ISC:
Deployment of New Virus Scanning Service for Selected E-mail Domains
We are all aware
of the increasing prevalence of viruses and worms that have potential
to disrupt our network and adversely impact our own personal use
of e-mail. Furthermore, in the event that our own e-mail account
is contaminated, remedial efforts can be time-consuming and constrain
our ability to communicate with colleagues both within and outside
of Penn, sometimes for days. ISC--in wide consultation with
users and the IT community--believes the free flow of communication
can be enhanced if we can more readily identify and limit viruses
before they actually appear in our inbox.
Therefore, ISC Networking
and Telecommunications is pleased to announce a virus scanning service
for selected Penn e-mail domains that will go into effect the first
week of November. All e-mail that is sent to and sent from users
in the admissions, ben.dev, dental, design, dolphin, mail.med, and
pobox domains will be scanned for viruses by an off-site vendor.
This vendor uses a sophisticated technology which promises to be
highly effective at identifying viruses while adhering to the University's
policies on security and privacy. (For Penn's Policy on Privacy
in the Electronic Environment, see www.upenn.edu/almanac/v47/n04/OR-eprivacy.html).
The decision to deploy this service was reached in consultation
with IT Directors for the affected domains, as well as with General
Counsel, the Chief Privacy Officer and the Information Security
Officer.
How Scanning Will Work
Messages that have been
identified as containing a virus are quarantined on the off-site
server for 30 days and then are automatically discarded. Neither
the sender nor the recipient will receive notification about messages
that have been quarantined. Summary reports (containing only address
of sender, intended recipient and type of virus) of messages which
have been quarantined are sent to ISC Networking and Telecommunications
and our staff has the ability to retrieve a quarantined message
during the quarantine period should it ever become necessary. Copies
of the reports are sent to the account administrator for each domain.
Users who have concerns that a message may have been mistakenly
quarantined should contact their local support provider or account
administrator.
ISC Networking and Telecommunications
acknowledges that automatic discarding of e-mail messages without
notice violates the normal e-mail delivery processes as specified
by Internet standard RFC 2821, but the spread of computer viruses
has become so rampant and so destructive that we are compelled to
try to protect our users.
While messages will be
scanned to help stem the spread of computer viruses; virus scanning
will not catch all viruses and users are always advised to exercise
caution when opening e-mail file attachments. Nor does scanning
replace the need to have desktop anti-virus software installed and
updated. Viruses and trojans can infect a computer through means
other than e-mail such as file sharing, Internet download, and operating
system or application vulnerabilities.
We do not anticipate
any noticeable delay in the flow of e-mail with this proactive approach
to minimizing virus attacks. Our provider states that 99% of messages
will be received by the intended recipient within 30 seconds of
arrival on our provider's e-mail server and that delays longer
than 10 minutes will occur only under rare circumstances.
Our provider is obligated
by contract to adhere to Penn's Privacy Policies. They reserve
the right to utilize any virus-related content of an e-mail or its
attachments solely for the purposes of:
* maintaining and improving
the performance and the integrity of the service;
* observing, studying
and/or testing the functioning of the service; and
* making available
to affiliates any virus-related content from an e-mail that is
not classified as confidential, solely for the purpose of enhancing
the service and protecting against viruses.
Prior to using any virus
related content of an e-mail or its attachments for the purposes
of complying with any regulatory or legal requirements, our provider
will provide at least two business days notice to the University
of Pennsylvania. That notice will be used to determine whether and
what virus-related content needs to be disclosed to law enforcement
authorities.
For more information,
see www.upenn.edu/computing/email/virus-scanning.html.
Pobox users may also wish to contact their local support provider
or account administrator.
-- Robin H. Beck,
Vice President, Information
Systems and Computing
Almanac, Vol. 50, No. 10,
October 28, 2003
|