Tech Guides :: Securing Confidential Information
Incident Response
A successful intrusion attempt is a felony and the trail of evidence must be preserved. Further, California law requires the agency (in this case, Humboldt State University ) to take certain actions in cases where personally identifiable and/or other confidential information is compromised. The Information Technology Services (ITS) Disaster Recovery Plan, an approved portion of the campus' emergency response plan, assigns ITS the responsibility for coordinating the campus response to an incident involving the loss or compromise of data. This coordination involves the University Executive Committee, Public Affairs, University Police Department (UPD), the CSU Office of General Counsel, and you. If you suspect that a machine you administer has been hacked or is harboring a Trojan with a backdoor:
1. Turn off the machine and disconnect it from the network. Do not back up or copy any files on the system or make any attempt to use the machine or mitigate the attack. Turn it off and disconnect it.
2. Notify the Information Security Officer (ISO). The ISO will make arrangements for ITS and UPD staff to inspect the machine. Make absolutely no use of a compromised machine until the ISO has released it back into production.
3. Make no public statements about the incident. All questions are to be referred to the ISO during any investigation. After the investigation, specific referral directions will be issued by the ISO.
Contacting the Campus Information Security Officer
The Campus Information Security Officer can be reached at (707) 826-3815 or security@humboldt.edu.
Always telephone x3815 if you suspect a machine under your administration has been subject to an intrusion attempt. If the ISO is not available, report that you are calling because of an information security incident, and your call will be routed to someone who can help you immediately.
Endorsed by the Information Technology Council, April 11, 2006
