Re: IRC policies

[Anthony Maszeroski <maszeroskia3 () SCRANTON EDU>]

I monitor the volume of IRC NICK/USER registration requests and JOIN
requests via IPS. If that number starts rising sharply I start looking
for bot activity. I also monitor our Packetshaper for large numbers of
new flows per minute coming from any single host (excluding enterprise
and DNS servers). That usually catches any infected host that is
starting to attack. I'd rather catch the bad IRC activity than prevent
IRC from working altogether.

Knowles, Richard N. CISSP PMP wrote:
> Are there any schools that are blocking IRC to curb ‘bot activity?
>
>  
>
> Rich Knowles CISSP PMP
>
> University Information Security Officer
>
> Miami University
>
>  

-- 
- Anthony Maszeroski
-----------------------------------
Information Security Manager
The University of Scranton
email : maszeroskia3 () scranton edu
phone : 570-941-4226
-----------------------------------