CAN-SPAM Act of 2003

As most of us know, the CAN-SPAM Act of 2003 was passed into law on January 1, 2004.

In order to be compliant with this new law, we will provide certain information in all emails sent:

The recipient should be allowed to opt-out of any further emails from you or your company.
We will handle all unsubscribe requests within 10 business days of that request.
All of your emails will provide a way for the recipient to contact a real human being, or at least report problems/concerns via an address that will be read and answered by a human being.
All messages will include a "valid physical postal address of the sender".

As long as you provide accurate and valid contact information (physical address and email address), we can help your business stay compliant with the CAN-SPAM Act of 2003. Please be sure to visit your Admin page immediately to make sure your information is current. Beginning May 1, 2004, we will not be able to allow delivery of any Campaign Manager emails to your Prospects if our system detects that this information is inaccurate or incomplete.

Virus Protection

Objectives

The principal concern of this computer virus protection policy is effective and efficient prevention of network virus outbreaks and network security attacks involving computers associated with Auburn University. The primary focus is to ensure that Auburn University-affiliated users (faculty, staff, and students) are aware of and take responsibility for the proper use of Ramage Technologies, LLC. This policy is intended to ensure:

the integrity, reliability, and good performance of University computing resources;
that the resource-user community operates according to a minimum of safe computing practices;\
that the University licensed virus software is used for its intended purposes; and
that appropriate measures are in place to reasonably assure that thispolicy is honored.

Policy

Centrally provided virus protection software will be run on all web servers and on all computers connected with Ramage Technologies, LLC.

No executable or suspect files will be opened without prior authorization of a Security Officer of Ramage Technologies, LLC.

All suspect files shall be quarentined before available to the client.

All clients will be notified immediately upon discovery of a suspect file or virus.

A management structure and supporting guidelines and procedures has been defined and will be utilized by the Security Officer to implement the above policy and ensure compliance.

Goals

Prevent all infections. And when that is not possible, create an outlet for notification and annotation of virus outbreaks for University service providers and end-users so that future breaches can be prevented.
Prevent the loss of information/data and software and minimize the cost of computing maintenance and network downtime by virus outbreaks.
Create a system for automatic, immediate notification of the client once an outbreak has been detected.
Annually evaluate the number of virus outbreaks.
Provide and continue to support the best virus protection solution that Ramage Technologies, LLC can support.

Compliance

Virus protection is most effective if every computer of the thinktank network has anti-virus software installed and is actively monitoring network activities. The Virus Protection System used by our Security Officer will provide assistance in removing existing anti-virus programs from infected computers.

Service providers will monitor network activity and initiate appropriate action to control infection. Service providers have the responsibility to disconnect any server or client known to be an infecting agent. Such a disconnection is an emergency action.

The service providers, Clients or end-usesr will be contacted immediately, and Ramage Technologies, LLC will work with the service providers and/or end-user to solve the problem.

Registered Service Providers of Information Technology (RSP)

Registered Service Providers (RSP) of information technology are personnel who maintain any IT-related service for Ramage Technologies, LLC. A service may be thought of as any production server, any software distribution channels that exist, and any other services provided to users that have the potential for infection and dissemination of viruses. IT service providers are to be registered with the Ramage Technologies, LLC for the purpose of coordination and enhanced communications.

Registered Service Providers (RSP)

Registered Service Providers are responsible for system, site, or network administration server(s) configured with the intention and purpose of regularly providing services including e-mail (SMTP), FTP, Web hosting (HTTP), file sharing, or other services to multiple users (Ramage Technologies, LLC inclusive).

An RSP, in consultation with Ramage Technologies, LLC, can assume some or all end-user support responsibilities herein assigned to Ramage Technologies, LLC. Once these responsibilities are assumed by an RSP, Ramage Technologies, LLC is relieved of the responsibilities until such time as the RSP relinquishes those responsibilities, with the consent of Ramage Technologies, LLC, or fails to shoulder the responsibilities adequately as determined by the Security Officer of Ramage Technologies, LLC..

