Computer)Security)Incident)Response)Plan

1 Computer Security Incident Response Plan Name of Approver: Mary Ann Blair Effective Date: 23- FEB- 2015 Date of Approval: 23- FEB- 2015 Date of Review: 22- FEB- 2015 Name of Reviewer: John Lerchey Computer Security Incident Response Plan Page 2 of 11 Table of Contents Table of Contents .. 2 Introduction .. 3 Purpose .. 3 Scope .. 3 Maintenance .. 3 Authority .. 3 Relationship to other Policies .. 3 Relationship to Other Groups at CMU.

2 3 Definitions .. 3 Event .. 3 Incident .. 3 Personally Identifiable Information (PII) .. 4 Protected Health Information (PHI) .. 4 Roles and Responsibilities .. 5 Incident Response Coordinator .. 5 Incident Response Handlers .. 5 Insider Threats .. 5 Law Enforcement .. 6 Office of General Counsel (OGC) .. 6 Officers .. 6 Users .. 6 Methodology .. 6 Constituencies .. 6 Evidence Preservation .. 6 Operational- Level Agreements, Governance .. 7 Staffing for an Incident Response Capability, Resiliency.

3 7 Training .. 7 Incident Response Phases .. 7 Preparation .. 8 Detection .. 8 Containment .. 9 Investigation .. 9 Remediation .. 9 Recovery .. 9 Guidelines for the Incident Response Process .. 9 Insider Threats .. 9 Interactions with Law Enforcement .. 10 Communications Plan .. 10 Privacy .. 10 Documentation, Tracking and Reporting .. 10 Escalation .. 11 Further Information .. 11 Revision History .. 11 Computer Security Incident Response Plan Page 3 of 11 Introduction Purpose This document describes the overall plan for responding to information security incidents at Carnegie Mellon University.

4 It defines the roles and responsibilities of participants, characterization of incidents, relationships to other policies and procedures, and reporting requirements. The goal of the Computer Security Incident Response Plan is to detect and react to computer security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to all stakeholders, and reduce the likelihood of the incident from reoccurring.

5 Scope This plan applies to the Information Systems, Institutional Data, and networks of Carnegie Mellon University and any person or device who gains access to these systems or data. Maintenance The University s Information Security Office (ISO) is responsible for the maintenance and revision of this document. Authority The ISO is charged with executing this plan by virtue of its original charter and various policies such as the Computing Policy, Information Security Policy, and HIPAA Policy.

6 Relationship to other Policies This plan incorporates the risk profiles for Institutional Data as outlined in the Guidelines for Data Classification. Relationship to Other Groups at CMU The ISO acts on behalf of the University community and will ask for cooperation and assistance from community members as required. The ISO also works closely with University administrative groups such as the Student Life Office, Human Resources, and the Office of General Counsel in investigations and e- discovery matters, and at their behest may assist Law Enforcement.

7 Definitions Event An event is an exception to the normal operation of IT infrastructure, systems, or services. Not all events become incidents. Incident An incident is an event that, as assessed by ISO staff, violates the Computing Policy; Information Security Policy; other University policy, standard, or code of conduct; or Computer Security Incident Response Plan Page 4 of 11 threatens the confidentiality, integrity, or availability of Information Systems or Institutional Data.

8 Incidents may be established by review of a variety of sources including, but not limited to ISO monitoring systems, reports from CMU staff or outside organizations and service degradations or outages. Discovered incidents will be declared and documented in ISO s incident documentation system. Complete IT service outages may also be caused by security- related incidents, but service outage procedures will be detailed in Business Continuity and/or Disaster Recovery procedures.

9 Incidents will be categorized according to potential for restricted data exposure or criticality of resource using a High- Medium- Low designation. The initial severity rating may be adjusted during plan execution. Detected vulnerabilities will not be classified as incidents. The ISO employs tools to scan the CMU environment and depending on severity of found vulnerabilities may warn affected users, disconnect affected machines, or apply other mitigations.

10 In the absence of indications of sensitive data exposure, vulnerabilities will be communicated and the ISO will pursue available technology remedies to reduce that risk. Personally Identifiable Information (PII) For the purpose of meeting security breach notification requirements, PII is defined as a person s first name or first initial and last name in combination with one or more of the following data elements: Social security number State- issued driver s license number State- issued identification card number Financial account number in combination with a security code, access code or password that would permit access to the account Medical and/or health insurance information Protected Health Information (PHI)