[Eril-l] APS IP Block solutions?

[Butler, Paul]

Hi Alice,

My first suggestion, if you haven't done so, is to ask ACS for their log files for the incidents that caused the blocks. That will give you some idea what ACS is seeing that is triggering the blocks. Then you can go back and cross-reference your EZproxy logs. What ACS is seeing may be legitimate user activity. Otherwise, I have seen this situation occur due to the browser plug-ins, the use of third-party citation software, and actual fraudulent activity.

You may also want to look at some of your EZproxy settings. Checkout this material (https://www.oclc.org/content/community/en_us/ezproxy/events/ezp-forensics-roundtable.html) that I helped create about EZproxy security. You maybe find you need to start lowering some thresholds.

The EZproxy listserv is an active place and maybe prove useful for you (particularly the archives, since ACS and this issue has been a topic of conversation in the past). http://www.oclc.org/support/services/ezproxy/documentation/list.en.html

Cheers, Paul
-------------------------------------------------
Paul R Butler, mlis
Library Technologies Support Analyst
Library Information Technology Services (L.I.T.S)
Ball State University<bsu.edu>
Muncie, IN  47306
P: 765.285.8032
E: prbutler at bsu.edu<mailto:prbutler at bsu.edu>

University Libraries...a destination for research, learning, and friends

The University Libraries provide services that support student pursuits for academic success and faculty endeavors for knowledge creation and classroom instruction.

From: Eril-l [mailto:eril-l-bounces at lists.eril-l.org] On Behalf Of Alice Daugherty
Sent: Friday, December 16, 2016 11:04 AM
To: 'eril-l at lists.eril-l.org' <eril-l at lists.eril-l.org>
Subject: [Eril-l] APS IP Block solutions?

Hello all,

In the past we have had the occasional IP block from ACS with the IP unfortunately being our EZProxy IP.  Lately, this has been a recurring issue, and not always the same user.

Recently, one person brought their computer to our IT people and no viruses were found.  We were thinking that a keystroke virus might have been the culprit.  Currently, a different user is causing our IP block and has caused the last 3 blocks.

This year, it seems that the excessive downloads block has occurred more frequently and with other vendors as well.

I wondered how other campuses are handing this issue?  How many attempts at password changes do you provide users before you consider taking away their access?  Do you ever consider restricting their access?  Are there other technologies that can be put in place to prevent these types of breaches?

Thank you,
Alice


[LSU]<http://www.lsu.edu/>
Alice Daugherty
Collection Assessment and Analysis Librarian
LSU Libraries
Louisiana State University
30 Middleton, Baton Rouge, LA  70803
office 225-578-7652
adaugher at lsu.edu<mailto:adaugher at lsu.edu> | lsu.edu<http://www.lsu.edu/> | lib.lsu.edu<http://lib.lsu.edu/>
[Facebook]<http://www.facebook.com/LSULibraries>  [Twitter] <http://www.twitter.com/lsulibraries>   [Instagram] <http://www.instagram.com/lsulibraries>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.eril-l.org/pipermail/eril-l-eril-l.org/attachments/20161216/41752de0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 334 bytes
Desc: image001.png
URL: <http://lists.eril-l.org/pipermail/eril-l-eril-l.org/attachments/20161216/41752de0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 205 bytes
Desc: image002.png
URL: <http://lists.eril-l.org/pipermail/eril-l-eril-l.org/attachments/20161216/41752de0/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 333 bytes
Desc: image003.png
URL: <http://lists.eril-l.org/pipermail/eril-l-eril-l.org/attachments/20161216/41752de0/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.png
Type: image/png
Size: 291 bytes
Desc: image004.png
URL: <http://lists.eril-l.org/pipermail/eril-l-eril-l.org/attachments/20161216/41752de0/attachment-0007.png>