Project ICE Department Coordinators Meeting May 11, 2006, 10:00 am 11:30 am Maxwell Dworkin Room 119

1
Project ICE!Department Coordinators MeetingMay
11, 2006, 1000 am 1130 amMaxwell Dworkin
Room 119

• Project Agenda and Updates Susan DeLellis (15
  mins)
• Email Management Retention Skip Kendall (30
  mins)
• Multi-Layered Secure Messaging Conference
  Room/Resource Naming w/Exchange - David Gipstein
  (30 mins)
• QA

2

Project ICE! Integrated Communications
w/Exchange

Building the Next Generation of Collaboration
Infrastructure
Email . Calendar .. Tools

Susan DeLellis, Project Manager Harvard
University Information Systems May 11, 2006
susan_delellis_at_harvard.edu
3
What is Project ICE!

Project ICE! Integrated Communications
w/Exchange Today - A replacement of our current
Eudora and Meeting Maker mail and calendar
clients with Outlook 2003 on the desktop for PCs
and Entourage 2004 for Macintoshes as well as a
robust web client for email calendaring
(OWA) Tomorrow A platform for delivery of
future additional integrated communications
services such as audio video conferencing,
instant messaging, voice mail and more!

4

Project ICE!

Pre-requisites for Exchange and Important Points
to Note

• Active Directory is a requirement for Exchange
  currently being planned implemented by NSS
  (Erica Cahill) We cannot begin Exchange
  migrations until AD is complete
• Microsoft Windows Exchange CALs are required
  for Exchange Most CA groups covered under
  Microsoft Campus Agreement (site_at_harvard.edu)
• Committed Groups are CA, GSD (staff/admin) and
  Radcliffe - _at_ 3,500 users
• Mail Migrations will be done in Phases
  (Department by Department) over a period of
  months
• Meeting Maker Calendar Migration will be
  one-time at the end
• Multiple Training options will be provided by
  CWD prior to migration - attendance is strongly
  recommended for all users!

5

Update Your Official Email Address
The new Email/Calendar system will have a
University-wide Global Address Directory

• User listings in the new Email system directory
  (called the GAL) will be based on the Harvard
  Official Email Address on Record with HR
• Many users have multiple email addresses
  aliases - For example, susan_delellis_at_harvard.edu
  , sdelelli_at_camail.harvard.edu, etc.
• To view your own current listing check the
  printed phone book or Online Directory lookup
  application  www.directory.harvard.edu
• Please update this information through your
  local Directory Contact
• Who is my Directory Contact?
• Directory contacts are locally based in your
  School or Dept.  To locate
• your contact
• Call the UIS Help Desk (617-496-2001)
• Email at uis_helpdesk_at_harvard.edu
• Call UIS telecom billing at (617-495-5457)

6

Plans for Future Sessions

• June Meeting
• Active Directory Update
• Demonstrations of the Microsoft Outlook
  clients on Exchange
• Desktop Migration Strategies
• Other Suggestions for future meetings?

7

Project ICE!

How You can Help

• Attend your local Staff meetings and communicate
  this project to your departments
• Read the emails information materials that are
  sent out
• Give constructive input/feedback to
  ProjectICE_at_harvard.edu
• Visit www.ProjectICE.harvard.edu for updates and
  things you can be doing now to prepare
• Start to clean out your existing CaMail Mailboxes
  File attachments, organize mail into folders,
  delete old mail
• Communicate that Microsoft Exchange is a very
  different system than what we have today for
  Email Calendaring the user will need to
  manage their mail and inboxes more closely

8
E-Mail Management and Retention

• Presented by
• Skip Kendall
• Senior Records Analyst
• Records Management Office
• Harvard University Archives

9
Records Management at Harvard

• University record definition
• . . . all forms of recorded information
  regardless of physical characteristics, created,
  received, recorded, or legally filed in the
  course of University business or in pursuance of
  the University's legal obligations. . . .
  including electronic mail.
• Disposal
• Records are not to be destroyed or otherwise
  disposed of except in accordance with procedures
  and schedules established by the University
  Archives through its records management
  program.
• Disposal does not mean the same thing as
  destruction
• Records are
• a University resource
• evidence of Harvards history and activities
• University property
• Harvard Corporation Vote of March 13, 1995

10
Records Management at Harvard

• Keep information as long as required, then
  dispose of it
• considerations for retention
• administrative value
• fiscal value
• legal value
• historical value
• advantages
• saves space
• improves access
• browsing is easier with fewer records
• reduces risk
• legal
• security
• helps document University history
• complies with University policy

