic authorization can move a device the moment its status changes, such as a flagged laptop.
What laws apply to student data?
FERPA (20 U.S.C. 1232g) limits who may see student education records. Institutions that handle federal student aid must also safeguard financial information under the GLBA safeguards requirements. We help build the technical controls, and your counsel interprets how they apply to you.
How do lecture halls with hundreds of laptops stay online?
The design is based on measured client counts, using high-density Wi-Fi 6E access points in the room. The case study describes a lecture hall of 600 laptops that keeps working, backed by multi-gigabit PoE++ switching and 25G and 100G uplinks.
Do you support older campus equipment?
Open campuses carry decades-old equipment, and we plan for it. Devices that cannot authenticate are profiled and placed in their own segments instead of being left on the main network.