Re: IRC policies

[Elliot Kendall <ekendall () BRANDEIS EDU>]

On 2007-06-06 07:47:14 -0400, Knowles, Richard N. CISSP PMP wrote:
> Are there any schools that are blocking IRC to curb 'bot activity?

We use some rules built into Snort to monitor IRC activity, but do not
block it outright. Once we confirm that a particular user is
legitimate, we whitelist them to avoid further alerts. This system also
allows us to identify and remediate infected machines. If you simply
block IRC, infected machines may be safe while they remain on campus,
but will start causing problems as soon as they're connected to a
different network.

I've been very surprised by the number of legitimate IRC users we have
on campus. I had thought IRC's popularity was on the wane, but many
applications with chat functionality use it as a backend. For that
reason, I would be very careful about blocking it completely.

-- 
Elliot Kendall <ekendall () brandeis edu>
Network Security Architect
Brandeis University

Trouble replying? See http://people.brandeis.edu/~ekendall/sign/

Attachment: smime.p7s
Description: