Ironport

Approved 04/27/2011

Overview

This is a Service Level Agreement (“SLA”) between the campus community and ICIT to document:

Procedures and requirements for campus users making use of the individual Ironport anti-spam service, and
Procedures and requirements for ICIT support of the Ironport anti-spam service.

Service Description

Ironport is a network-based anti-spam service that uses an onsite appliance and a global spam evaluation system to identify and flag messages that are likely to be spam. Ironport discards messages that have a very high probability of being spam messages, and has the ability to place messages that are questionable into a quarantine that the user can examine and manipulate.

ICIT uses the Ironport service at the global level to block messages that have been flagged as nearly certain to be spam or malicious based on Ironport's global database of spam sources and signatures. This is done to prevent potentially harmful emails from reaching users’ mailboxes. Roughly 90% of the email directed at the campus on a daily basis falls into this category, and are blocked by Ironport before they get to individual email boxes.

Individual users may opt for an additional Ironport quarantine service. With this extra service, users will receive a report via email that lists potential spam messages in their quarantine. The report (issued daily or as needed), allows the user to quickly review what messages have been quarantined, and release for delivery any that are legitimate. Those not released for delivery will be automatically deleted after 14 days.

The UW-Whitewater Ironport Service allows three different levels of anti-spam filtering and quarantine aggressiveness: Low, Medium, and High. The default setting if a user does not request a particular setting is "High." The service further allows users to identify senders as either "safe" (not to be flagged as possible spam in the future), or "blocked" (always to be flagged as possible spam in the future).

Roles & Responsibilities

ICIT maintains the infrastructure and configures global settings for the Ironport service, but responsibility for managing an individual’s email messages resides with that individual. Below are a description of responsibilities relating to the Ironport service.

User Responsibilities:

Opt in to the Ironport quarantine service. This will be done initially by request to the Technology Support Center (TSC) Help Desk. Later versions of the service will allow users to opt indirectly on their own.
Review quarantine reports to ensure that legitimate messages are not being flagged as spam. If legitimate messages are marked as spam, release them for delivery and, if desired, mark the sender as a safe sender.
Adjust the desired level of anti-spam filtering if a large number of spam messages are getting through, or a large number of legitimate messages are being quarantined. This can be done by request to the TSC Help Desk. Later versions of the service will allow users to manipulate this information directly on their own.
Inform TSC of any significant problems or errors in categorizing mail.

ICIT Responsibilities

Maintaining the university’s infrastructure as related to operating the Ironport service.
Provide documentation and training relating to the Ironport service.
Promote the service as an anti-spam tool available to the campus community.
Monitor overall effectiveness of anti-spam infrastructure and adapt based on campus feedback.

Requesting Service

Students

Students will be automatically enrolled in the Ironport Quarantine Service at the "High" aggressiveness level. Students may contact the ICIT Technology Service Center to request modification of aggressiveness or removal from the quarantine service during the initial rollout. Future versions of the service will allow students to manipulate aggressiveness settings and removal from the service online.

Faculty and Staff

By default, faculty and staff email accounts are not configured to use the Ironport quarantine feature. In the initial version of the service, faculty and staff may contact the TSC to request that their spam messages be placed into quarantine. The default setting for faculty and staff opting for the Ironport quarantine is "High." Level of aggressiveness can be changed with a subsequent call to the TSC. Future versions of the service will allow users to enroll and manipulate aggressiveness settings online.

Hours of Coverage and Escalation Procedures

Service Requests

The TSC is the initial contact for all service related requests. Phone Number: 262-472-HELP (472-4357) or TSC@uww.edu.

The hours during academic sessions are:

Monday-Thursday: 8 a.m. - 9 p.m.

Fridays: 8 a.m. - 4:30 p.m. (Check Get Help for summer and extended hours.)

Service will be prioritized on the following scale:

Impact Level	Explanation	Examples	Initial Response Time
Impact Level 1	Campus-wide impact	Campus email delivery is delayed or suspended due to system failure	An initial contact will be made within 30 minutes.
Impact Level 2	Groups are affected	Campus email is being delivered, but mail is not being filtered due to system failure.	During business hours, an initial contact will be made in one hour.
Impact Level 3	Individuals are affected	An individual is having problems configuring their Ironport filtering settings.	Helpdesk will respond within one business day.
Information Request	Individuals need information on how to use Ironport	An individual does not know how to use Ironport quarantine.	TSC will respond within one business week

Impact Level 2 and 3 service requests will be handled during normal business hours. If a department/division does not receive a contact within the specified time for their Impact Level, an email should be sent to sla-ICIT@uww.edu.

Fees and Expenses

Ironport is provided to all Exchange email users without charge.