MS Security Essentials and Forefront Client Security academic licensing

[Brian Smith-Sweeney <bsmithsweeney () NYU EDU>]

Hello all,

A number of higher-education security professionals have expressed some
concern over the licensing terms for Microsoft Security Essentials,
officially released late September.  The "Use" section of that license
includes the following language[1]:

"Use. You may install and use any number of copies of the software on
your devices in your household for use by people who reside there or for
use in your home-based small business. "

The REN-ISAC Microsoft Analysis Team[2] has been pursuing a
cost-effective antivirus solution for higher-education with Microsoft
for some time,  and so took it upon ourselves to get approval for the
use of Security Essentials for students in higher ed.  I am pleased to
report that we have received the following official word from Microsoft:

"   * PCs owned by an academic institution should use Forefront Client
Security (this includes faculty machines owned and managed by the
institution)
    * Students, teachers and others may use MSE on their personally
owned PCs.  If these machines are managed by the institution, FCS is the
preferred choice but Microsoft Security Essentials is still an option."

The second point - that student systems are covered by the MSE license -
is key.  In a year when many higher-education IT budgets are being cut
drastically we believe the availability of free anti-virus software for
students could be leveraged to significantly reduce AV licensing costs,
or allow those without an existing enterprise antivirus license to
ensure their students are protected.

I have asked MS to post this information on their website.  In the
meanwhile I was told by an MS representative that it was acceptable to
post this to relevant higher-education websites.

Those interested in pursuing the use of FCS on campus should talk to
your Microsoft representative.

I want to be clear that this is in no way an endorsement of one
anti-virus product over another, and neither I nor anyone else on the
MAT will be able to provide guidance on the relative effectiveness of
these products.  The goal of this project was to make sure there was a
cost-effective solution available to those that needed one.

Please let me know if you have any questions about the MAT or this
project.

On behalf of the REN-ISAC MAT,
Brian

REFERENCES:
[1] http://www.microsoft.com/security_essentials/eula.aspx#mainNav
[2] http://www.ren-isac.net/advisory.html#microsoft

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Brian Smith-Sweeney                      Project Lead
ITS Technology Security Services, New York University
bsmithsweeney () nyu edu
http://www.nyu.edu/its/security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~