Comments have been received that suggest that some sysadmins hold the view that divisions are independent entities and can run their systems any way they see fit. While it is true that responsibility has devolved to the divisions so has accountability, and there is a need for the University to have common policies in some areas. We need a policy document that allows sysadmins the freedom to run their systems in a way that best suits the needs of their divisions while at the same time to reconcile this with the needs of University as a whole. Many departments and faculties already have policies on network use and Eugene should get copies of these policies. If a security problem is identified, CNS will help.
Security is a serious problem in some departments.
Departments should be proactive in setting policy and working with CNS in response to specific situations. Perhaps the most obvious vulnerabilities could be summarized and distributed on a regular basis so that users know what to look for. The summary should be brief, user friendly, distributed widely and updated regularly. Scans will identify particularly vulnerable areas. If a Department is at risk through careless noncompliance, there should be a centrally enforceable means to correct the situation.