Re: blocking .ZIP attachments

["F.L.Ferreri" <f.ferreri () CSUOHIO EDU>]

Like others, we're blocking .zip files as well as *all* other executable
file types.  We don't look into the file, but allow/disallow the attachment
based on the file extension.

There was one professor who complained about not getting his .zips, but when
I explained the reasons and showed him other universities who were doing the
same thing, he accepted.  Since we exclude attachments based on file
extension, he can still get the files he wants from his colleagues if they
append '.csu' (for example) to the file's name.  The new file would look
like 'legitimate.zip.csu'.  The prof would then have to remove the '.csu'.

This has worked very, very well for us.  Virus infections are down to near
zero.

Fabian

- - - - - - - - - - - - - - - - - - - - - - -
F. L. Ferreri
Security Administrator
Cleveland State University
phone: 216.687-2160
fax: 216.687-9200

-----Original Message-----
From: The EDUCAUSE Security Discussion Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of John C Borne
Sent: Thursday, August 19, 2004 5:53 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] blocking .ZIP attachments

I apologize if this topic has been discussed before, but I couldn't find
any direct mention of this specific issue recently.

We have a problem with viruses penetrating the campus "under the radar" so
to speak. Before a new virus is detected and the anti-virus update is
written, received, and distributed, we have a window of vulnerability. In
the past we have lost a considerable amount of time repairing these
outbreaks. The vector for many of these infections has been through
attachments especially .ZIP's. At first we were intermittently blocking
.zip and other attachments; going back and forth between blocking and
accepting as each new virus appeared. We found that keeping the zip's
blocked had a big impact on minimizing the impact of new virii.

We've gotten to the point where we cringe at the thought of unblocking
.zip's and would like to make it permanent. Before I propose this to the
administration, I wanted to see if anyone could comment on whether they
are, or are not, blocking zip's and other attachments and if not, what
other solutions they have considered.

Thanks.

John Borne
Asst Dir for System Support
Computing Services
Louisiana State University

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.