Members
Joe Adamo (Computing and IT Center), Troy Bacon (AVP Finance and Business Affairs and Controller), Craig Berry (School of Visual Arts), Ginger Boone (University Union), Allen Bradley (Computing and IT Center), Sandy Burke (Computing and IT Center), Tim Christian (College of Arts and Sciences), Chu Chuah (School of Community Service), Wil Clark (UNT System Center @ Dallas), Jim Curry (Microcomputer Maintenance/Classroom Support Services), Cyndie Harris (UNT Facilities), Mike Hatch (College of Business Administration), Pamiela Hight (UNT Libraries), Elizabeth Hinkle-Turner (Student Computing Committee, Computing and IT Center),  Paul Hons (College of Education), Abraham John (VP Student Development), Scott Joyce (Universities Center at Dallas), Kirk Kelly (Housing), Brenda Kirk (Computing and IT Center), Maurice Leatherbury (Chair, Executive Director of Information Technology and Academic Computing), Mike Maner (Computing and IT Center), Gary Mathews (School of Library and Information Science), Dallas Newell (Registrar's Office), Bruce Pollock (ABN LAN Mgmt), Chris Strauss (Computing and IT Center), Brad Varcoe (Police Department), Mike Wright (Computing and IT Center), Yancey Yeargan (College of Engineering), Roy Zumwalt (Texas Academy of Math and Science)

Members Present
Joe Adamo (Computing and IT Center), Craig Berry (School of Visual Arts), Ginger Boone (University Union), Allen Bradley (Computing and IT Center), Sandy Burke (Computing and IT Center),  Tim Christian (College of Arts and Sciences),  Chu Chuah (School of Community Service), Wil Clark (UNT System Center @ Dallas), Pamiela Hight (UNT Libraries), Elizabeth Hinkle-Turner (Student Computing Committee, Computing and IT Center), Paul Hons (College of Education),  Maurice Leatherbury (Chair, Executive Director of Information Technology and Academic Computing), Mike Maner (Computing and IT Center), Gary Mathews (School of Library and Information Science), Chris Strauss (Computing and IT Center)

Guests
Richard Anderson (Computing and IT Center), Charlie Andrews (College of Education), Travis Brown (Computing and IT Center), Jim Byford (ABN LAN Mgmt), Patrick Dolan (Computing and IT Center), Dan Glass (Computing and IT Center), Richard Harris (Computing and IT Center), Lee Haughton (UNT Facilities), Krysta Kaye (UNT Libraries), Frank Lugo (Computing and IT Center),  Jason Myre (Computing and IT Center), Joel Phillips (College of Arts and Sciences), Charlotte Russell (Computing and IT Center), Curry Searle (college of Arts and Sciences), Dennis Scroggins (Computing and IT Center), Mitch Smith (Computing and IT Center),  Chris Stoermer (College of Business Administration), Yoke Teo (Computing and IT Center), Glenn Thorpe (Computing and IT Center), Mike Williams (Computing and IT Center), Scott Windham (Computing and IT Center), David Wright (College of Education)

Approval of Minutes
Minutes from February 20, 2004  were approved as written.

Remediation of Windows Servers after new worm/virus
Mike Williams reported on the Phatbot worm infections on the network.  Phatbot (also known at agobot) is a polymorphic virus/worm.  It is constantly changing.   There were approximately 350 to 400 infections on campus. 

Phatbot spreads through at least four different vectors but it is still unclear as to how this worm is spreading. Infected machines had local administrator accounts.  The worm enumerates the local users on the machines and does brute force password cracks to compromise the machine  If passwords are blank or are found in the worm’s list of passwords, the machine will become infected.  Areas that allow users to have administrator rights had big problems with the worm.  Areas that do not did not have much trouble.  The most common vector point for infection is through administrator accounts which had weak or no passwords.  Where possible, users should be given power user privileges rather than administrator level privileges.   It is also very important for users to be made aware that they must use strong passwords.  It is much harder for passwords that contain a minimum of 8 characters to be cracked. Network managers should encourage the practice of turning off machines at night.

Other information about the worm: 

• Phatbot overwrites host files and IP addresses.
  Phatbot exploits backdoors left behind by other viruses.
  Phatbot can do anything from opening ftp servers to sniffing passwords.
  McAfee will catch the worm, it changes its memory signature every time it morphs.  
  McAfee doesn’t catch the worm itself, but catches the activity that is generated. 

The number of viruses with risk assessment ratings of medium and high has increased significantly.  All users will need to be even more cautious.  Eventually a virus or worm will be released that will cause even greater damage than has already been witnessed.

The information security team provided a remediation checklist  which provides recommendations for remediating compromised computers.

Patch Management Group
Mike Williams reported on the status of the Patch Management committee.  The committee will be reformed and will be opened up to others to address patch management, antivirus and security issues as well as develop solutions. 

McAfee Firewall uses an install program that combines a firewall, antivirus software , and the E-policy orchestrator.  E-policy checks antivirus and policy.  If the box is not up-to-date it will not be allowed to access the network.  If it can be updated, it will be allowed on the network.  A simple command will block ports known to be used by viruses to propagate until McAfee comes out with a .dat file to take care of the problem. Mike will send more information about the group to netman.  

Security Video Broadcast 
Maurice Leatherbury reported that a Cyber Insecurity broadcast will air next Thursday at 1:30 in Chilton 245.  The broadcast will be captured and broadcast live.  Maurice recommended that network managers invite administrators (deans, chairs, department heads) to that they can gain a better understanding of security problems that affect higher education.Dan Updegrove is on the Educause Security task force and will be one of three panelists.

