Jane Drews University IT Security Officer EDUCAUSE On-line 2009 Incident Management Jane Drews University IT Security Officer EDUCAUSE On-line 2009

General Elements Policy Training Technical and operational issues Procedures and decision making Quality Improvement

EDUCAUSE/I2 Information Security Guide Aligns with ISO-27002 standards for Information Security Management Chapter 13: Information Security Incident Management https://wiki.internet2.edu/confluence/display/itsg2/Information+Security+Incident+Management

Sample Security Incident Some policy was in place Decision making authority and depth Technical decisions Political decisions Operational decisions Insufficient security services Notification questions not fully understood

Notification Considerations Applicable policy, and/or local, state, or federal laws Physical possession (lost or stolen device?) Credible evidence the information was copied/removed Length of time between intrusion and detection Purpose of the intrusion was acquisition of information Credible evidence the information was in a useable format (unencrypted) Ability to reach the affected individuals

Preparation, Detection, and Reporting Policy for reporting, containment, notifications, communications Training – End users, IT admins, and Security personnel Technical resources/services Detection, analysis, forensics

Security Incident Response and Process Improvement Response team members vary by incident Security, Sysadmins Affected Unit, Legal, LE, Media/Relations, Administration, CIO, CISO Clearly defined expectations at all levels Responsibility, timing, recovery Debriefing (lessons learned)

Questions ? jane-drews@uiowa.edu