ITPAC Meeting Minutes: August 21, 2008
Last edited November 13, 2008 by Steve Lasley.
- Jump to Items for Administrative Notice.
- Download and print Meeting Agenda [28KB doc].
- Listen to Streaming Audio archive of the meeting.
Agenda
- Approve Prior Minutes
- Administrative Updates
- ICC Updates
- Web Policy as an IMM
- RDU Formula
- IT Updates
- Other Discussion
Call to Order
This meeting was scheduled in McCarty D, room 1031 at 8:30am on Thursday, August 21, 2008. The meeting was called to order by chairman Allen Wysocki.
Attendees
Eleven people attended this meeting locally with two attendees via Polycom videoconference.
Thirteen members were present: Dan Cromer, Keith Gouin, Brian Gray, Steve Johnson (via Polycom), Joe Joyce, Steve Lasley, Mary Anne Morgan, Sheri Munn, Dave Palmer, Pete Vergot (via Polycom), Wendy Williams, Ashley Wood and Allen Wysocki.
Two members were absent: Michelle Quire and Brandon Segermeister.
Audio Archive
An archive of audio from the meeting is available.
1.) Approve Prior Minutes
The minutes of the last meeting were approved without dissent.
2.) Administrative Updates
2.1) How changes in UF IT administration may relate to IFAS
2.1.1) Chuck Frazier appointed as Interim CIO for UF
Dr. Joyce noted that Dr. Frazier has been at UF for a long time and that we have had a good working relationship with him in the past that is expected to continue. Joe and Dan Cromer met with Dr. Frazier last Tuesday to discuss how he sees his new role. Chuck indicated that UF does intend to hire a permanent CIO and that his current position will entail a transitional role.
2.1.2) Cooperation will remain the theme
Dr. Frazier had served in this role for UF previously under the Provost's office from 2001-2004 [200KB pdf]. In working with Dr. Frazier back then, Dr. Joyce indicated that their philosophies were similar in that both wanted to solve IT issues centrally only when doing that made good sense from both a service and cost standpoint. If the same or better service could be supplied centrally at the same or less cost, then movement in that direction should be encouraged.
2.1.3) Not all centralization proposals hold merit
Dr. Joyce gave the recent example of two proposals to centralize our WAN and LAN groups. The WAN proposal was deemed to make sense from a service/cost standpoint and we are in the process of that transition right now. In the case of the LAN proposal, CNS indicated that they could not economically provide the services we currently provide for ourselves; they estimated it would cost at least $100,000 more for them to do that. Consequently, we did not accept the LAN proposal.
2.1.4) IFAS to assist CLAS in transition to UFAD and UF Exchange
While Dr. Joyce does not see Dr. Frazier as supporting a UF-wide take-over of all IT services, we will work with Dr. Frazier and the rest of UF to cooperate for the good of all. For example, Dan Cromer is currently helping out CLAS via arrangement with Dr. Bernard Mair, their Associate Dean of Information Resources & Technological Programs. Chris Leopold's group is supplying technical support to assist them in moving to UF Exchange and UFAD. Paul D'Anieri, the new Dean for CLAS has apparently earmarked this as one of CLAS's IT priorities.
2.1.5) IFAS IT remains a leader on campus
Dr. Joyce reminded the committee that our IT group has been and remains a leader on this campus. When quarterly security analyses are run, IFAS performs consistently at the top of our peers.
2.2) Budget situation
Dr. Joyce indicated that his office has no additional budget forecasts that haven't been addressed by the news media. Governor Crist is looking into tapping reserve funds to cover about half of the shortfall this year. That shortage is expected to be $1.8-$2 billion. That kind of a cash infusion, if it happens, would not involve recurring funds; thus the budget issue is something the legislature will still have to deal with down-the-road.
2.3) New Listserv policy
2.3.1) ITPAC sub-committee provided input
Dr. Joyce related that a special sub-committee of ITPAC had been called since our last meeting to look into our Listserv policies--in particular the appropriate use of IFAS-Announce-L. Due to concerns over the effort which moderation would require the sub-committee was in favor of leaving things as they were.