Microsoft Security Training
Maurice also reported that UNT responded to Microsoft's invitation to host free security training. June 24th and 25th have been tentatively scheduled as the training dates.  June 17^th and 18^th are alternate dates.  DCSMT will be informed as soon as the dates are confirmed. 

Adoption of Office 2003
Paul Hons announced that COE has had requests for Office 2003.  (COE has a basic computing course that teaches the  office suite but this course uses a specific textbook.  The next edition of the textbook will cover Office 2003.  The professor teaching the course has requested the installation of Office 2003 and other professors has also made requests. Paul asked if other areas were planning to roll out Office 2003.  SOVA has  been testing and has begun to rollout Office 2003.  They experienced a  few compatibility issues.  CAS experienced problems with MS Access.  COBA does not plan to update to Office 2003 at this time but may convert next summer.

Old Business
Maurice reported on LEARN and the statewide fiber optic network.  The group has been meeting approximately every three weeks.  Funds have still not been released by the Lt. Governor.  The UT System has been lobbying to make it work concerns are that plans have fallen victim to state politics.  UT System and Texas A&M systems will be funding (fiber and electronics) links between Dallas and Austin and College Station and Houston.  They believe other institutions will hop onto the network to reimburse some of the costs. +

Maurice also reported that the status of the National Lightrail project changes.  The state of Louisiana has joined and will fund $5 million to get onto the rail at Jackson.  AT&T donated 6000 fiber miles to the Southeast Research Association 6000 fiber  miles.  There will be costs associated with maintenance, however.  AT&T fiber does not come through Denton but CR Chevli worked a deal so that we could get a pop under the same contract at a cost of $40,000 for 20 year lease rights. 

The LEARN network is alive and well.  Dues have been paid by several members.  LEARN will meet again in Austin at the end of April.  

New Business
None.

Status Reports
Wil Clark reported that he is working on server and storage upgrades and wiring issues.

Tim Christian reported that CAS is working on getting a SAN donated from HP.  They are also trying something new-- contract management of computers. Tim also introduced Joel Phillips, a new computer support staff in CAS.

Allen Bradley reported that he has accepted a position as the UNT e-mail police.  He has been dealing with "everyone" mail that that is proliferating through the GW system.  Allen manually checks "everyone" messages and sends out general reminders about appropriate guidelines for sending messages.    There are no more restrictions than before, but senders are requested to include full signatures.

Maurice reported that E-mail guidelines were finally approved and that he sent a notice to everyone regarding the guideline.   

Richard Harris reported that he is working with the ITCHE group (Information Technology Council for Higher Education), which works with TxDIR to establish university friendly rules.  The group is pleased with the way things are going.  Presently, the group is considering the feasibility of consolidating some state agencies. 

Scott Windham reported that there were problems with the Tandberg links.  The problems were related to worm infections.  Some infections were causing the links to reboot.

Joe Adamo gave an update on Network Management.  The group is in the process of licensing computer associates software tools.  Adoption and use of the tools will allow testing.  A 60 day trial evaluation (involving EIS groups) will be conducted.  The desire is to have something published, accepted, configured and running shortly. 

Pam Hight reported that  Libraries was infected by Witty worm, causing two servers to crash and affected over 70 public workstations.

Pam also reported that she is trying to get E-Commerce established on campus. If anyone is interested in using E-commerce, contact Pam Johnson or Joey Saxon.   Forthcoming information will be sent to Maurice. 

Mitch Smith reported that he is working on browser support for PeopleSoft applications.   PeopleSoft officially supports a limited set of browsers:  Netscape 7 and IE.  Now that students are on-line, there is a need to support, at some level, Safari and other non-netscape branded Mozilla browsers.  Mitch is asking DCSMT to send opinions on what we should be supported. Send e-mail to msmith@cc.admin.unt.edu.

Sandy Burke reported that, as of yesterday, my.unt.edu went into production.  My.unt.edu  is the portal which will allow everyone to access admissions and fall financial aid.  On April 30, students will be able to register for the fall semester through the portal.  Training is now being conducted by the Registar’s office.  Contact Loreen Hamilton for more information. 

Lee Haughton reported that Facilities was infected with Phatbot. 

Charlotte Russell announced that Information Security acquired security awareness posters from Microsoft.  Interested network managers may want to post them on labs or other public places.   The posters will be available after DCSMT. 

Jason Gutierrez announced that GroupWise for Linux will be released soon. Contact Jason if you have any questions. 

Jason Myre asked if areas had begun the move to the GW 6.5 client.  Areas that have upgraded or plan to upgrade can contact Jason for assistance or training.  

Mike Maner reported that Datacom spent a great deal of time dealing with worms (witty, phatbot, and other bots).  Yesterday, there was a hardware failure on the core switch due to problems with the processor card.  Datacom turned off UNT's connection to Qwest due to a DoS attack on a UNT server.  

Chris Stoermer reported that the XP operating system is required for COBA's next version of mainframe emulation software.   

Chris Strauss reported that most of the Remedy related activity has been directed toward dealing with data integrated from EIS: Old records are missing data,  HSC students, UNT applicants, major codes and college codes will be added.  

Chris also reported that Axton Grams now works for New York Life and will be based in Atlanta. 

Travis Brown reported that over 250,000 records are now stored in ID Mgmt.  Travis also reported that the e-mail virus gateway stopped 50,000 viruses that were mostly zipped files.  Post fix is rejecting .exe files.  The volume of blocks has increased dramatically.

The meeting adjourned at 11:30 am.