The only shared service is provided by Janet (UK) – provision of main external network service.

2445 (last updated 17 January 2013)

Not to the best of our knowledge, and no relevant information is held.

2446 (last updated 1 February 2012)

Major projects are managed following a gateway process operated in the public sector. The process is described in:

sussex.ac.uk/efm/documents/sussex-project-management-framework.doc

2447 (last updated 1 February 2012)

IT Services is managed by the Director of IT Services who reports to the University's Registrar and Secretary.  IT governance and major investments are handled through the work of the Information Services Committee and Capital Programme Committee. The responsibilities of Information Services Committee are set out on page 22 of the Organisation of the University document at:

sussex.ac.uk/ogs/govdocuments

and the responsibilities of Capital Programme Committee on page 23 of the same document.

2448 (last updated 21 March 2013)

Through programme boards established as a part of the gateway process outlined in question 2447.

2449 (last updated 1 February 2012)

The University has a Director of Information Technology Services. The Director's principle duties are Head of the Information Technology Services Department and Chief strategy advisor for the exploitation of Information and Communications Technologies (ICT) within the University.  For details about the IT Services Department see:

sussex.ac.uk/its/about

For details of IT Governance see the response to question 2448.

2450 (last updated 21 February 2012)

The IT strategic plan can be found at:

sussex.ac.uk/its/about/strategy

2451 (last updated 1 February 2012)

See response to question 2450. The Director of IT Services is a senior manager in the University.

2452 (last updated 1 February 2012)

Yes, through gateway reviews described in:

sussex.ac.uk/efm/documents/sussex-project-management-framework.doc

2453 (last updated 1 February 2012)

We do not formally use this approach. Senior business and IT staff have discussed the approach to providing major business systems.

2454 (last updated 1 February 2012)

Maintenance support arrangements are the responsibility of management of the University’s IT Services Department.  The current holders of these posts can be found on the web site (http://www.sussex.ac.uk/its/about)

2459 (last updated 17 February 2012)

The University purchases its server systems under the National Servers and Storage framework agreement.   Almost all of the servers are purchased directly from Dell with four or five years’ support (either next day support or 4 hour support) included in the purchase price.  We purchase mostly mid-range models currently R420 and R520 systems.  Servers are bought when required by the business and so the end dates for support are three to five years following the purchase date.  We have a small number of Apple Xserve systems, the hardware support contracts for which have expired.  We have a few legacy SUN systems also purchased from the National framework; some of these are supported by Oracle directly and others are no longer maintained. Oracle’s standard support arrangement is a four hour response.

We use FalconSTOR NSS running on Dell servers as controllers and DotHill storage systems; these are again bought with four or five year support.  We also have some DAS which is supplied by Dell, and NAS which is supplied by Oracle, Dell and Nexenta.  Again these purchases are made under the National framework agreement.  The storage support is a four hour response time contract.

Our tape libraries were purchased from Sun and are presently maintained under a maintenance agreement with Oracle.

Almost all of our network switches are HP ProCurve equipment; the devices come with a life-time warranty.  Our routers are a mixture of Cisco and Palo Alto, and were purchased with three year maintenance and support contracts included in the purchase cost.  All purchases were made through framework agreements.

We tend to include the support agreements covering the expected life-time of equipment at the time we purchase the equipment.  This reduces our administrative costs and is generally better value for money.

Where we have maintenance contracts for equipment which has not been included with the purchase of the equipment, or if we run equipment beyond its planned life-time and wish to have it maintained, we align these to the University’s financial year whenever possible and continue to use the manufacturer’s support offerings.

We regard any further details of our support arrangements as commercial in confidence.

2461 (last updated 29 July 2014)

At present all major IT projects are progressed via the project gateway process (see FAQ 2453).  The University's Capital Programme Committee reviews projects and decides which projects proceed.  The Director of IT Services is a member of this committee.  Smaller "projects" are progressed internally within IT Services, and the decision to make such rests with the Director of IT Services and his senior colleagues.  All such projects are reported to the University's Information Services Committee.  The committee structure can be viewed at: http://www.sussex.ac.uk/governance/documents/OrganisationoftheUniversity2011-12.pdf

2473 (last updated 12 March 2012)

The University's Director of IT Services is a member of the Professional Service Group - a committee chaired by the Registrar and Secretary made up of the heads of all the professional service groups and the Librarian.  The Director of IT Services is not a member of the Vice-Chancellor's Executive Group - the Registrar and Secretary represents the interests of all of the professional services on that body.