2.3.2) Conforming to best practices of other UF colleges
Dr. Cheek requested that Joe look into what policies other colleges at UF might have in place. The College of Medicine maintains lists which are similar to our IFAS-All-L and IFAS-Announce-L but their announcement list is moderated. They also have very detailed E-mail list policies and procedures with which it was decided we should align. Consequently, a proposal was drafted to amend the IFAS Electronic Mail IMM by adding an item regarding Listserv as follows:
d) E-mail distribution lists (Listserv)
The Office of Information technology will support access to a central e-mail distribution application to simplify sending messages to groups. Those requesting the distribution lists are responsible for maintaining them as owner; there may be more than one owner, editor, or moderator for each list. Group lists may be configured to require approval by moderator before being distributed or be approved by the sender after confirmation. As required in 2a above, all lists are created for the purpose of conducting official UF/IFAS business, and messages must conform to UF Acceptable Use Policy, with subject matter limited to that of UF or IFAS policy or procedures, senior level personnel changes, meetings, conferences, seminars, or to convey emergency information. Messages concerning matters of a personal or editorial nature are inappropriate. The IFAS-ALL-L list is reserved for use by the SVP and Deans' offices only, and subscription membership is required for all IFAS faculty and staff. Other lists for general announcements to a large group of recipients, such as IFAS-Announce-L (subscription optional) and IFAS-Faculty-L, will be moderated by those designated by the SVP. The current list of distribution list archives is at http://lists.ifas.ufl.edu.
2.3.3) Moderation concerns addressed
In previous communication on this matter, Steve had indicated his support for moderation of IFAS-Announce-L, provided:
- a clear statement of appropriate use is publicly available (to guide moderation and avoid potential moderation vs. censorship debates) and
- IT staff are excluded from the moderation task (as moderation is not a technical role).
2.3.4) Appropriate use clearly and publicly detailed
The proposed addition clearly details appropriate use. Also, Dan Cromer indicated that there is a "List Server" link at the top of the IFAS Directory page which takes one to an index page for the major IFAS lists. Dan's intention is to include information there about this matter in addition to the IMM itself. That way, when people go there to see about how to sign-up for the list, etc., they will be presented with the pertinent information relating to this policy. This is similar to how the College of Medicine handles their Announcements List and brings IFAS in-line with best practices of other colleges at UF.
2.3.5) Moderator responsibilities ultimately rest with the VPs office
Details of how moderator responsibilities would be assigned were specifically not added in order to avoid the necessity of editing the IMM as personnel changed. Joe said that initially the IFAS-Announce-L list would probably be moderated by Dan Cromer, Paul Willis and himself. Dan Cromer shared Steve's concern that moderation was not an appropriate IT function but indicated that any situations which were unclear could be deferred to Joe.
2.3.6) Further action deferred to VP Dean's meeting
After discussion and general agreement by ITPAC Joe said he would take this proposal to the VP Deans' meeting for their decision.
3.) ICC Updates
3.1) No new formal recommendations to offer
Steve believed most of his input today would involve the other agenda topics and that he would work that in with discussion on those.
4.) Web Policy as an IMM
4.1) The policy proposal has been discussed at length in various forums
Dr. Joyce passed out copies of the latest proposal revision [48KB doc] and it was noted that this matter has been well discussed prior at ITPAC having passed detailed consideration by the ICC.
4.2) Concerns over the ability to track virtual visits
4.2.1) Available tools have difficulties at the folder level
The only concern which Joe had heard against the proposal involved our ability to tabulate statistics under this new policy. Dave Palmer spoke to that, indicating the Web Analytics Committee which he chairs had tried using our current tools (Urchin 5) along with newer versions of those tools and was unable to track statistics, specifically "visits", at a folder level.
Addendum from the Web Analytics Committee meeting held later this same day:
A "visit" is not well defined and each analytics package uses a different and undisclosed method to calculate those. The idea, however, is that a visit is akin to a path taken through a site; this is a much more difficult entity to measure than simple accesses or "page hits", but presumably offers greater value in that it is more closely analogous to physical contacts via extension office visits by clients.
