Service interruption on Friday, 18-Mar-16, starting at 5:00 p.m.

We need to perform off-line maintenance on a number of computing services in CBC, before the semester resumes. We will start work at 5:00 p.m. on 18-Mar-16. We will end all work by 12:00 midnight that evening, if not before. I will send out an email to all faculty, staff, and graduate students if our work is complete sooner than midnight.

We apologize for any inconvenience this will cause.

Thanks, Bruce

Flash ransomware vulnerabilities

The number of nasty things that can happen to systems with old versions of Flash is growing.  See this article for an overview.  Although Windows systems are the big targets, there is nothing stopping the technique described being used against Mac and Linux laptop and desktop systems.

We try to make 3rd-party software updates available to our Windows users, but the system is far from perfect.  The saving grace is that CBC Windows users are pretty good about not saving files on local drives.  So ransomware is not quite as dangerous.  However, for personal systems, or for systems not in the Chemistry domain, I strongly recommend that you check your version of Flash by going to here.  You should run the check found there from any of the browsers you use.

I just ran the check myself on one of my systems, and I see that the Adobe site is not completely clear about whether the version I was using was out-of-date on not.  (It was out-of-date.)  You can reference this page to see what the current version is for your OS and browser.

Checking your laptop for encryption

OSU-owned laptops used by faculty, staff, and students must, whenever possible, use whole disk encryption to protect data stored on these devices. There are a few products, for example on some high-end ultrabooks, that perform data encryption at a hardware level. However, almost all Windows laptops running Enterprise versions of Windows 7 or 8 can support the use of BitLocker. Mac OS X Lion or later can support the use of FileVault 2. Both of these products perform whole disk encryption.

To see if your Windows laptop has already been encrypted, do the following:

  • Go to the Start button, and in the Search box type ‘BitLocker’. Click ‘BitLocker Drive Encryption’ when it appears on the Start menu.
  • You will see the C: drive listed. If to the right it says, “Turn off BitLocker”, then the drive is already encrypted. If to the right it says, “Turn on BitLocker”, then you should contact CBC Computer Support. Please note that you can turn on BitLocker yourself, but if we help, we can show you how to store the recovery key securely.

To see if your MacBook or Mac Air has already been encrypted, do the following:

  • Click the FileVault tab in the Security & Privacy pane of System Preferences.
  • If you see a button that says “Turn Off FileVault..” your Mac is already encrypted. If you see a button that says “Turn On FileVault..” then you should contact CBC Computer Support. Please note that you can turn on FileVault yourself, but if we help, we can show you how to store the recovery key securely.
  • For older versions of OS X, you should contact Computer Support for assistance.

See this support doc for more information about FileVault.

If your laptop is already encrypted, do not decrypt it. If you possess a paper copy of your recovery key, do not tape it to the body of the laptop, or otherwise store it together with the laptop.

Content display problems during video conferences

Over the last few months, we have experienced two failures when attempting to display presentation content to remote sites for seminars hosted in MP2015.  We have identified the causes of these failures.  In the first case, Computer Support staff made a mistake when setting up the Polycom in MP2015.  I’ve clarified operator instructions to avoid repeating that mistake.  In the second case, the tech staff did everything they were supposed to do to setup and test the connection ahead of time.  However, the guest speaker’s Mac Air would not adjust its display resolution to match any of the many compatible modes required by the Polycom graphics processor.  This was the first time we have encountered this problem.  Computer Support staff  delayed the start of the seminar by 10 minutes while we attempted, without success, to correct it.

Because some of these seminars are very critical, requiring participation by faculty, we will in the future make the following adjustment to our video conferencing setup procedures:  Since it is unreasonable in many cases to expect seminar speakers to use our laptop to present, we will always attempt to use the speaker’s laptop if asked.  However, if we encounter problems with display of content because of some incompatibility with the speaker’s laptop, we will immediately switch to using the Polycom’s camera, pointed at the projector at the presenter’s location, to display content remotely.  This is not optimal, but we believe this is a better approach than delaying a seminar start time and/or distracting the presenter with technical details.

