It appears around $2,000 worth of microphones have been stolen from the audio production area in Building 9 during the last teaching week of Semester.
The production areas are always busy during the last few weeks of semester when many staff and students are involved with audio and video productions. It’s hard to know what to do to reduce the risk of thefts from the area without compromising the access required to support teaching.
Several years ago the Technical Services Unit set up a student share on the Division’s Network Attached Storage Device (dcenas) so that lecturers, tutors and students in particular Units could share materials. One requirement of the system was that staff could share unit materials among themselves without students being necessarily able to see them. The TSU was convinced at that stage that WebCT or other services provided by ICT Services couldn’t handle the particular requirements of the Units.
Once set up, the facility was left in place so that the lecturers could manage the system without requiring TSU staff intervention.
Recently a student in one of the Units with access to the share discovered several folders within their unit folder containing marks for students. The student was able to open the files and read them. When a directory is created within another directory, by default the new directory inherits the permissions of its parent (permissions allow or deny certain users and groups of users access to read from and/or write to files in the directory). The creator of the directory can change the default permissions to allow or restrict other users’ read and/or write access to the directory. Anyone with the right level of administrative access can change the permissions on a directory to allow or deny access to users.
Staff should not store information they don’t want students to see on drives, shares, or volumes that students can access. The Division and the University have network storage for this purpose that can be shared between specified staff members securely: contact the Division’s helpdesk for further information.
A list of shares or volumes on Divisional servers that students have access to will be circulated to staff so they can assess whether they want to move any of their files to a more appropriate location.
Over the class-free period work was completed on the installation of the CardAX access system to teaching spaces in Building 5 and Building 9.
Although it is still early days yet, so far the installation, commissioning and operation seems to have gone smoothly, although there are some teething problems.
Some students where unable to access spaces where their unit number had been left off a list provided to Security, and one staff member with an old staff card was unable to access a room until his card was replaced with the new type. Some individual student cards did not operate the doors when the cards of others enrolled in the same unit worked: cards that fail need to be taken to Security for examination.
Some lecturers are still using keys to enter doors where the staff card should be used, and propping doors open. This defeats the purpose of the system somewhat: if there is a problem with access using a card (staff or student) that should work on the door, the issue needs to be taken up with Security.
Course Convenors should contact Security before the beginning of each Semester to advise them of who requires access to which spaces over the coming Semester. Requests should be provided for each space where access is required: listing staff names and staff id numbers, and unit numbers of students requiring access to the rooms (or names and student id numbers where there is no unit number applicable). Security should also be advised of any limitation on access, otherwise access will be provided during building opening hours, for the whole of the Semester.
ICT Services network people would agree that the network has a number of deficiencies that result from historical decisions made locally (rather than centrally) to provide local network services, or ad hoc extensions to the network, that now don't fit in and even conflict with the centralised system.
Recent security limitations implemented in an attempt to protect Windows PCs from malicious attacks have further limited the usefulness of the network.
Other restrictions in place to limit the amount of data that comes into the University (for cost reasons) also limit the range of services available to users.
Some examples of problems encountered include:
The University network is now less useful for teaching, learning, research and administration than it was say a year ago. Pushing the network to its limits (for example by using multicasting techniques to push installations out over the network, or streaming live television around the campus) is causing basic services like access to network storage, email and the web to degrade or fail when theoretically the network should be able easily to cope with the load of all of these services.
How is the University going to ensure it has the resources to keep up with or respond to the dynamic demands of teaching and research at a time when there is great interest and spectacular growth in bandwidth-hungry IP services like VoIP, Google Earth, video streaming and video conferencing? There is no (known) strategic plan for designing and rolling out network support for services (like audio and video services over IP, or video chat and conferencing) that require high bandwidth, on campus, nationally and internationally.
There is still no (known) operational plan or budget to systematically upgrade the network to remove outmoded legacy devices installed in good faith years ago that now impede the potential capability of the network to serve the University community.
As a Division we have had to invest recently in a number of devices to replace older equipment that now no longer serves us well, even though the responsibility for network support has been (quite rightly) ceded to a central service: we still have to provide resources to fix the problems because while ICT Services has the responsibility to look after the network it doesn't have the money.
The University Information Systems Management Committee (UIMSC) should investigate and address these issues.
In the past is has been customary to restrict undergraduate student access to Divisional facilities to business hours (9-5 on working days), or to building opening hours with written requests being sent to Security in advance detailing the times, the facilities and the students involved. Building opening hours are 6am to 10.30pm Monday through Thursday, and 6am to 6.30pm on Friday during teaching periods, 6am to 6.30pm Monday through Friday during non-teaching periods. Buildings are closed on holidays and weekends.
Increasingly there is pressure from media production and journalism staff and students to increase these hours, with one recent example of students staying all night in the video editing facilities to complete their assignments. The facilities were unable to be cleaned as a result of the students still working when the cleaners arrived at 4am.
Climate control is turned off outside of building opening times. Unless previously arranged (and paid for), there is no access, no climate control, and no cleaning or maintenance of buildings on holidays and weekends. Normal University hire rates for rooms out of hours is $28/hour + $22/hour for climate control + $7 for each lock/unlock. The climate control charge would probably cover a building as a whole, since it is unlikely Facilities and Services could or would heat or cool individual rooms separately. This estimates are based on some figures provided by Facilities and Services a couple of years ago and purport to cover the costs incurred in making the rooms available: electricity, corridor lighting and settings, water and so on.