Dave Palmer wants to ensure that tracking requirements do not conflict with these policies or our stated need to consolidate our web sites as the first step towards making them manageable. Consolidation involves moving certain sites that are currently under their own domains (such as the numerous course sites previously discussed at ITPAC) to sub-folders within existing departmental and unit sites. Consolidation is supported primarily by the proposed Domain Policy [72KB doc], however, not the Web Policy which was passed previously by ITPAC and is once again on the table currently.
4.2.2) Implementation of the new RDU formula being proposed will not require tabulation of folder-level "Web Visits"
Addendum from the Web Analytics Committee meeting held later this same day:
Concerns over the ability to track things relate to the previous need for certain faculty to report client usage of web-based materials via Unifas. Replacement methodologies for such tracking are currently being considered by Diane Craig of PDEC, but she has essentially ruled out asking individual faculty to report on that due to the complexities involved. Rather she is now investigating aggregating web visits across only those specific sites which have clear extension purposes. This obviates the requirement for visit tracking at the folder level--at least with regards to the DRU formula--and brings those reporting needs and capabilities in-line with our consolidation goals.
4.3) Successful web presence rests on its overall manageability
4.3.1) Proposed policies conform with those of other universities
Ashley Wood stated that the other universities which they have investigated have similar Web and Domain policies to those which we are proposing. All seem to agree that such policies are necessary steps toward organizing and maintaining a successful web presence. The analytics tools used at other universities run the gamut and some are very expensive, but other groups do not indicate having problems satisfying their web usage reporting needs. Ashley's contacts at other universities have clearly indicated policy-supported consolidation as a necessary ingredient to success.
4.3.2) What impact would policies have on current IFAS sites?
Joe Joyce asked Ashley what was the biggest impact that the proposed web policy would have on our existing site. Ashley responded that the policy would give the IFAS Web Team Advisory Committee the power to enforce uniformity in our web identity standards. They will be able to tell people when their web site does not conform to UF/IFAS standards with regards to identity, placement and management. This may affect on the order of 250 web sites that are currently out of compliance. Beyond that, the goal is to apply ownership to all IFAS websites along the same lines which we do currently with EDIS documents.
4.4) Solutions For Your Life (SFYL) as a model for necessary web statistics
Ashley spoke about the reporting capabilities that Urchin is currently providing SFYL. That data includes a ranking of topics within SFYL which is useful in tracking the relative importance of those to our clientele. He believes Urchin is meeting our needs in that regard. Wendy Williams stated that we should look on how SFYL reporting is being done and whether or not similar methods will work elsewhere. The main difficulty, both Wendy and Ashley agreed, is that most of our faculty are unable to indicate exactly what data it is that our reports need to supply.
Dan Cromer noted that he did not have the expertise to speak to how Urchin functions; however, the raw information for any type of analysis is contained in the logs we maintain. Pulling that out can only be a question of the tools used. Despite the relevance of the available data to the usefulness of the SFYL site, Dave Palmer and Brian Gray both noted that Urchin works on the site level and the statistics it aggregates across a site are not aggregated to the same level of detail at each subsequent folder level within a site. It does, however, track "hits" at all levels - that is, it can tell you how often a particular file was accessed.
Addendum from the Web Analytics Committee meeting held later this same day:
Considering current thought regarding implementation of the new RDU proposal as well as certain faculty input on which stats are most important to them, page hits may be sufficient for our administrative needs.
4.5) Our faculty need support for publishing via the web
Steve pointed out that a great deal of resources are expended by individual faculty members at various units in creating and maintaining web sites. Many simply avoid doing that due to the complexities involved and most would appreciate being able to focus on the content and not having to concern themselves with the technical details involved. If we can be successful in consolidating and organizing our web presence into a structure which can be supported by a content management system, the overall efficiencies of providing web services centrally could more than justify the necessary expenditure for setting up and maintaining a content management system. This is a huge step to take, however, and IFAS needs a policy to support movement in the proper direction; that is the first step towards our web presence meeting the stated goals of administration regarding future communication with our various clients.
4.6) ITPAC supports the adoption of the proposed Web Policy as IMM
Dan Cromer pointed out that the only reference to Domain Policy within the proposed Web Policy [28KB doc] involves the statement: "Web site requests should be in accordance to the UF and IFAS Domain Name Policy (currently being drafted)". Ashley further mentioned that this Web Policy by itself could provide great assistance to the web team even without the consolidation aspect inherent in the proposed Domain Policy.
