When it comes to combating e-mail viruses, many colleges, including Penn, take a decentralized approach, dividing up tasks such as buying and regulating software among different organizations within the school.
While school officials report general satisfaction with decentralization, it also makes it difficult for them to track with precise accuracy the costs of these protective and combative measures, which often run into the tens of thousands of dollars. However, officials say the money is well spent because the cost of a virus attack could be far greater than the cost of anti-virus software.
Postini, a California-based e-mail filtering company, tracks virus activity weekly and reported a near doubling of the occurrence of e-mail viruses nationally in the past six months -- a condition that has forced school administrators to provide extensive anti-virus software to students and faculty.
Mark Aseltine, a Penn Information Systems and Computing staff member, estimated the cost of desktop anti-virus software to be close to $85,000 annually.
"But this is only a small piece of the cost," he said. "It's not really possible for us to put a number on the staff costs associated with fighting viruses because the effort is distributed among many system administrators and local providers all over campus."
Penn's financial offices do not keep exact score either, citing similar reasons. "When we make a purchase, we don't classify the details," said Craig Carnaroli, University treasurer and senior vice president of finance. "It's very decentralized."
Carnaroli did say that the University spent $8.2 million for computer software and accessories in fiscal year 2003, but the exact portion of that which goes to fighting e-mail viruses is unknown.
He added that the cost of lost productivity is not factored in, either. As a result, he said, the money spent on anti-virus protection is less than would be spent if the computing system was debilitated by viruses.
Penn officials are not the only ones who lack a precise idea of how much they spend on anti-virus protection.
For officials at Cornell University, centralizing IT security efforts is part of a plan to help financial administrators invest funds more strategically.
"We centrally don't keep track of these numbers, but starting this summer, we will," said Cornell Director of IT Security Steve Schuster who added that he estimates virus protection and combative costs to add up to well over $100,000 yearly.
"My guess is that we don't specifically put a fence on those costs. It's more a part of the cost of overall computer security," California Institute of Technology Vice President for Business and Finance Albert Horvath said. The school's IT staff does not have a figure, either.
At Yale, the costs associated with eliminating worms at the university have been high, especially since an onslaught of viruses bombarded campus e-mails at the beginning of the year, according to Yale Director of Information Security Morrow Long.
"We haven't really quantified it, but we easily spend several hundred thousand to $1 million a year, plus lost time and productivity," Morrow said.
Having a decentralized IT effort "is really ingrained and works well," Aseltine said. He added that despite this, "there are a lot of attempts to join forces to figure out costs better."