Important note for hosts and event coordinators:  Please forewarn a speaker if you know that the seminar will be video conferenced.  Speakers should also be reminded to have a copy of their presentation files on a thumb drive or some quickly accessible cloud service so that Computer Support staff are able to move those files to our Polycom laptop in the event of more severe technical difficulties.  One example where this might be necessary:  The content not only fails to display remotely, but cannot be displayed locally even via a direct connection to the projector.

Asset and information risk management

There is a set of requirements from the OSU internal auditors and from OCIO Security that we must follow for computing equipment and data used by CBC:

  1. With the exception of consumables, all OSU-owned computing equipment and supplies that will remain on campus, and that are valued at more than $500, will require an OSU non-cap equipment tag.
  2. With the exception of consumables, all OSU-owned computing equipment and supplies that could potentially be used off campus, regardless of value, will require an OSU non-cap equipment tag, as well as a signed off-campus equipment form for each device.  The potential for use off-campus is not based strictly on intent.  For example, all laptops must be tagged, and all laptops must have a signed off-campus equipment form, even if they are intended to be used only on campus.
  3. Any OSU-owned mobile computing device that could potentially store restricted information, such as FERPA data, must be encrypted.  To clarify, this means that all OSU-owned laptops must be encrypted.
  4. We are required to produce a complete inventory of all software licenses and all installed software on all university-owned computing equipment in CBC.  This will necessitate the installation of a reporting client on every OSU-owned desktop, laptop, tablet, and server. Most customers use computers that are directly managed by CBC, and these computers already have such a client installed.  The majority of exceptions to this are for Mac OS X-based computers.  We will need to install, on every university-owned Mac in CBC, an inventory and remote management client from JAMF that will allow us to obtain an inventory of software on that system.

Video conferencing in CBC

Overview

CBC has two Polycom mobile video conferencing systems, as well as a fixed Polycom system in BI773. We also have a mix of cameras and mics to provide laptop or desktop video conferencing. Finally, we have a single Polycom phone that can be very useful for point-to-point teleconferencing.

We can provide video Polycom video conferencing in most conference rooms in CBC. We cannot provide this service in BI768 or in RF716. There is a single mobile Polycom unit that is dedicated to CBEC. The other mobile unit can be used anywhere in NW, CE, or MP.  We are unable to provide video conferencing support outside the buildings that CBC occupies.

We try to be adaptable with respect to software/system that is used.  We can support Skype, H.323, CarmenConnect, and Lync video conferencing.  Our subscription to BlueJeans allows us to interconnect some of these services.  Just ask us, and we can probably find a way to make a video conference work for your event.

Requesting support

To request video conference support, send an email to support@chemistry.ohio-state.edu.  The subject should clearly state that video conference support is requested.  For example, something like, “Video Conference Support for the Allen Group on <date>”.  The body of the email request should provide the following details:

  • When the conference will be held, both day and time. (Please note recurrence where applicable)
  • Duration of the conference
  • Where the CBC endpoint(s) of the conference will be located, e.g., a conference room or office room number and building
  • Who the remote participants are.  Email addresses for remote participants are required
  • The nature of service requested (BlueJeans, Skype, Polycom, etc).  Note: A request is not a guarantee of availability until you receive a confirmation
  • Whether the conference should be secured by password. This specifically relates to anything using BlueJeans, and should only be used if the meeting really requires it, as this will require additional technical knowledge at all endpoints.

Limits of service

We will in all cases always make a best effort to service requests from our users.  However, there are limits on what we can and cannot do to facilitate a video conference.  We list the following as limits on the service we can provide:

Lead time is required for a service request:  We need to have as much advance notice as possible of a video conference event where CBC Computer Support assistance is required.  Appropriate lead time is dependent on the type of service requested.  For example, 24 hours is required for a simple BlueJeans meeting request with no moderator that does not involve the Polycoms.  A request for in-person tech support requires 72 hours.  A request for an event that requires conference room scheduling, Polycom usage, and/or many remote endpoints requires one week.  We will attempt to service requests that do not provide this lead time.  However, lead time is usually required to allow us to perform prep tasks like contacting remote participant tech support, and scheduling a time and location on campus for testing the connection.

