Information Security Incident Response Primer LW Presented by Lucas Walker & Lawrence Alderete

I am responsible. Although I may not be able to prevent the worst from happening, I am responsible for my attitude toward the inevitable misfortunes that darken life. Bad things do happen; how I respond to them defines my character... Walter “Bob” Iglis Anderson, American painter, writer, and naturalist LW

First, Some Basics LW Defining the term ‘Incident’

An unplanned interruption to an IT service or reduction in the quality of an IT service. ITIL® v3 Glossary LW Incident

The ability of a product, service or process to provide the intended value. ITIL® v3 Glossary LW Quality

Utility Value Warranty Value Creation Performs Adequately or; Has No Constraints Fit For Purpose Continuous Availability and; Has Enough Capacity and; Secure Continuous Availability and; Has Enough Capacity and; Secure LW -> LPA Fit For Use Value Creation ITIL® v3 Glossary

Therefore… LPA

Information Security Incidents are ITIL Incidents Lucas Walker, Information Security & Privacy Office, University of New Mexico LPA

The Boring Stuff LPA Policy 2550, Section 2.7

All breaches of information security must be reported immediately to security@unm.edu. University of New Mexico Administrative Policies and Procedures Manual - Policy 2550: Information Security LPA UNM Policy Mandates that information security incidents be reported to ISPO

More Boring Stuff University of New Mexico Incident Management Program LPA University of New Mexico Incident Management Program

The purpose of Incident Management is to direct the activities of UNM employees when responding to an Information Security Incident to ensure a timely and appropriate response to all Information Security Incidents. University of New Mexico Incident Management Program LPA Incident Management’s Purpose

Major vs. Minor Incident LPA - LW

Major incidents can involve highly sensitive data, can have a high impact, or can have the potential for high impact on institutional reputation, services, information, and operations. These types of incidents require the involvement of various UNM teams, internal and external, to assist in the response. University of New Mexico Incident Management Program LW Major Incidents

Major Incident Examples Incidents involving: High severity vulnerabilities as defined by the ISPO Vulnerability Management Program Component Compromised or exposed enterprise systems of record, especially those that result in extended outages (breaches) Systems that are conducting attacks against other UNM services or against the services of third parties Successful targeted social engineering, such as Spear Phishing Law enforcement agencies LW

Minor incidents rarely have a significant impact on institutional services and operations. Often, minor incidents are isolated and / or not the result of targeted attacks. Furthermore, these types of incidents have a prescribed or known method of resolution, such as a patch installation, malware definition update, or configuration change. These types of incidents are generally resolved by following Standard Operating Procedures (SOPs). University of New Mexico Incident Management Program LPA Minor Incidents

Minor Incident Examples Incidents involving: Vulnerable UNM Systems* Lost or theft of a UNM device* Compromised… NetIDs sending phishing emails Hosts participating in botnets Websites (defacements) * Where no sensitive data is at risk LPA

Stages of Incident Response LW

Validate that an incident has occurred Identify Validate that an incident has occurred Determine the scope of the incident Contain Limit system access Create investigative copies of logs, data, media, etc. Remove Change passwords where appropriate Re-Image systems & restore from backups Restore Bring services back up Monitor Review Identify root-cause & and service restoration steps Identify opportunities for improvement LW

How do I report a potential Information Security Incident? Minor Incidents Security Mailbox (security@unm.edu) Help.UNM UNM IT – Service Desk (7-5757) Major Incidents ISPO On-call (7-2497) Anonymous Reporting UNM Compliance Hotline (1-888-899-6092) UNM EthicsPoint See https://ispo.unm.edu/contact-information.html for a complete list of contact methods. LPA

Q and A LPA You ask questions, we’ll answer them.

Contact Us ispo.unm.edu LPA