4 ms·

It's the perfect example of why security teams are often considered to be the least friendly, least approachable part of an already unapproachable department (I

by EwanToo 14y ago

It's the perfect example of why security teams are often considered to be the least friendly, least approachable part of an already unapproachable department (IT). Their reasoning seems to be "Google Docs causes us (the security team) hassle, we don't use Google Docs, so we'll shut it down". They might as well of shut down the whole of the Internet, for all their nonsensical reasoning, except they'd of been affected themselves then..

anonymouz 14y ago
No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking, had no alternative way of dealing with the phishing attacks effectively, they made the right choice in temporarily suspending Google Docs access.
- EwanToo 14y ago
  They could deal with the email issue in a number of ways, all of them causing the security, systems, and network teams hassle, but not end users. For example, blocking all outgoing SMTP traffic except via approved internal relay servers would make tracking these millions of unexpected outgoing emails much easier. Most organisations already put these kinds of restrictions in place, it seems Oxford don't. As far as I can see, their temporary blocking of Google Docs access did nothing but annoy users, cause them to lose face amongst users, and in the long term make users less likely to cooperate with the security team.
- betterunix 14y ago
  "no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not willing to push for a real solution, and instead went for a bandaid on a broken leg.
  - EwanToo 14y ago
    I also wonder why so many phishing emails are getting through the university spam filters - a slightly better solution might of been to remove links in external emails that point to docs.google.com. But anyway, I don't want to start slagging off a particular team that I've never met - maybe they wanted to do all sorts of other, smarter, things and weren't allowed, and maybe they'll be allowed to do them now..
    - jacques_chester 14y ago
      > I also wonder why so many phishing emails are getting through the university spam filters It's usually customised for each university.
      - EwanToo 14y ago
        I can believe it, I just don't know why it's not been customised to react to links to docs.google.com if it's such a high volume issue. It's not a trivial problem by any means, but from the network security team's blog it doesn't seem like they've taken many of the steps that I'd expect prior to cutting off a very high traffic website.
        jacques_chester 14y ago
        Time. There's the nice clever intelligent solution which could be developed over a few weeks, or there's the fact that the phishers have decided -- for whatever reason -- to go apeshit today.
        EwanToo 14y ago
        True, but in this case it seems like it's not a particularly new problem, just something that they've finally reacted to? They actually mention sinkholing spreadsheets.google.com in this post from August 2011 [1], they actually say "There are also some forms which are more difficult to block ( I don’t think we’d be too popular if we sink-holed spreadsheets.google.com for example)". So they've had the issue for years. 1 - https://blogs.oucs.ox.ac.uk/oxcert/2011/08/12/the-price-of-phish/ https://blogs.oucs.ox.ac.uk/oxcert/2011/08/12/the-price-of-p...
- jnazario 14y ago
  continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem. http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6112332&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D6112332 http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61... edited to add: here's the paper for you to read, i forgot i had a copy lying around. http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf
  - mcherm 14y ago
    Thank you for posting ACTUAL RESEARCH! Although I'll note that I didn't read the research since it's behind a $31 paywall.
  - freehunter 14y ago
    Just because you saw a small amount from Google Docs doesn't mean that Oxford isn't seeing a large amount, or large enough to concern them. If you're a researcher, you should know that you can't extrapolate your dataset to everyone.
    - deleted 14y ago
      [deleted]
- fnordfnordfnord 14y ago
  My own employer has farmed out the admin of student email accounts to Google (wisely IMO). The system had some initial glitches I admit. On a few occasions (if I'm not mistaken) Google banned email originating from their own system. In other news, many faculty use Google Docs for communication with students, and a lengthy disruption would be a big hassle, at least for me.
- martinced 14y ago
  "Google Docs are nowhere near as important" Sure. Which is why after so many people complained it is already back up. Did you miss the recent articles about how spreadsheets were essential to many people? I know many SMEs and individuals which are doing nearly everything besides email in Google Docs. And what do they use email for? To send PDF of Google Docs to those that don't have GMail accounts. In the recent "tools of the trade" for HN readers one of the webapp that came out the most often was Google Docs. It is also, quite arguably, seen all its functionalities and seen that it's made by a team of, what, 600 Googlers (!) the most advanced webapp ever. I think you really don't realize how important Google Docs has become. And it is growing by the day. There are people who create a GMail account only to get Google Docs after they've seen a demo of it.
- rmc 14y ago
  (e.g., Hotmail dropping all emails coming from Oxford) This can be a problem for universities in specific ways. Students get emailed some change to course work, all students using hotmail don't get the email, students then have a case to appeal the (possibly) worse mark they received.

by EwanToo 14y ago

anonymouz 14y ago

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking, had no alternative way of dealing with the phishing attacks effectively, they made the right choice in temporarily suspending Google Docs access.

