<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span style="display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted1">ISO Security Operations has asked the ISO Infrastructure (Email) team to remove the Exempt-from-SMTP-AUTH rule on the campus SMTP servers
for Campus VPN users. </span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Currently, the campus SMTP servers allow anyone on the Campus VPN to send mail without authentication. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
This type of exemption has use cases for systems in internal networks. However, this exemption is not best-practice for user networks, including VPN. Users sending email through an SMTP server should be authenticating to send mail.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
Given that users should be using Google's SMTP or O365's SMTP through the IMAP/MAPI/Modern Authentication protocols and not our campus SMTP servers, this will have nearly zero impact on campus users.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
If there are any concerns with this requested change, please let me or the Information Security Office know via email (infosecoffice@ucr.edu). <br>
<br>
Thank you.</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"></p>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">---</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Jonathan Ocab |
</span><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><a href="mailto:jonathan.ocab@ucr.edu" target="_blank" rel="noopener noreferrer" data-loopstyle="linkonly">jonathan.ocab@ucr.edu</a></span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Manager, Information Security Operations</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Information Security Office</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">University of California, Riverside</span></div>
<p style="margin-top:0px; margin-bottom:0px"></p>
</div>
</div>
</div>
</div>
</body>
</html>