Summary of Questions for Anti-virus and Spam Protection RFP 04.

026

Is your current NAI/McAfee solution completely deployed? If not, please let me know what
number is deployed and what number still needs to be rolled out.

Yes

What product do you have installed on your web server and e- mail server?
(Where NAI/McAfee's WebShield and GroupShield would be installed with the Active Virus
Defense (AVD) solution, if choosen.)

Web Server and SMTP server one box and covered by same software as clients - no mail
checking

Would you prefer to roll out using ePolicy Orchestrator (which, I understand that you are
currently using) or would you prefer to have McAfee Consulting Services come in to help with
the implementation and roll out?

As always, depends on cost The City is not averse to using ePolicy Orchestrator to disseminate
the software. However; based on EPO reports, we have difficulty addressing about 300 PCs -
being reported as no protection or invalid protection.

Do you have a preferred solution in mind? May we propose more than one option, so that you
have choices?

Since this is an RFP, you can submit alternates to our requests.

There are really 2 ways to filter mail for lotus notes. One is make a smtp/spam/antivirus gateway
server that cleans everything before it gets to the mailserver. The second is to put Spamassassin
on the lotus notes server. I am wondering how taxed cpu wise your lotus server currently is? If it
is under heavy load an smtp gateway would probably be a better solution for yo u.

The server in question is a Gateway 7450R, dual 950 MHz processor machine running Windows
NT 4.0 SP6A, Lotus Domino 5.09a. It functions both as the SMTP gateway and web server.

A small monitor over a four hour span in prime time showed each processor peaking in the low
30% and averaging between 5 - 10 %.

Is any mechanism currently in place to do remote/automated deployment of software? Do you

have a Windows domain in place where login scripts can be used, any software like SMS or
ZenWorks?

There is not automated distribution software. We use kixtart as our login script language.
To what extent must the solution be configurable per-user? Is on/off and quarantine/ignore/delete
okay? Does the point system need to be adjustable per user? Per group? Please elaborate.

We often have on-going police or fire investigations that require special configurations for
Internet access. I assume that they may need special configurations to assure mail is not being
deleted. Given the diversity of our employees and departments, it is reasonable to assume that
one department's spam definition might not work or another department.

Does having the e- mail go into a separate folder count as 'quarantined' if it is clearly marked as
SPAM?

Yes.

What is the timeline for awarding and implementing Anti-Spam services? Assumably it is the
same as for the Anti- virus solution but it is not detailed in the RFP.

There really isn't a definite time line for the spam implementation. It would be nice if we could
do both at the same time, but the virus subscription deadline is definitely driving that part of the
RFP

What is the approximate number of email users? The number of clients is mentioned but not all
clients necessarily have email capabilities. Is it safe to use the number of clients for pricing
purposes?

We have approximately 1500 email users, with another 200 or so coming on board soon

What is the level of concern regarding inappropriate (adult-oriented) attachments coming in or

going out of your network? Normal Spam filtering services won't prevent adult-oriented
attachments from being sent or received.

City policy states that inappropriate data on a PC is a violation. The RFP was written with the
expectation that adult oriented mail would get blocked based on a scoring system. The
assumption was that the scoring system could also be applied to attachments as well. If that is
not the case, please note that as an exception in your response.