EwanToo 14y ago
They could deal with the email issue in a number of ways, all of them causing the security, systems, and network teams hassle, but not end users. For example, blocking all outgoing SMTP traffic except via approved internal relay servers would make tracking these millions of unexpected outgoing emails much easier. Most organisations already put these kinds of restrictions in place, it seems Oxford don't. As far as I can see, their temporary blocking of Google Docs access did nothing but annoy users, cause them to lose face amongst users, and in the long term make users less likely to cooperate with the security team.
betterunix 14y ago
"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not willing to push for a real solution, and instead went for a bandaid on a broken leg.
- EwanToo 14y ago
  I also wonder why so many phishing emails are getting through the university spam filters - a slightly better solution might of been to remove links in external emails that point to docs.google.com. But anyway, I don't want to start slagging off a particular team that I've never met - maybe they wanted to do all sorts of other, smarter, things and weren't allowed, and maybe they'll be allowed to do them now..
  - jacques_chester 14y ago
    > I also wonder why so many phishing emails are getting through the university spam filters It's usually customised for each university.
    - EwanToo 14y ago
      I can believe it, I just don't know why it's not been customised to react to links to docs.google.com if it's such a high volume issue. It's not a trivial problem by any means, but from the network security team's blog it doesn't seem like they've taken many of the steps that I'd expect prior to cutting off a very high traffic website.
      - jacques_chester 14y ago
        Time. There's the nice clever intelligent solution which could be developed over a few weeks, or there's the fact that the phishers have decided -- for whatever reason -- to go apeshit today.
        EwanToo 14y ago
        True, but in this case it seems like it's not a particularly new problem, just something that they've finally reacted to? They actually mention sinkholing spreadsheets.google.com in this post from August 2011 [1], they actually say "There are also some forms which are more difficult to block ( I don’t think we’d be too popular if we sink-holed spreadsheets.google.com for example)". So they've had the issue for years. 1 - https://blogs.oucs.ox.ac.uk/oxcert/2011/08/12/the-price-of-phish/ https://blogs.oucs.ox.ac.uk/oxcert/2011/08/12/the-price-of-p...
jnazario 14y ago
continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem. http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6112332&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D6112332 http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61... edited to add: here's the paper for you to read, i forgot i had a copy lying around. http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf
- mcherm 14y ago
  Thank you for posting ACTUAL RESEARCH! Although I'll note that I didn't read the research since it's behind a $31 paywall.
- freehunter 14y ago
  Just because you saw a small amount from Google Docs doesn't mean that Oxford isn't seeing a large amount, or large enough to concern them. If you're a researcher, you should know that you can't extrapolate your dataset to everyone.
  - deleted 14y ago
    [deleted]
fnordfnordfnord 14y ago
My own employer has farmed out the admin of student email accounts to Google (wisely IMO). The system had some initial glitches I admit. On a few occasions (if I'm not mistaken) Google banned email originating from their own system. In other news, many faculty use Google Docs for communication with students, and a lengthy disruption would be a big hassle, at least for me.
martinced 14y ago
"Google Docs are nowhere near as important" Sure. Which is why after so many people complained it is already back up. Did you miss the recent articles about how spreadsheets were essential to many people? I know many SMEs and individuals which are doing nearly everything besides email in Google Docs. And what do they use email for? To send PDF of Google Docs to those that don't have GMail accounts. In the recent "tools of the trade" for HN readers one of the webapp that came out the most often was Google Docs. It is also, quite arguably, seen all its functionalities and seen that it's made by a team of, what, 600 Googlers (!) the most advanced webapp ever. I think you really don't realize how important Google Docs has become. And it is growing by the day. There are people who create a GMail account only to get Google Docs after they've seen a demo of it.
rmc 14y ago
(e.g., Hotmail dropping all emails coming from Oxford) This can be a problem for universities in specific ways. Students get emailed some change to course work, all students using hotmail don't get the email, students then have a case to appeal the (possibly) worse mark they received.