2474 (last updated 13 March 2012)

Turnitin® software is NOT used within the University of Sussex to detect plagiarism but as a formative tool for students to develop their academic skills.

It is made available to all students to use as part of their development of academic skills. So we are using it currently to *prevent* academic misconduct.

No cases of academic misconduct due to plagiarism will therefore have been uncovered or evidenced through the use of Turnitin®.

We started using Turnitin® across the campus on 8th Nov 2010.

As examples:

• From 8 Nov 2010 to mid-November 2011, 13097 files were uploaded to Turnitin® by UG/PG (T) students.
• From mid-November 2011 to now (24 Feb 2012) 8752 files were uploaded to Turnitin® by UG/PG (T) students.

A site for doctoral students was launched in April 2011.

The license costs are fixed by the size of the institution. 

No additional hardware has been purchased for the service. There is some expenditure of staff time for support, although this is pretty minimal and is managed within existing provision for Study Direct generally. 

2476 (last updated 21 August 2014)

Network, Wi-Fi information

9,772 University owned devices connect to our network.

There are 4,500 wired network connections in the residences.

There are more than 300 Wi-Fi Access points on campus.

There are around 650 Wi-Fi Access points in the residences.

Plessey / Siemens is the main manufacturer of our telephone system (PBX).

HP Procurve is the main manufacturer of our LAN network.

 This information is correct at 6th December2012

2490 (last updated 7 December 2012)

Broadband provider, renewal date and spend

The University does not have a contract with any broadband provider. Our network connections are provided by Janet who provide a private network for HEIs and other educational and research organisations.  This is not a time limited arrangement.   HEIs are expected to connect to this network. The funding from this network is provided by JISC. The University pays a fee to support the network whether it chooses to use it or not.  (See https://community.ja.net/library/janet-services-documentation/janet-network-charges)

The connection to Janet from the University is presently over a 10Gbps main connection and a 10Gbps resilient connection.

VOIP/PBX Installation Date: - please provide day, month and year (month and year is also acceptable).

The University does not use VOIP.

2491 (last updated 24 July 2014)

IT Services budget 2011-12

Staffing:                            £3,800K

Non-staffing:                     £1,500K

2495 (last updated 25 July 2012)

There are around 80 staff (some of whom work part time).  The IT Service also employs around 30 casual and temporary staff each year; many of these are postgraduate students who work for a few hours each month.

2534 (last updated 6 December 2012)

The University makes use of Windows and Macintosh desktop and laptop computers.

IT Services provides desktop systems for student use in cluster rooms and in the Library across the campus.  There are around 1,120 such systems available to the student community; about 50 of these are Macintosh systems and the rest are PCs running Windows 7.

In addition to these systems some Schools also provide a number of systems for student use in Laboratories and other student work areas (probably less than 250 in total).

Most University staff are provided with a centrally supported device and there are around 2,500 systems in current use.  The majority of these are Windows desktop PCs (migrating from XP to Windows 7) and a few are Windows laptop systems.  About 20% of the systems provided for staff are Macintosh machines, with perhaps 30% of these being MacBooks.

There is no significant use of thin client devices (<25) on the campus.

There are numerous tablet devices (including iPads) used within the University.  Many of these are personal devices owned by staff and students; some are purchased from devolved budgets held in Schools (University Departments) and the details of these purchases is not available centrally.  To date IT Services has purchased about 12 such devices for its own use and will purchase more when there is a demonstrable need.

2535 (last updated 18 December 2012)

Server information

There are about 200 physical servers in operation.

There are about 150 virtual servers in operation.

Dell is the main manufacturer of our physical servers.

We use VMware for virtualisation and the servers operate under Windows Server and Linux; we also have a few OSX and Solaris servers.

2538 (last updated 7 December 2012)

Most IT equipment is handled as scrap electronic equipment and disposed of appropriately: hard drives are removed and subsequently destroyed by crushing (either using an onsite metal press or through a service provided by a company who visit site with their crushing machine) or by an onsite degausser.

The selection of any disposal services for IT equipment (electronic scrap and crushing services) follows the University’s financial guidelines.  The accumulated costs of these services are significantly less than the threshold which would require an EU tender.