Registered Service Provider Responsibilities

Install and maintain anti-virus software on the servers that they manage. The administrator will determine the appropriate level of scanning (on-demand vs. active) based on the performance capacity and purpose of the server. At a minimum, on-demand file scanning must be installed and run on a frequent and regular basis. Administrators are encouraged to install active scanning, but are not required to do so at the expense of general server performance. In addition, administrators of SMTP servers will install email attachment filters, if available, to intercept well known viruses.
Ensure that they fully understand the configuration and operation of anti-virus software. They will seek assistance or training from Ramage Technologies, LLC or other administrators when questions arise about the proper functioning of software. If contacting the vendor becomes necessary, this will be done through appropriate channels as specified in the license agreement.
Maintain log files and other records of virus scans. Administrators will rotate logs on a regular basis and will retain old logs and records for a period of one year.
Notify the owner of the infected file and other RSP's as soon as possible so action can be taken to prevent further infection when viruses are detected on a given server.
Submit annually a report to Ramage Technologies, LLC. that details the number and nature of virus incidents as well as the steps taken to remove the viruses.
Upon finding a computer propagating a virus, immediately notify the end-user responsible for the system requesting that the suspect computer be shutdown. If the end-user is not found within three working hours, the computer system can be removed from the network to prevent further propagation.
Reinstate to the network computers for which the Security Officer agent has confirmed the disinfection and the virus protection software is current.

Noncompliance

Registered Service Providers including Ramage Technologies, LLC, are responsible for making the computers and servers under their care compliant with the virus protection policy.

Any system determined to be an infecting agent must be taken off the network or the infection effectively eliminated by the responsible service provider. Ramage Technologies, LLC has the authority to disconnect such an infected system from the network until the infection is effectively eliminated if the responsible service provider fails to manage the infection in a timely manner.

IT Service Providers Responsible for File Sharing Servers

The protection of servers providing file sharing to client computers is particularly critical to minimizing the spread of viruses. Though viruses are often spread by email, the most rapid and often the most difficult to contain virus outbreaks are spread via shared file systems.

IT service providers providing file-sharing services have a heavy responsibility to be certain that the shared file systems are well protected. Server-based virus protection software that actively scans for all files written to the shared file systems typically causes significant delays in server responses making such active scanning on servers impractical and thus not required for compliance under this policy. Timed virus scanning on servers is required and will catch any of the less virulent strains before they propagate.

Some of the worst viruses to-date propagate much too quickly for timed scans to be effective. Active scanning of files being read from or written to shared network drives is the only means of protection against these virus strains.

IT service providers offering file-sharing services can, therefore, specify virus protection regiments beyond this policy for any users connecting to their file shares. This policy provides IT service providers the right to enforce such regimens. Individuals required to adhere to virus protection regimens beyond those stated in this policy who feel the requirements onerous, should file a formal appeal to the service provider with copies to the service provider's supervisor or director and the VPC.

End-Users

Computer systems owned by Ramage Technology Clients will run anti-virus software, and it should be active at all times. The primary user of a computer system is responsible for keeping the computer system compliant with this virus protection policy. Computer systems, which login and use our software, are considered under this policy as "end-users" computers.

Responsibilities

Install and maintain current virus protection software
Be certain that the software is running correctly. If these responsibilities appear beyond the end-user's technical skills, the end-user is responsible for seeking assistance from an RSP.
Initiate disinfecting procedures or seek assistance from an Security OFficer.
Notify our Security Officer if a virus infection occurs even if the virus has been successfully disinfected. This information is vital to making others aware of the danger and keeping accurate records of outbreaks.
Perform regular backups. Virus infections often destroy data on an individual's computer. Without proper backups, recovery of destroyed files may be impossible.

Noncompliance

"End-users" not complying with this computer security policy leave themselves and others at risk of virus infections which could result in

damaged or lost files
inoperable computer resulting in loss of productivity
risk of spread of infection to others
confidential data being revealed to unauthorized persons

An individual's non-compliant computer can have significant, adverse affects on other individuals. Hence it is critical to bring all computers into compliance as soon as they are recognized not to be.