11
Records Management Office

• Part of the University Archives
• Created by University mandate to ensure the
  prudent maintenance and efficient disposition of
  University records, consistent with sound
  archival standards, budgetary considerations, and
  legal obligations
• Develops the General Records Schedule and special
  schedules
• guides to the disposition of records
• determine how long to keep records before
• transferring them to the Archives, or
• destroying them
• provide legally-defensible means for the
  destruction of records
• Assists University offices with all aspects of
  records management
• Authorizes the destruction of University records

12
Retention and Disposition

• General Records Schedule grs.harvard.edu
• created as part of the Archives responsibility
  under the 1995 Corporation vote
• guide to retention and disposition of University
  records
• arranged functionally
• 146 series (types of records)
• many records you encounter are covered by the GRS
• policy working papers(1125)
• correspondence with other Harvard offices (1080)
• personnel records (0675)
• local, not University-wide
• you will not encounter most records covered by
  the GRS
• grade records (4050)
• transcript request records (4065)
• animal subjects protection records (3530)

13
Managing E-Mail

• Just like other records
• content matters - not format
• keep as long as needed, but no longer
• Not like other records
• volume
• casual medium
• high proportion of junk and personal messages
• Manage e-mail as it is received and sent
• the volume will be more difficult to deal with
  later
• both incoming and outgoing mail must be managed
• For retention purposes, do not store records on
  drives that are not backed up
• if local drives must be used, make arrangements
  to back them up
• this applies to all electronic records, not just
  e-mail

14
Managing E-Mail

• Folders and subfolders
• can mirror paper or electronic filing systems
  already in use in your office
• make it easier to find messages
• make it easier to dispose of messages
• use the dates on messages in conjunction with
  your filing system to easily find messages ready
  for disposal
• An e-mail about budget preparation should be kept
  2 years. Put it in a folder titled Budget
  Discussions and periodically check the folder
  for e-mails that are at least 2 years old.
• put dates on folders to know when to dispose of a
  group of related messages
• A search for a new staff member ends 6/30/2006.
  Put messages related to the search in a folder
  titled del_2009-06-30_SearchRcrds and put it in
  another folder with other messages waiting for
  disposition. Check the other folder periodically
  for subfolders ready for deletion or archival
  transfer
• Print and file when appropriate

15
Organize folders by type of record
Series numbers can be added to the name
Use date sorts to see what can be disposed of
16
E-Mail Retention and Disposition

• Most e-mail needs to be kept for a very short
  time, even if it is a University record
• personal e-mails and, arguably, spam are not
  University records and can be deleted at any
  time.
• If an e-mail will eventually go to a Harvard
  archive, print it and file it
• Printed e-mails should include
• the message
• metadata
• name of the sender
• name of the primary recipient
• the name(s) of any other recipient(s)
• the date and time of receipt
• any additional routing information
• the format in which the message was transmitted
• the date and time of transmission
• attachments
• Keep track of what has been printed

17
E-Mail Retention and Disposition

• Messages that can be destroyed immediately
• spam (0588)
• advertising (0588)
• personal
• any message where you can determine that someone
  else is the appropriate person to retain the
  record copy (9630)
• University or departmental announcements
  (recipients only)
• routine and/or trivial information
• message from co-worker to return a phone call
  (9620)
• informational request and response (9730)
• Messages that can be destroyed after a relatively
  short period of time
• budget discussions (0510, 2 years)
• arrangements for HR programs (0610, 4 years)
• routine facilities management (0340, 4 years)
• Messages that can be destroyed after a longer
  period
• legal advice (1350, 10 years)

18
E-Mail Retention and Disposition

• Messages that may need to be transferred to the
  Archives
• committee records (1030, 10 years)
• projects (1175, 5 years)
• discussions of issues related to the department
  (1150, 10 years)
• Messages that should be transferred to the
  Archives
• proposals for changes to University policy (1120,
  5 years)
• For many types of messages, printing and filing
  may be easiest and/or more appropriate
• archival records
• proposals for changes to University policy (1120,
  5 years)
• records with a long retention
• legal advice (1350, 10 years)
• records that may be necessary to keep a paper
  file complete
• personnel files (0675, 6 years after separation)
• projects (1175, 5 years)
• committee records (1030, 10 years)

19
RMO and Your E-Mail

• Advice
• help determine what kinds of records show up in
  your offices e-mail
• Schedules
• discuss application of GRS to e-mail
• create special schedules and discuss how to apply
  them to e-mail
• Filing
• apply paper or other electronic filing schemes to
  e-mail
• determine filing schemes
• Help RMO learn what records are found in e-mail
• Records Management Office
• http//hul.harvard.edu/rmo/
• 495-5961

20
Calendar Resource Naming Your Input

• Presented by David Gipstein

21
Whats in a Name?

• We would like to collect your input
• A standard is required
• Question What is important when naming calendar
  resources?
• Conference rooms
• Phone bridges
• Projectors
• Floating laptops, devices, phones
• Equipment
• Vehicles
• Etc.
• Input Please send your comments to
  ProjectICE_at_harvard.eduby May 30th.
• Lets take a look

22
Resource Listings - Today in MeetingMaker
23
Resource Listings Outlook 2003 with
Exchange(Example from ProjectICE! Development
Environment)
Resources
Out-of-Box Exchange Functionality
24
Next Steps

• Next steps
• Please send your comments to ProjectICE_at_harvard.ed
  u by May 30th.
• Scheduling Power Users Focus Group to be formed.
  Please let us know if you are interested
• Questions?
• Thank you!