Set up time is required when using mobile Polycom:  We need at least 20 minutes prior to the start of a video conference to set up a mobile Polycom system.  Please bear this in mind when reserving time in conference rooms.

Connection quality of remote endpoints:  There is nothing that CBC Computer Support can do to improve a very low bandwidth or latent connection to a hotel room.  We have tested the quality of connections using BlueJeans on many occasions between end points both on campus and off campus.  As far as we can tell, the service quality is adequate if and only if all endpoints have good network connections.

Connection blockages due to remote firewalls:  This is another problem that is hard for CBC Computer Support to solve on behalf of remote endpoints.  Remote parties must address firewall rule problems that prevent successful video, audio, and/or content transmission.

Audio feedback problems:  These are often caused by poor quality, specifically highly latent, remote connections.  We strongly suggest that all participants using desktop or laptop endpoints keep a pair of headphones on hand.  The other alternative in this situation is to use a cell phone to call into the conference.  BlueJeans accepts telco connections.

Lack of technical knowledge at remote endpoint locations:  CBC Computer Support will of course try to help remote parties with their technical difficulties, but this is merely a commitment to best effort.

Lack of available conference room space:  Conference room space in CBC is currently extremely limited.  We will assist in any way possible when a customer requires a meeting space, but finding a free time in a technology enabled conference room is not the responsibility of CBC Computer Support.

Web Services Maintenance

Chemistry web services will be off-line briefly from 10:00 – 10:30 pm tonight so that maintenance can be performed.  This outage will affect the group, OPR, research, TWIG, and web servers.

Spam Whitelists sent via email

To assist users in the spam server transition Steve Fabian will be sending out copies of each user’s trusted sender lists (whitelist) today or tomorrow. You can paste these addresses into the new system’s white list.

Barracuda Whitelist Bulk Add Screen Grab

Since the new system uses different methods for classifying spam, it’s best to build your black list from scratch as needed. If you have concerns about your blacklist please contact computer support at support@chemistry.ohio-state.edu so we can address issues on a case-by-case basis.

Department SPAM filtering service changes

It is necessary for the Chemistry department to transition to a new spam detection and prevention mechanism.

The Borderware Spam Appliance in use by the Chemistry department (as well as several other departments in the college) is nearing end-of-life (October 2010). In addition, Arts and Sciences began offering Microsoft Exchange to departments early this year. This service offering includes a separate spam filtering mechanism using a Barracuda Spam & Virus Firewall.

Chemistry’s cost-sharing partner departments who have used the Borderware Spam Appliance are rapidly shifting all of their mail services to the Microsoft Exchange server offered by Arts and Sciences. As a result the Chemistry department is faced with the choice to bear the entire burden of licensing fees or to find an alternative solution.

Continuing maintenance is cost prohibitive for a single department. Steve Fabian has worked with Arts and Sciences to test use of their Barracuda Spam & Virus Firewall in conjunction with our existing mail services- a cost-free and effective solution. We will be moving to this solution next week. The transition to the new spam system will be completed on the evening of Monday, 8/30/2010.

If you use the quarantine server to check for mail flagged as spam, to configure spam detection parameters, or to whitelist or blacklist email sender addresses there will be some changes. These are outlined below:

* Old web interface login: https://hormel.mps.ohio-state.edu – we will no longer use this URL
* New web interface login: https://mx1.asc.ohio-state.edu – after the transition, begin using this URL to manage your spam settings and view quarantined mail
* As with the old web interface login, you will be able to access the new web interface using your Chemistry Department username@chemistry.ohio-state.edu email address and password as your login credentials.
* Your BorderWare Trusted/Blocked Senders lists will NOT be automatically transferred to the Barracuda Spam and Virus Firewall. The two systems use different methods to classify spam, so it is necessary for you to rebuild these lists on our new system. We recognize that this might present an inconvenience and we appreciate your patience and understanding.
* Finally, the Arts and Sciences Barracuda system has the added benefit of receiving and classifying a substantially greater volume of mail. The system has already intercepted and learned to recognize over a million spam messages since going live. This will provide better detection and prevention of spam over time.

If you have any questions or would like assistance with this new service or managing the transition, please contact us at support@chemistry.ohio-state.edu