Does "Trellix" ring a bell? Here is a reminder from an AI summary:
UC Systemwide Trellix Dispute
• The Mandate: UC President Michael Drake ordered the systemwide deployment of Trellix EDR cybersecurity software on university-managed devices.
• Faculty and Academic Senate Opposition: Faculty members and the UC Academic Senate Assembly formally protested the rollout. They argue the administration bypassed shared governance consultation.
• Privacy and Surveillance Concerns: Faculty raised alarms that root-level access could allow file monitoring, alteration, or deletion, infringe on academic freedom, and expose sensitive research data or government collaboration channels (such as the Joint Cyber Defense Collaborative).
• Administration Stance: The UC Office of the President (UCOP) maintained that Trellix limits data collection strictly to system-level threat indicators without monitoring personal browsing or emails.
• Phase-out Plans: For instance, UCLA Transitioning from Trellix to CrowdStrike scheduled a full retirement of Trellix by May 2027 in favor of CrowdStrike.
==
Trellix Corporate Data Breach Investigation
• The Incident: Trellix disclosed a security and source code repository incident in 2026, followed by notification letters sent to affected individuals in August 2026.
==
UCLA Transitioning from Trellix to CrowdStrike for Endpoint Security
October 27, 2026 Security
https://dts.ucla.edu/news/ucla-transitioning-trellix-crowdstrike-endpoint-security
--
Protecting UCLA's systems, information and digital environment is essential to supporting our university's teaching, research and service missions.
As part of a University of California-wide initiative, the UC Office of the President (UCOP) is replacing the current systemwide endpoint security solution, Trellix HX (formerly known as FireEye), with CrowdStrike Falcon, a modern cybersecurity platform providing antivirus and other detection and prevention capabilities designed to protect computers and university information from evolving threats.
In alignment with UC expectations, UCLA will retire Trellix by the end of May 2027, making a timely transition to CrowdStrike essential to maintaining supported endpoint protection. While the security software is changing, the cybersecurity requirements established by UC in 2024 remain in effect. UCLA is committed to making this transition in consultation with both campus academic and administrative governance to develop the detailed rollout plan and necessary adjustments.
No action is required at this time, as your local IT team will provide instructions as the project gets underway.
--
What Is CrowdStrike?
CrowdStrike is an Endpoint Detection and Response solution designed to detect, prevent and respond to cybersecurity threats, including malware, ransomware and unauthorized access.
Compared with Trellix, CrowdStrike is designed to provide enhanced protection, support a broader range of devices and operate more efficiently in the background, minimizing the impact on everyday device use.
CrowdStrike is not intended to monitor your work, research or productivity. Its purpose is cybersecurity threat detection and response, and UCLA's use of the technology remains subject to UC privacy and data-use policies. This includes any use of CrowdStrike for remote cyber threat remediation in alignment with university consent procedures. As part of the governance process, a formal academic committee dedicated to cyber transparency has been requested to ensure ongoing alignment with these policies and to review activity.
What Should I Expect?
UCLA has begun deploying CrowdStrike through a pilot with select campus units to test and refine the installation process. The broader rollout will occur in phases, in conjunction with ongoing IT and academic governance review:
October 2026 – January 2027: Campus IT teams will prioritize installing CrowdStrike on servers and administrative staff computers.
January 2027 – May 2027: Deployment will tentatively expand to faculty, researchers, and other applicable devices across campus following consultation with the Academic Senate.
Beginning June 1, 2027: Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain high-risk UCLA applications and services.
Depending on your device, CrowdStrike may be installed automatically by your IT team or require you to complete additional installation steps. Your local IT team will communicate the timing, instructions, and support available if action is needed.
What Happens Next?
As UCLA prepares for the transition, your local IT team will share additional details about timing, expectations, and any steps you may need to take. Again, no action is required at this time. Please wait for further instructions from your local IT team before installing CrowdStrike or removing Trellix from your computer.
For more information, including frequently asked questions about deployment, device compatibility, privacy and upcoming access requirements, visit the OCISO CrowdStrike website:
https://ociso.ucla.edu/crowdstrike-falcon-endpoint-security-antivirus
Sincerely,
Darnell Hunt
Executive Vice Chancellor and Provost
--
Michael J. Beck
Administrative Vice Chancellor
==
NOTE 1: Blog readers may recall that Trellix became an issue both at the UCLA campus level and systemwide at the Academic Senate's Assembly. The issue for faculty involved personal cybersecurity. There is a general reference to this concern in the Hunt-Beck memo above. It is highlighted in boldface.
NOTE 2: (from AI) - CrowdStrike is headquartered in Austin, Texas — 206 East 9th Street, Austin, TX 78701 — after relocating from Sunnyvale, California in 2021. Beyond Austin, the company runs a significant global footprint: regional hubs in Washington D.C., London, Sydney, Tokyo, and Singapore, plus smaller offices across Europe, the Middle East, and Asia-Pacific.
NOTE 3: If you are reading this blog through the older
https://uclafacultyassociation.blogspot.com/,
typing in "Trellix" will bring you references to concerns raised by faculty. (The newer parallel blog
https://danmitchellsblogcontinues.blogspot.com/
does not go back far enough to have those references.
No comments:
Post a Comment