Re: Who manages your antivirus.

[David Seidl <dseidl () ND EDU>]

We originally ran AV as part of our security team's efforts. In general, we
found that we were distanced from the day-to-day desktop support for the
University, and that caused issues in our support model. Driving regular
maintenance and monitoring from information security, rather than a desktop
management partnership inserted a gap

We have since switched to managing AV in our platform services team -
they're responsible for third tier support, and have overall responsibility
for our desktop management tools like SCCM and Casper. This means they have
a better overall match to desktop support and management tools, which we
felt matches where AV now sits.

Infosec still cares about infection rates and whether we're identifying new
malware, but AV is no longer the front-line defense it used to be.

Somewhat ironically, I managed our AV environment as a security guy, and
ended up owning it when I took over the larger group that I now manage.
Perhaps my answer should have been "pick a staff member and stick whatever
team they're on with it"!

David

David Seidl
Senior Director of Campus Technology Services
dseidl () nd edu | 574-631-7305

On Thu, Oct 16, 2014 at 11:58 AM, Jeff Borton <jborton () schoolcraft edu>
wrote:

>  I am trying to find a good balance of what the security team should be
> focusing on so my question to  this group is:
>
>
>
> For those of you who you who use enterprise antivirus management, is this
> managed by your Info security team, or other teams such as server or
> technical support at your organizations?
>
>
>
> *Jeff Borton*
>
> *Executive Director of Information Security & Networking*
>
> *jborton () schoolcraft edu <jborton () schoolcraft edu>*
>
> *734.462.4446 <734.462.4446>*
>
>
>
> [image: cid:image002.png@01CF177E.5A2F4840]
> <http://www.schoolcraft.edu/maps/livonia.asp>
>
>
>
> CONFIDENTIALITY NOTICE: This message and any included attachments are from
> Schoolcraft College and are intended only for the addressee. The
> information contained in this message is confidential and any unauthorized
> forwarding, printing, copying, distribution, or use of such information is
> strictly prohibited and may be unlawful.