A small amount of IT equipment is passed on to appropriate charitable organisations: the hard disks in any such equipment are cleaned and reformatted using appropriate tools to prevent data recovery by the recipient.  The University does not provide any operating system or other software with these machines – the recipients need to obtain their own operating system and software for these computers.  It takes around an hour to prepare each system for disposal in this manner.

In a very limited number of cases, IT assets may be traded-in with a supplier as part of a procurement activity.  In these cases the hard disks in any such equipment are cleaned and reformatted using appropriate tools to prevent data recovery. 

The disposal of equipment described above ensures that there is no risk of data (University or licensed software) being inadvertently transferred to an external third party and no such incidents have occurred.

IT Services carries out most of the IT equipment disposal for the University and advises other units on the processes to be followed.  The work of disposing of IT assets is shared amongst the IT Services support staff (about 30 individuals).

Most desktop IT systems are deemed to have a four – five year useful working life though some systems are used for longer.  When equipment has reached the end of its working life it is disposed of following the processes described above.  Our Finance Department operates a depreciation system for higher value IT systems.

The Director of IT Services has overall responsibility for the disposal of IT assets; contact information is provided on the web site.

2545 (last updated 27 March 2013)

The University uses Moodle as the base of its VLE which we brand Study Direct; we are currently building on Moodle 1.98.  Moodle is an open source solution and is supported and hosted in-house.  Study Direct is used to support all taught programmes at the University and almost all of our students will follow some modules which make use of the system.  The Study Direct team consists of a manager, advisor and a number of developers; its infrastructure is supported by our Infrastructure group.  The total staff effort in providing the VLE service is around 5 FTE.

2548 (last updated 21 January 2013)

The software for our Windows Servers is provided under the Microsoft Campus Agreement which  we purchase from one of their partners who specialise in the provision of this and essential license advice.  The Apple Servers run Apple’s OSX which is only available from Apple.  We use open source distributions for our Linux Servers.  We do not have an external maintenance contract for our server software as we have appropriate diagnostic and analytical skills within our own staff.  We rely on the service updates provided by Microsoft and Apple for their systems and on updates provided by the open source community for our Linux systems.

2558 (last updated 18 March 2013)

Multifunction units are provided through the Procurement office and computer printers are provided through IT Services.  The majority of the computer printers are HP printers with various models purchased from organisations on the HE Procurement frameworks.  We use PaperCut to manage printing.  Details about IT hardware are covered in another FAQ (2461).

Various scanning and PDF software is used depending on the application being used e.g. Adobe, MSOffice and others.  The cost of this is not accounted for individually.

There is no “managed print” contract in place. All these services are managed in-house by the internal IT Services.  Various consultants are used depending on the application for which we hire them.

2560 (last updated 27 March 2013)

1. The University (and all other HEIs) is provided with its external network connections via Janet UK.  They are responsible for the provision of services and maintenance and support of that service to the University.  We have a 2Gbps and a 1Gbps connection from them and they maintain and support all parts of the connection from Sussex into their network and beyond.  The full cost of this is not paid for by the University – it is top-slice funded by HEFCE.
2. We have one external provider (Metra Net) who provides a microwave service for us between the University and King’s Road Brighton (1Gbps LAN to LAN connection). 
3. When we buy servers we include the cost of maintenance contracts for the expected life-time of the server; once this has expired we do not take out supplementary contracts to maintain these – should they fail we either repair in-house or replace the failed device.  Our servers are presently provided through the SUPC tendered frameworks.  We have Dell SUN(Oracle) and Apple servers in use.
4. Our network equipment is purchased from network suppliers on the SUPC or other national frameworks.   Core devices are purchased with maintenance for the expected life-time of the device and operated without maintenance when this has expired.  Edge devices are supplied with a life-time warranty by the manufacturer.  We use devices from Cisco and HP.
5. Desktop, laptop and mobile systems are purchased with five years manufacturer warranty.  When this ends we use the devices without support.  We purchase these systems from suppliers on the SUPC procurement framework.    Presently we use Dell, Toshiba and Apple systems.
6. We do not have software support contracts in place for our Microsoft or Apple systems.

What Microsoft agreement do you have?  We have and Academic Agreement with Microsoft (via Viglen).

Do you have software assurance?  NO

How many remote workers do you have?  All of our staff and students are able to use service on or off campus with either our or their own systems.

