Re: Checking for AV software on students' machines

[Bill Frazier <frazier () IASTATE EDU>]

We are embarking on a project similar to that described by the
person from U Toronto.  I'm not familiar with the details of
the code, but the focus will be Windows and we'll use code
that returns current patch level.  As for AV software, our
intent is to check currency for common products (e.g.,
Viruscan, Norton, ...).  One difficulty with AV checking,
especially on student or visitor machines, is that the AV
software popular here is not likely to be installed on a
machine purchased in Korea, for example.  We have a large
number of such machines that appear on campus and it is
sometimes difficult to tell whether protective software is
present, let alone whether it is current.

Dictating the particular product is problematic for both
political and technical reasons.  Among the technical being
that blindly installing one AV product on top of another may
render the machine very safe.  Unfortunately, inability to
boot is viewed by users as a disadvantage.

__________________________________________________________________
On Wed, 09 Jun 2004 12:26:05 CDT, "Rivers, Christopher R" wrote:

I would be interested any any responses to this as well.

Many thanks,
Chris Rivers - CEH, A+
Technology Support Coordinator=20
Indiana University Kokomo=20
Department of Information Technologies=20
http://www.iuk.edu/IT

"He is no fool who gives what he cannot keep to gain what he cannot
lose." -- Jim Elliot  =20

> -----Original Message-----
> From: The EDUCAUSE Security Discussion Group Listserv=20
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Jeff Giacobbe
> Sent: Wednesday, June 09, 2004 12:13 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] Checking for AV software on students' machines
> =20
> Nathan-
> =20
> I unfortunately don't have an answer to your questions regarding
> verification of AV software on client machines, but I was wondering if
> you could provide some details on how you accomplished your=20
> first goal -
> verifying for patches before a student machine is allowed on=20
> the network.
> =20
> We are currently investigating ways to drop student machines into a
> "quarantine" VLAN if they are not up to the latest Windows=20
> patches, but
> so far have not found an effective way to do that check. Does your
> solution require some kind of pre-installed client agent?
> =20
> I didn't see anything in a previous thread, but if you've already
> answered that question my apologies. Any insight, advice,=20
> horror stories
> you could provide would be greatly appreciated.
> =20
> Thanks,
> =20
> Jeff Giacobbe
> Director of Systems, Security, and Networking
> Montclair State University
> =20
> =20
> Nathan Hall wrote:
> > Now that we have found a way to check students' machines for missing
> > patches before they are allowed on the network, we are=20
> looking to expand
> > to checking for the presence of updated anti-virus software. This
> > requires access to the students' machines, so we are=20
> looking at using a
> > web page with a .NET component to perform the check. A few=20
> questions:
> > 1) Is anyone else doing something like this currently?
> > 2) How have you implemented this (web page w/ ActiveX/.Net,=20
> downloadable
> > program...)?
> > 3) What do you look for to determine if AV software is=20
> present (registry
> > entries, services, running processes...)?
> > 4) How successful has it been?
> > 5) Pitfalls?
> >
> > Any other input would be appreciated too. Thanks in advance.
> >
> > Nathan Hall
> > System Administrator
> > SUNY Oneonta
> > Oneonta, NY 13820
> > (607) 436-2708
> >
> > **********
> > Participation and subscription information for this=20
> EDUCAUSE Discussion Group discussion list can be found at=20
> http://www.educause.edu/cg/.
> =20
> **********
> Participation and subscription information for this EDUCAUSE=20
> Discussion Group discussion list can be found at=20
> http://www.educause.edu/cg/.
> =20

**********
Participation and subscription information for this EDUCAUSE Discussion
Group d
iscussion list can be found at http://www.educause.edu/cg/.




__________________________________________________________________
Bill Frazier                                 frazier () iastate edu
Assistant Director/Software Support          voice: (515) 294-8620
Iowa State University                        fax:   (515) 294-1717
Academic Information Technologies, 291 Durham, Ames, Iowa 50011

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.