Staff argue that increasing demands on students in terms of employment and work experience preclude their use of these facilities during regular working hours, so that the facilities should be opened up to them after hours and on weekends. This they say “will be increasingly important in 2006 when the affects of the recent university-wide course restructure result in larger class sizes and increased output demands for third year students due to expanded contact hours”.
Unsupervised out-of-hours access to Divisional facilities raises significant financial, security, health, safety and other duty of care issues that would need to be addressed if the Division were to extend the hours currently available.
At the very least the Division would have to commit to the additional costs of keeping a building open beyond the current building opening hours, and negotiate the proposed arrangements with Facilities and Services. It may also be prudent from a liability perspective to employ student monitors to look after the spaces on behalf of the Division during opening hours.
First, a definition. A “port” in network terms is a “logical connection place” where a program on a user’s computer connects to a server program. Ports are referred to by numbers, like port 25 (email programs communicate with email servers using port 25, among other ports), or port 80 (Netscape gets pages from World Wide Web servers over port 80 (usually)). As well as these and other well-known and standard ports, other server and client applications use dynamically-assigned ports to “bind” to in order to communicate with each other over the network.
Malware often exploits open ports by opening a connection between an infected computer and other devices on the internet without the user’s knowledge (on Windows computers anyway: most ports on Macintosh computers are closed by default and are only opened by the user initiating a particular application or service).
The University recently closed down most network ports in response to compromises to the local network from outside. Only known services (like official web and email servers) were allowed to continue to operate. ICT Services asked that where these restrictions prevented services from operating, contact them and the issues would be investigated.
Desktop video conferencing services like Apple’s iChat AV and Marratech eMeeting use a range of ports to dynamically connect participants through text, audio and video links. In order to create a good connection between users who might be on the other side of the world (and often are: that’s why these systems are popular), the various computers involved negotiate a “good” set of ports for each service from the wide range they might use.
iChat AV and eMeeting are (or at least were) used by staff to communicate with off-campus colleagues and collaborators. When the University's IT Security Officer was asked to open the ports used by iChat AV up again he declined, saying he was unhappy with the requirements and suggested there might be alternative more secure (but unnamed) solutions available.
While we had some success with eMeeting before the blocks were implemented, we haven't been able to commission the service since the ports were blocked and have stopped working on it until the ports it uses become available again.
Over the next month University contractors will be installing CardAX access to a number of rooms in Building 5 and Building 9. Security has advised us that there will be some noise and disruption associated with the installation of the card system when the installations begin in two or three weeks time. The contractor has been asked to keep the noise and disruption to a minimum but expect drilling, hammering and dust.
Please bear with this short-term pain in order to enjoy the longer-term benefits of giving students greater and more convenient access to Divisional facilities.
Proposed lab rules (based on existing practices and the new situation) that will govern the rights and responsibilities of the staff and students accessing the facilities are being developed and will be presented to the IT & Infrastructure Committee for discussion at its next meeting.
The University has (finally!) begun the transition between the old Honeywell swipe card access system used in a number of places around the Division, to the new Cardax system. The first phase of the transition is expected to be completed by the beginning of Semester 2, when all existing Honeywell controllers managing access to Buildings 5 and 20, and rooms 5B38, 5C44a and b, and 5C56 will be replaced with Cardax controllers. Eventually out of hours access to all of the buildings on campus will be regulated by the system.
After the rollout the Division can request additional spaces be regulated by the system: suggestions for any spaces that might be regulated by the new system should be sent to the Division’s IT & Infrastructure Committee for discussion. The Division will have to pay for the installations requested.
On Thursday 28 April 2005, someone tampered with the cables securing equipment in two of the Division’s labs: three new flat panel displays were stolen and a computer damaged in one of the labs.
The TSU is reviewing the security of the installations, but no matter how much is done to secure equipment, determined thieves will find a way to steal equipment, even though they destroy it in the attempt.
Staff must take responsibility for locking labs after use: keys can be requisitioned from Heads of School if required. Staff should also notify Security on x2222 if they notice any suspicious activity.
Since the spaces in Building 9 became the responsibility of the Division, there have been numerous requests for the rooms to be unlocked for scheduled classes and for casual use.
Often the doors have been left unlocked after the last occupant has departed.
The TSU does not provide security services, and staff needing access to these rooms should requisition the appropriate keys from their Head of School so they can access the spaces as required. They should also take responsibility for ensuring the spaces are locked when leaving.
The TSU has approached the University of many occasions to develop proposals for the installation of Cardax swipe card systems to access spaces around the Division (especially the Microteaching rooms in Building 5), but to no avail.
Swipe card access to a number of labs around the Division and to Building 5 and 20 failed late on Friday night and was unavailable for most of Saturday after a hard disk containing the information about who could access the various doors on the system ran out of disk space. While most access was restored on Sunday, some users who previously had been added to the system manually lost access. The manager of the Honeywell system that controls the doors is working on the issue.
At the same time it appears that the controller for doors within Building 5 has failed, and needs to be replaced before access to labs can be restored. Honeywell is working on the problem and expects to have the system fixed in a couple of days. In the meantime, the ICT in Education labs will be unlocked at 8.30 am and locked at 5.30 pm. Postgraduate students may need to contact Security to access their rooms if the cards don't work.