2577 (last updated 3 July 2013)

2578 (last updated 3 July 2013)

LAN information

9,772 University owned devices connect to our network.

There are 4,500 wired network connections in the residences, we have two main sites.

IT Services provide maintenance with the hardware supported by the vendors.

The majority of our wired network is HP ProCurve equipment; the edge devices come with a life-time warranty and the aggregation layer and core devices are purchased with four or five years’ warranty from HP via a supplier selected from the JANET framework agreement.

We tend to include the support agreements covering the expected life-time of equipment at the time we purchase the equipment. This reduces our administrative costs and is generally better value for money.

Where we have maintenance contracts for equipment which has not been included with the purchase of the equipment, or if we run equipment beyond its planned life-time and wish to have it maintained, we align these to the University’s financial year whenever possible and continue to use the manufacturer’s support offerings.

Any further detail of contractual costs are considered to be commercial in confidence.

The responsible officer for these contracts is the  Director of ITS.

2585 (last updated 29 July 2013)

The University has more than 1000 Wi-Fi Access points supporting 7000 plus user connected devices. These Wi-Fi Access Points are provided by Meru Networks. The coverage of Wi-Fi is across campus – it covers lecture theatres, some seminar rooms, cafes, the Library, student residences and other student study spaces.

The University’s network connects to JANET the UK academic network; this provides access to other HEI’s, some partner organisations and the Internet.

Sussex is part of the eduroam  community; this provides a free of charge reciprocal agreement for members of the University and visitors from other academic institutions to access the Wi-Fi network using their home organisations credentials at any member site.

2589 (last updated 27 August 2013)

The University does not buy individual copies of Windows 7 as they are covered by an enterprise licensing agreement with Microsoft.

There are 2054 staff workstations and 1056 student workstations running Windows 7 on campus.  A further 358 staff workstations are still to be migrated to Windows 7.

Information correct at 18th November 2013.

2616 (last updated 12 December 2013)

1. If students at your institution have to agree to a Terms of Service/Acceptable Use Policy before they are granted access to network resources, please provide a copy of this.  

A. There are links to policies (from Governance and ITS pages) and FAQs and related articles for staff & student use.

http://www.sussex.ac.uk/ogs/govdocuments/regulations  Particularly Regulation 29, pages 190 onwards.  (This is also linked from http://www.sussex.ac.uk/its/about/policy )

http://www.sussex.ac.uk/infosec/

2. Could you confirm any disciplinary or punitive actions that students might face as a result of breaking such Terms of Service/Acceptable Use Policy?

A.  Sanctions are listed in regulation 29.

3. Does your network employ any kind of traffic shaping that limits the use of particular internet protocols such as BitTorrent? Does your institution block access to file sharing sites such as The Pirate Bay or other kinds of sites (for instance, pornography sites)? 

A.  Yes.

4. If your institution does block certain sites or implements traffic shaping on protocols, please could you confirm the broad internal process by which sites or protocols are chosen for blocking. If an external service such as BT’s ‘Cleanfeed’ is used to regulate the sites to which students have access, please confirm the details of this.

A.  Network applications which make excessive use of network bandwidth and use of which may bring the university into disrepute are blocked or traffic shaped to unusably slow flows.  These are almost all peer to peer file transfer applications.

Those which are network intensive but recreational (streaming television, YouTube, etc.) are traffic shaped during weekday working hours.

Definition of traffic categories is made using a hardware network traffic analyser and shaper which is maintained by a third party.

5. Do you conduct any analysis, whether automated or manually, that investigates the volume of traffic upon your network? If so, please provide a summary of the amount and proportion of upstream and downstream traffic (accounted for separately if possible) which is utilised for the ten most popular protocols (such as streaming video, BitTorrent, email, and so on).  

A.  Figures pertain to Friday 8th November 2013.

Our application sensitive traffic monitoring system does not readily distinguish between upstream and downstream traffic.  In general, our traffic is in the ratio 1:7 upstream:downstream.

6. Please could you also provide any available breakdown if possible of the use of legitimate media consumption upon your network, such as the amount of traffic generated by the BBC iPlayer, Netflix, Spotify, or to Apple's iTunes store. 