Consequently, Steve Lasley recommended and it was seconded that this committee support the presentation of this Web Policy to the Deans' for adoption as IMM. That motion was passed without dissent.
5.) RDU Formula
5.1) Proposed formula revision
5.1.1) IFAS hopes to include electronic contacts and publications
Dave Palmer provided a handout which he stated was basically the Web Analytics Committee's current recommendations for revising our RDU formula. This revision is intended to include the accounting for contacts via new electronic methods which IFAS hopes to utilize increasingly for communication with our clients. Administration wants to propose to the legislature that the RDU formula be revised to include such methods.
5.1.2) Revised formula and definitions have been developed
The front page of that handout [32KB doc] comes from Diane Craig and details the actual RDU formula being proposed. Pages two and three [32KB doc] attempt to define the various terms in an easily understandable fashion. The various types of electronic publications and technology-assisted contacts are iterated and defined. The RDU formula is designed to describe workload and the formula revision was based solely on that goal.
5.1.3) Analogy between existing methods and electronic methods is important
A major goal was to be as clear as possible so our legislators could easily understand exactly what it was we are talking about. The hope is to require little discussion on "why" we are doing this but rather permit administration to focus on addressing the politics involved without focusing on the technology itself.
5.2) History and workings of the RDU
5.2.1) How RDU came to be
Joe Joyce briefly explained how the RDU formula came to be. Linda Collins, UF's legislative affairs person, used to be on the Senate Higher-Education staff. For years, Linda wanted something for IFAS to use in calculating how the Research and Extension budget should grow over time - something akin to Fundable Student Credit Hours. From that desire, the research and development formula and its Research Development Unit (RDU) was eventually developed. In that formula, "Learning Participant" is weighted at 1.00 because it is considered directly analogous to a student sitting in a class; weights for other categories of activity were judged via estimated workloads relative to that.
5.2.2) Relating efforts to our Land Grant mission
The value of each RDU can be determined by dividing each year's Research and Extension expenditures by the total number of RDUs generated. While Extension is currently generating these numbers we are also trying to get all our specialists to report these numbers and contacts. We realize, and want the Legislature to realize, that Extension wouldn't have anything to distribute if it wasn't for the Research programs generating the information. That provides us an opportunity to relate back to our Land Grant mission.
5.2.3) How RDU works today
Tim Jones, Budgeting and Fiscal Policy Executive Director for the Board of Governors, e-mails Joe within the April-May timeframe requesting our numbers and what it generates in workload. Those numbers now come from Diane Craig and are forwarded on by Dr. Joyce. As a result, our Research and Development workload numbers show up under the Board of Governors' budget for Cost to Continue; it doesn't show up under the IFAS budget request at all. We utilize a three-year rolling average in these calculations. Should we have a large jump in these numbers (and they are bound to increase because of the work we do) we will have to justify that increase.
5.3) Discussion of formula details
5.3.1) Some new items are more easily judged than others
Joe stated that it seems reasonable in the new formula to rank an e-mail equivalent to a phone call or rank the development of a web site equally with the creation of a publication. He would have no trouble justifying those. The difficult one to determine, in his opinion, is the weighting of a web "visit". Dave Palmer responded that it is weighted at .01 currently and that could easily be set at .001 if that was deemed more appropriate. Dr. Joyce asked Dave Palmer for his Web Analysis Committee to do additional work to justify the weight value chosen.
The definition within the formula also discusses a "visit" as lasting at least 10 seconds; that duration is another aspect that could certainly be held up to question. Steve Johnson was concerned that the precision of this definition might ask too much of the tools we are using for measurement. Pete Vergot asked if any of the formula weights had been changed from the current RDU and Dave responded that they had not.
5.3.2) Which activities aren't covered?
Pete also asked if letters and mailing of bulletins, etc. were included in the formula. Dave Palmer said the former were not included and the latter were termed "Publications Distributed" from the faculty point-of-view, but they are not considered as "contacts" within the RDU formula. You get the credit for preparing materials not for distributing them. Unifas used to ask for those numbers, but that was for administrative purposes - not for the RDU.
