1. Incident Response And a debrief of UNM’s response to the Heartbleed vulnerability 1 Presented by: Michael Burlison, Information Security Analyst – CISSP, GCIH, GSEC Lucas Walker, Information Security Analyst - GSEC

2. What happened and why you should care… 2

3. Researched scope of problem Identified vulnerable systems Updated and patched core IT-managed systems Revoked and re-issued SSL certificates Involved the community: Notified departmental IT areas Posted alerts Involved help desk Provided instructions to users Issued password resets for impacted services What IT did 3

4. What IT is doing: Scanning and monitoring for vulnerable systems on the network Monitoring Intrusion Prevention Systems (IPS) for Heartbleed activity De-briefing stakeholders and decision makers, “Lessons Learned” Researching for patches that are still being deployed 4

5. Incident Response Plan Is an action plan for dealing with intrusions, cyber-theft, denial of service, malicious code, natural disasters, and other security-related events Incidents can be intentional or unintentional Incident Response Plans help to know what to do when an incident occurs. Not a matter of “IF,” but of “WHEN” Planning is (almost) everything! 5

6. Incident Response Plan DoE’s 6 Step Process: 1.Prepare 2.Identify 3.Contain 4.Eradicate 5.Recover 6.Lessons Learned 6

7. Key Mistakes Failure to report or ask for help Incomplete / non-existent notes Mishandling / destroying evidence Failure to: Create working backups Contain or eradicate Prevent re-infection Apply lessons learned 7

8. Legal Aspects Plans, policies, and procedures developed for incident handling must: Comply with applicable laws Be reviewed by legal counsel & key stakeholders Unless you are a lawyer in OUC, you are not the expert. Work closely with legal counsel Regulations: FERPA PCI GLBA HIPAA ITAR Reporting security breaches, cyber-insurance, international standards (ISO 17799) 8

9. UNM Incident Response Plan Draft will be distributed to this audience PCI version is on cio.unm.edu/standards ERP version is posted on Banner ERP sites Is being updated Will be posted to CIO Standards page 9

10. Q&A Help.unm.edu security@unm.edu it.unm.edu/security 10