A.  Top ten media applications breakdown for Friday 8th November 2013.

2617 (last updated 12 December 2013)

Information about the number of incidents of hacking into university servers. This includes breaches into department websites, databases on students, blackboard and any other IT service under the university's control. Please indicate, if it was noted:

- Date of the attack

- Motive of the attack

- Whether the hackers changed/altered anything

- Who the perpetrators were

- If it was a student, the punishment for the incident

- Whether any data was lost/stolen and whether that data was personal and/or sensitive information on individuals

- Whether the hacker(s) gained access to, or could have theoretically gained access to, personal and/or sensitive information on individuals.

*****

Any report or minute meeting that centred on any incident of hacking against the university as described above.

----------------------------------------------------------------------------------------------------------

This information is not centrally collated.

To our knowledge, there have only been three types of successful attack on centrally run IT servers in years 2011/12 and 2012/13.  Specifically:

1. In 2011/12, one departmental web server was compromised through a PHP vulnerability.  The compromise was used to install software to make the server participate in a botnet.  The compromise was detected and the system secured before the server was used in the botnet.  The system contained no credentials which could be used for an onward attack on other University systems.

2. In 2012/13, two student accounts were accessed on a central Linux server from a single remote site in the USA.  Bitcoin mining software was installed and run remotely.  The pattern of access triggered an alarm, and the accounts were closed to prevent misuse of computing facilities.  Both accounts belonged to students who were in the process of graduating from the University, and had little or no privileges to access other systems.

3. Throughout both 2011/12 and 2012/13, roughly six times each year, user account credentials are compromised through phishing or spearphishing attacks.  The compromised credentials are invariably used to originate or relay spam email.  Our monitoring tools are usually able to detect such compromises, and users are guided through the process of securing their accounts.

We are not aware of any additional accesses to personal information during any of these incidents.

******** 

None of the incidents have been judged to be sufficiently seriously to have been reported to through the University's governance mechanisms, and therefore will not have been formally discussed at a minuted meeting.

2623 (last updated 7 February 2014)

We don’t use Oracle EBS, SAP ERP or SalesForce nor use any ERP Software but have a ‘best of breed’ strategy for individual systems.

2625 (last updated 17 January 2014)

No Corporate Information Systems use DB2.

The database software used by Coorporate Information Systems is:

Oracle, MS SQL, MS Access, MySQL

Databases are procured as part of software application solutions which will have been subject to procurement rules.

Corporate Inforamtion Systems do not currently outsource any database support.

Researchers and students may well use other database software of which IT Services have no knowledge.  This information is not held centrally by IT Services.

2628 (last updated 3 February 2014)

Admissions Reporting

Database and Oracle Forms upgrade

Electronic Management of Assessment

HR/Payroll System replacement

Paperless Admissions

Research Profile

Telephony replacement

Web CMS

Careers System

Finance system upgrade

Upgrade and enhance HPC cluster

New Service Management software

Business Continuity and Disaster Recovery

Library MFDs

2666 (last updated 9 April 2014)

Student MFDs / PDF Solutions / Document Management

The University has three Kyocera MFDs for student use running PaperCut on contract until June 2017.

The University pays for Adobe Acrobat and Corel PDF Fusion.

The University does not use any document management / document repository systems.

2677 (last updated 11 August 2014)

Servers - hardware

1a:  How many physical servers does the organisation manage? (please specify numbers onsite, Offsite)?

We have interpreted "physical server" to be a single physical enclosure, irrespective of the number of logical computing units held within that enclosure (e.g. each blade server will count as a single physical server).

All of our servers are on site.

As at 27th August 2014, we have a little over 420 physical servers.

1b:Which vendor(s) does the organisation use?

Dell, Apple, Transtec, Oracle.  Currently the main supplier is Dell.

1c: Who is responsible for purchasing new server equipment, technically and commercially?

Technical specifications are developed by service operation teams.  Vendor selection is performed in consultation between service operation teams, IT Services purchasing staff, and the University's procurement department.

Appointment of a vendor for a particular procurement is almost invariably made through the lists of approved suppliers developed by sector or national purchasing consortia, such as the Southern Universities' Purchasing Consortium.

1d: Who do you make your server purchases though?

This is determined by the purchasing consortia agreements, but is usually direct with the vendor.  In a few cases, the vendor may choose not to supply directly, but instead will appoint one or two agents as their representatives on the consortia agreements.

2684 (last updated 2 September 2014)