Joe pointed out that we used to base publication counts on how many were printed and we had a warehouse of old and yellowing publications which had never been distributed. Now, we have print on demand and document downloads are available; this has led to cost savings and efficiencies, but these are examples of the sorts of distribution methods which we now need to track.
5.3.3) Which categories are completely new?
Steve noted that there are now seven categories and that "Web Visits" would appear to be the new addition. Ashley had also commented that "Web Visits" and how they are measured is an inexact science. Those details along with our stated concerns for measuring certain types of activity seem to make this the most controversial category for inclusion in the RDU.
Addendum from the Web Analytics Committee meeting held later this same day:
There was discussion, led by Diane Craig, on whether we should remove "Web Visits" from the RDU entirely. She was concerned about the validity of the numbers we could obtain and the difficulty we might have in accumulating those.
It was also mentioned that, in the current RDU formula, workload credit is given for creating a publication, but not for its distribution. A number of people on the committee felt that we might consequently want to reconsider the inclusion of "Web Visits". Dave Palmer, however, believed its inclusion was justified on the basis of the work needed to maintain a website.
The committee split in a vote on whether to keep or drop "Web Visits" from the formula completely. After hearing how fragmented our current web presence was, Diane Craig asked for lists of our current web sites and those which are currently utilizing Urchin for analysis. She hoped to get a better idea of the number of sites for which data would need to be aggregated in order to provide a reasonable measurement of our clients' "Web Visit" activity.
5.4) The collection of contact and publication data
Steve Johnson asked about how the information relevant to this formula would be collected now that Unifas had been discontinued. Joe responded that the system for doing that is being worked out by Diane Craig.
5.4.1) Tracking e-mail contacts
Steve Johnson noted that most of these things seemed reasonably easy to track without placing a great burden on faculty. He did note, however, that tracking every e-mail is something which he has not done; rather he uses estimates. Dave Palmer responded that methods of accounting for e-mail contacts vary widely across our faculty. Some people actually log those; others dump them into a folder for later assessment or merely estimate. Phone calls are done similarly.
5.4.2) Tracking web use by clients
Ashley Wood asked about where we want to collect web statistics - at the institutional or the faculty level - and how would that be done? Dan Cromer believed that we need information at both levels but that we should provide a report to the faculty rather than burdening them with the details of tracking. Joe said it is important for a faculty member to know whether or not their web information is being visited and, if it is not, to figure out whether that is due to people not knowing about it or it not being valuable.
5.4.3) Hits deemed more important than "visits"
Steve Johnson said that he doesn't care how many enter that "virtual door" at the web site, but he cares very much about who clicks on those individual documents which he has written. He finds those numbers very valuable and uses them in various reports to justify his work.
5.5) Approval of RDU revision for presentation to the VP Deans
Dan Cromer made a motion, which was seconded, that ITPAC approve the RDU revision which Dave Palmer presented for submission to the VP Deans. The motion passed unanimously, with Al Wysocki adding the caveat that we be able to provide the requested "Web Visit" data. Dave Palmer said that his committee would do further analysis on that and get back to Joe with the results.
6.) IT Updates
6.1) Transition of WAN responsibilities to CNS
6.1.1) The transition became official on August 18th
Dan Cromer noted that this Monday (August 18th) was the official date by which CNS began handling all our Wide-Area Networking (WAN) services. CNS has hired James Moore in the new position which was created to handle those responsibilities. This includes all data circuits going to every County Extension Office (CEO) and Research and Extension Center (REC).
6.1.2) IFAS IT staff will remain involved
Dr. Joyce stated that all negotiations and contacts with the providers out there are now handled by CNS. Dan added that District and REC IT Support staff still will need to diagnose issues to assure that the network is actually involved. CNS does not want to be called in for things such as the network cable having been unplugged from a computer. Once a problem has been determined to involve the network itself, then our staff will have to enter a request for service and monitor the resolution of that.
Steve mentioned that Chris Leopold had indicated CNS is expecting a higher level of diagnosis than Chris had anticipated. Dan responded that he hadn't heard that. He said that the exact procedures to be used are still evolving and we will have to monitor how that goes.