25
Multi-Layer Secured Messaging

• Presented by David Gipstein

26
Agenda

• The Messaging Landscape
• Best Practices Deploy a Multi-Layer Secured
  Messaging approach
• Who sends spam and why?
• Global vs. CAMail Statistics
• Predictions
• E-mail Challenges
• Best Practices
• Message Routing Processing
• Message Filtering
• CAMail Message Analysis
• Best Practice Analysis Exchange CAMail
• Summary

27
The Messaging Landscape

• Spam / Phishing / Viruses are annoying and a
  security threat
• Best Practices are built around a Multi-Layer
  Secured Messaging approach
• A layered defense reduces impact from any single
  threat both at the server and desktop
• Viruses, worms, Trojan horses, malicious code
• spam, phishing, spear-phishing, spam bounce
  messages
• desktop, server, network security updates and
  patches
• denial-of-service attacks, directory harvesting,
  list harvesting and penetration
• Who is sending spam and why?
• Some Global Statistics
• 75-90 of all e-mail that most organizations
  receive is spam 2-6 contains a virus 1
• Best-of-breed anti-spam effectiveness is 95 or
  more 1
• Over 900 million viruses and 52.4 billion spam
  messages are sent each day 2
• In February, 9 of 25 new virus attacks were
  considered signature-busting 3
• Harvard CAMail statistics
• Overall Spam 58 Virus infected 1
• Predictions
• Spam volumes expressed as a of e-mail are
  leveling off and will not grow 1
• Spam effectiveness will remain about 95 for the
  near future 1

1. 4/25/06 Gartner, Inc. 2. 2005 The Radicati
Group, Inc. 3. 3/20/06 Commtouch
28
E-mail Challenges

• Customers

• Service Provider
• E-mail is mission critical
• E-mail must always be available
• E-mail maintenance is expensive and
  resource-intensive

• Technical Teams
• Security is a top concern
• Threats continue to evolve including from the
  inside

• Spam and viruses distract users from productivity
• Users want uninterrupted access to their inbox

Manage cost complexity
Secure, protect and deliver
Inbox value and access
Source Microsoft 2006
29
Message Routing Processing Best Practices
Inbound Mail Traffic
NOC MailHub Services
External Firewall
Internal Firewall

• MTAs (Mail Transfer Agents)
• GOAL Filter as much as possible
• Anti-Spam Scanning
• Anti-Virus Scanning
• Load Balanced

• Exchange Mailbox Cluster
• GOAL Deliver as quickly as possible
• Internal Anti-Virus Scanning
• N1 Configuration

• MAIL GATEWAY
• GOAL Drop as much as possible
• Recipient Validation, Aliasing
• RBL Filtering
• DOS Attack Defense
• Connection Throttling

Source Microsoft 2006
30
Message Filtering Best Practices
Spam Filtering
Content Filtering
Attachment Scanning
Body Scanning

• Virus Scanning
• Worm Scanning
• File Name Filtering
• Archive/.zip Files File Name Filtering,
  Traverse the archive

• Sender/Domain Filter
• Subject Line Filter

• Sender Allow List Check
• Spam Scanning

• Keyword Filtering
• Virus Scanning

Source Microsoft 2006
31
CAMail Message Analysis
Inbound Mail Traffic
Message Flow
32
Best Practices / Whats New!
Inbound Mail Traffic
Message Flow
33
Best Practices / Whats New! (Continued)
Inbound Mail Traffic
Message Flow

• Concern regarding False-Positives Gartner /
  Microsoft report organizations should expect a
  false-positive rate of 0.0004 or 1 in 250,000
  e-mail messages
• Example based on Gartner / Microsoft assertions
• If you received 100 msgs per day, 1
  false-positive would arrive every
• 2,500 days (6.8 yrs) based on 250,000 e-mail
  messages
• 1,0 00 days (2.7 yrs) based on 100,000 e-mail
  messages

34
Summary

• Spam / Phishing / Viruses are annoying and a
  security threat
• Best practices
• Deploy a layered defense
• Drop as much as possible at the gateway
• Filter out as much as possible prior to mailbox
  delivery
• Educate users
• Questions?
• Thank you!