Skip to the content of the web site.
[an error occurred while processing this directive]
[an error occurred while processing this directive]
IST Collage

Minutes for Admin Computer Support Meeting - November 3rd, 2004


Location and Time:

NH 3001; Wednesday, November 3rd at 2:00 pm.

Attendees:

Donna Schell (Assoc. Prov. Bus. Oper/ Student Services), Lynn Snider (Athletics), Victor Lufer (Audio Visual), Linda Howe (C&PA), Karen Gallant (CBET), Lorraine Nesbitt (Counselling Services), Ildiko Denes (Office for Persons with Disabilities), Susan Shifflet (Office for Persons with Disabilities), Judy Richardson (Distance & Continuing Ed.), Pat Moore (Faculty Assoc), Michele Sguigna (Food Services), Cathy Jardine (GSO), Chris Strome (Health Services), Jeff Sturn (Housing), Tammy Marcinko (Human Resources), Sam Schmidt (IAP), Michelle Banic (IAP), Ian Read (Marketing & Undergrad Recruitment), Peter Robinson (Office of Development), Ian Turner (Office of Development), Cathy Cooper (Office of Development), Brenda MacDonald (Research), Christine Kuehl (Research), Monica Wielonda (Plant Operations), Maria LeBlanc (President's Office), Lauri MacLeod (Retail Services), Sheila Hurley (Safety Office), Ian Fraser (Safety Office), Karen Jack (Secretariat), Verna Keller (TRACE), Yvan Rodrigues (Graphics; Presenter), Kevin Paxman (Graphics), Peter Carette (UW Theatre Centre).

IST Attendees:

Trevor Bain, Peggy Day, Tim Farrell, Jason Greatrex (minute-taker), Bob Hicks (Presenter), Phil Knipe, Sandy Laughlin (Presenter), Pat Lafranier (Chair), Reg Leland, Giles Malet (Presenter), Keith Peck, Lisa-Tomalty, Carol Vogt (Presenter), Heather Wey.

Agenda:

PowerPoint Slide Presentation (please view)

Minutes:

Appendix A (post-meeting: copy of Nov 5 email from T. Bain )

Please note that disabling the antivirus realtime protection option (autoprotect) for network drives is not without risk. If you disable realtime protection on network drives, there is the potential that an e-mail infected with a virus or worm could arrive on your N: drive. You need to remain suspicious of any e-mail attachment that you have not requested and be aware that there is a risk in turning off the realtime protection for network drives.

For more details, read on:
Disabling the antivirus realtime protection option (autoprotect) for network drives is not without risk.

In the past, this action has not been recommended for those who store their e-mail on the N: drive (a network drive) because of the viruses and worms that arrive via e-mail. Realtime protection on network drives provided a mechanism to scan all incoming e-mails for viruses and deal with them accordingly. If realtime protection was turned off, a virus/worm would not be detected until the nightly virus scan of the file server was conducted. Because of the volume of data involved, it takes 5-6 days for the nightly scans to complete one pass of the file server. So, an infected file could survive in your inbox for nearly one week before the scheduled scan of the file server "discovers" the infected file and deals with it. While it resides there, it poses a risk -- you may inadvertently opening the attachment.

Since mid-December 2003, ClamAV virus scanning has been performed on e-mails prior to their delivery to the e-mail servers (e.g. admmail, watserv1, ist). The result is that the scheduled scans on the main academic support file server (jam) are picking up 1-2 virus infected files per week. The realtime protection statistics for academic support computers are showing a similar rate of return (only 72 infected files over the last 9 months). This is a significant drop from the numbers seen prior to the installation of the ClamAV virus scanning in December 2003. The current statistics for virus detection via ClamAV are enlightening and can be found at: http://mailservices.uwaterloo.ca/cgi-bin/minos-virus/display.pl

Why do infected e-mails make it past the server/ClamAV scanning?

1. In busy times, the scan can take too long, the process "times out", and an unscanned e-mail is delivered.

2. As with biological viruses, many viruses are slight variations of previous viruses. The virus software companies are continually monitoring these changes and updating their definition files accordingly. It is possible for a "new" virus to arrive in your inbox overnight prior to the ClamAV definitions being updated. By the time you read your e-mail in the morning, both Symantec and ClamAV may have definitions that will detect the virus but the infected e-mail has already made it past the ClamAV scan. Your only software defense at this point is your local workstation antivirus software (Symantec Antivirus).

If you disable realtime protection on network drives, there is the potential that an e-mail infected with a virus or worm could arrive on your N: drive. The number of worms/viruses getting through to your inbox may be low, but it only takes one to cause you enormous grief. You need to remain suspicious of any e-mail attachment that you have not requested and be aware that there is a risk in turning off the realtime protection for network drives.

Appendix B (Presentation by Giles Malet, IST)

SPAM & UW Mail

3rd Nov 2004

Typical path of e-mail:

     sender's system ---> UW Mail cluster ---> admmail/watserv1

Tests we perform

On the cluster On the destination server We also do greylisting on some servers.

Compare to commercial system

For example: Sophos.
At least 95% of your spam should be detected as such, but overall quantity is increasing, and thus the number of msgs undetected.

Statistics

For the End User

Conclusion

We're doing about as much as we can to reduce spam at the campus level -- further changes will increase the false-positive counts, and cause more annoyance. Only individuals can make a significant difference, as only they know their e-mail (what can be rejected etc.), and use that to build better filters.

Minutes by Jason Greatrex.

Last updated by Pat Lafranier, pllafran at uwaterloo.ca, November 9, 2004.

Keywords: (none)