6.1.3) Transition problems
Pete Vergot related that Calhoun County had received a $500 bill from the phone company during a recent circuit installation because they had to remain on site for two days. Pete said this was something they hadn't seen in the past and that it was due to CNS refusing to come out to the site. Calhoun doesn't have the kind of budget to cover that expense and the County Commission's response will likely be "take out the router".
Dan mentioned that the transition of the WAN to CNS has been a bit "bumpy" at times and that Pete's example was one instance of that. When we started paying CNS for this support on July 1st, Quincy and Ft. Pierce were both in the process of converting to a different Internet provider. The CEOs at Collier and Calhoun both experienced some problems which were troublesome to resolve due to the transition and the fact that our processes had not yet been thoroughly worked-out. Dan doesn't expect similar incidents to occur in the future.
6.1.4) Concerns over the timeliness of network implementations
Pete noted that both Okaloosa and now Bay are both ready for new circuits; if we don't move fast on those, their offers of money will go away. Bay County is offering a full T1 if we can get a router installed; it has now been two months without movement on our part. Okaloosa has been waiting over a year for router reconfiguration.
Dan responded that it was a separate group within CNS that submits requests of the type Bay requires - not IFAS WAN support - and that he needed to get with them to see to it that they followed up. Apparently, that group is in a little bit of a transition also.
Dan said that the problem at Okaloosa involved wireless access in violation of UF Networking process. Pete disagreed saying that the Okaloosa site was no different than any other site within the district. Multiple IP addresses were ordered; they are sitting there with the DSL line waiting for a router and nothing is happening. What they do currently is physically plug and unplug the Polycom as it is needed; they can't use the Internet when the Polycom is in use. At one point, Claude said they needed site photos to proceed; there have been all sort of excuses, but no movement. Pete is now concerned with what will happen now bringing in CNS as a third party to this process. He is concerned that ownership for problem resolution might now be fuzzier than ever.
Dan responded that he was as frustrated with this as Pete was and that we simply don't have the staffing levels necessary to address all the issues as quickly as we would like.
6.1.5) IFAS will not hesitate to exit our agreement if service levels prove insufficient
Joe Joyce stated that IFAS has a Service Level Agreement with CNS on this. When we entered that agreement we indicated that we would be watching the level of service very closely. If it is going to cost us more for less service then we will go back the other way. CNS signed up and we give them money to manage this. If it isn't working then we need to go back and do it ourselves. When Dan responded that it would cost even more to do it ourselves, Joe said that we need these services and cost is the secondary concern. Dan asked that we continue to give this new service a trial and see how things go.
6.1.6) CNS is slowly taking over all network management for IFAS
CNS also manages all buildings which have converted to Wall-Plate. Since it is assumed that all IFAS departments on campus will move to that, and if the WAN transition is successful, CNS will eventually manage our entire network infrastructure.
6.2) Ft. Pierce and Quincy have improved Internet service
Dan announced that Ft. Pierce and Quincy have new Internet Service Providers (ISPs) and are now connected with a bandwidth of 10 Mbps. Ft. Pierce has the USDA on their campus who may be willing to split network costs in the same fashion that Pharmacy splits costs at Apopka. If that proves true we may be able to go to a 100 Mbps dedicated circuit there.
Wiley Horton is the phone representative for AT&T who has been managing our campus for 20 years. According to Dan, Wiley has indicated that AT&T is getting increased competition from other ISPs across the state and is consequently "sharpening their pencils". Consequently, it is expected that they will be reducing the cost of some of our service charges. If that proves true, we should be able to add a circuit to Hastings and Ft. Lauderdale. This is something we wanted to do to increase the bandwidth at those locations.
6.3) Barracuda default settings change
6.3.1) High volume users must first be contacted
Dan related that the default setting changes recommended in May by ITPAC have been proposed to and approved by UF Exchange. We are waiting on local computer support personnel to contact those of our users who would consequently see a large increase in messages quarantined. Mike Conlon has asked that each of these users be contacted personally and individually. Dan would prefer and has requested that UF Exchange consider using a script to change those users so they have the current default manually specified; this would prevent them from seeing any effect from a change in the defaults.
6.3.2) UF Exchange expectations only recently learned by the ICC
Steve noted that the ICC learned only last week that UF Exchange was expecting IFAS to switch all high-volume users from "Use System Defaults: Yes" to "Use System Defaults: No" before they would proceed. Consequently, Steve put out a plea to the ICC to get this done by the end of this month.
6.3.3) An attempt to prevent potential blocking of legitimate e-mails
Dan reminded the committee members that the current default settings are causing legitimate messages to be blocked; we have documented that with one of our faculty in particular who missed a couple of request for proposal messages.
6.3.4) Blacklisting to lessen quarantine bloat
Joe Joyce commented that he gets e-mails in his quarantine each day from the same senders. He wanted to know if there was a way to prevent seeing those at all. Al Wysocki responded that Joe could Blacklist those addresses within the Barracuda web interface by going to the "Preferences" tab and adding those individually. Once an address is Blacklisted, all messages from that address will be blocked.
6.4) Security continues to become a growing concern
6.4.1) Two IFAS privacy breaches discovered
Dan warned that we must manage our e-mail and the files stored on our servers to make sure that restricted data such as student information, SSNs and credit card information are not exposed. As part of a five-year major audit, our Information Security Office (ISM), Wayne Hyde, performed a scan of our servers looking for restricted data which was inappropriately exposed. Wayne discovered two files from two IFAS units which each contained 58 SSNs. The law requires that we notify those people and that has been done for those 116 individuals. CLAS, on the other hand had 12,000 students who had to be notified. The UF Privacy Office requires that the units involved pay the postage for these notifications and that they must be done.
6.4.2) Spread the word--security is everyone's concern
It is important for ITPAC to realize and spread the word that the laws are becoming more and more restrictive and that security of restricted data should be everyone's concern.
Joe added that because we discovered these and self-reported them, there are no penalties involved. Had these breaches been discovered from outside and the problems were determined to be rampant, the university could get slapped with some heavy fines.
6.4.3) UFIDs now considered restricted information
Al Wysocki asked if UFIDs were in the same category as SSNs. Dan responded that UFIDs had recently been categorized as "Restricted Information"; consequently, correlating UFIDs with names is problematic and as such needs to be protected from exposure. This doesn't mean that authorized individuals may not use them, but rather that electronic records containing those should be kept only in secure storage locations--not placed on a public share or kept unencrypted on a removable drive, for example.
6.4.4) Public folders within IFAS have been revised
Dan mentioned that individual unit public folders had recently been removed because of the security risk involved. IFAS still maintains a single IFAS Public folder ( \\ad.ufl.edu/ifas/public/ ) which can be written to by anyone within IFAS and read by anyone within UF. The contents of that were recently cleaned out, however, and people need to avoid posting any files there which contain restricted data. The ICC has recommended, and we are going to institute a practice whereby, files placed there will be deleted after 7 days. This step is felt to be important in order to enforce the idea that this area is inherently insecure and should not be used for file storage.
7.) Other Discussion
7.1) Backups at remote sites
With the hurricane season upon us, Pete Vergot asked if IFAS IT had any plans to help people out with backing up their data. Dan mentioned that certain CEOs have file servers termed Multi-Purpose Servers (MPSs) which are used for local file storage. We currently do not have any central backup for that. With low-speed circuits there is really no way to back up to Gainesville from those counties. Dan recommended that the DEDs buy external drives for their offices and train the staff to use those for backup.
Steve mentioned that Chris Leopold and Andrew Carey are trying to work backup into the plan for the next generation of MPSs, but the speed of the connection at many locations can make this essentially impossible in many cases. There are some real problems which we currently don't have the means to solve, but they continue to look at that.
Next Meeting
The next regular meeting is tentatively scheduled for November.
Items for Administrative Notice
- The IMM revision for Listserv was reviewed and approved informally; this will be considered next at a VP Deans' meeting.
- The proposed Web Policy, having been rewritten as an IMM [28KB doc], was again recommended for consideration by the VP's office.
- The RDU revision proposal [32KB doc] was approved by ITPAC and recommended for consideration by the VP's office.