Compromises in information security can include both electronic and hard copy information. Electronic compromises can potentially occur at every level of computing from an individual's small mobile device to the largest and best-protected systems on campus. Incidents can be accidental incursions or deliberate attempts to break into systems and can range from benign to malicious in purpose or consequence. Regardless, each incident requires careful response at a level commensurate with its potential impact to the security of individuals, sensitive information and the campus as a whole.

The accelerated pace of technological change and concurrent reliance on electronic information systems has greatly increased both the potential exposure of sensitive information to the world at large via electronic means and the motivation of some to exploit computing devices, computing infrastructure and software either for gain or to cause organizational difficulties. Governmental authorities, regulatory bodies and standards organizations have recognized this new reality and responded with laws, regulations and other measures to motivate organizations to take the steps necessary to minimize or prevent information security incidents before they occur.

This environment means that all persons within the University have an active role in preventing security incidents or in minimizing them if they occur.

For the purposes of this policy an  "Information Security Incident" is any accidental or malicious act with the potential to:

• Result in misappropriation or inappropriate modification or disclosure of sensitive information;
• Affect the functionality or continuity of information technology including the infrastructure of the University;
• Provide for unauthorized access to university resources or information; or
• Allow university information technology resources to be used to launch attacks against either other internal resources or the resources and information of other individuals or organizations.

The policy of the University of Louisville is to minimize both the frequency and the severity of information security incidents within the University environment. All users are responsible for and must maintain their university computing/mobile devices and data in as safe a manner as is reasonably possible. In the event of an incident, the standards outlined in this document as well as the related procedures must be followed.

The Information Security Office (ISO) is responsible for managing the University's Information Security Incident Response Program. The ISO has established procedures and identified the Information Security Incident Response Team (ISIRT) as the authority in developing plans and managing the university's information security incidents. Working in conjunction with ITS and other internal and external parties, the ISIRT will follow protocol in determining what actions should be taken, how incidents should be handled and in documenting, securing and retaining evidence and information. Incidents may be escalated to university counsel, human resources or other university officers as well as law enforcement or outside authorities. Non-ITS specific information incidents relating to sensitive or regulated data (e.g. inappropriate access or modification, abuse or suspected abuse of access, lost or stolen hardcopy, transmission without encryption or transmission to an unauthorized user, etc.) should immediately be reported to the University's Information Security Office at isopol@louisville.edu.

The University of Louisville Computer Incident Response Team (ULCIRT) has been identified as the authority in developing response plans to security incidents specific to technology resources.  ULCIRT will work with ISIRT and incidents that are determined to be ITS specific or need ITS assistance will be redirected to ULCIRT for further investigation.

Users who have knowledge of or suspect an information security incident should immediately contact the Information Security Office at isopol(@)louisville.edu, the ITS helpdesk at 502-852-7997 or the ITS Enterprise Security team at SecureIT@louisville.edu. Users wishing to remain anonymous may contact the Compliance Hotline at 1-877-852-1167.

Administrative standards:

Dealing with Viruses, Worms and other common "Malicious" Software

• ITS support professionals are not required to report IT security incidents involving viruses, worms, and other common malicious software to ULCIRT if self-contained and completely removed by anti-virus, anti-spyware or other software. If, in the judgment of the Tier 1 or other authorized technical support personnel, the malicious software could pose a risk to university data/networks or was not successfully removed the incident must be reported. Please follow the standards in the next section, Reporting and Responding to IT Security Incidents.
• Because malicious software can reduce the functionality or otherwise affect the campus computing and communication environment, individuals and information technology support professionals are expected to:
  • Prevent computer equipment under their control from being infected with malicious software by the use of preventive software and monitoring (see ISO-014 Protection from Malicious Software policy and standards), and
  • Take immediate action to prevent the spread of acquired infections from any computers under their control.

Assistance is available from your Tier 1, the ITS HelpDesk and from the ITS Enterprise Security Team.

Users - Includes students, faculty, staff, administrators and other employees of the University of Louisville and its affiliated entities and any other individual having a computer account, email address or utilizing the computer, network or other information technology services of the University of Louisville.

Sensitive Information - Information of a confidential or proprietary nature and other information that would not be routinely published for unrestricted public access or where disclosure is prohibited by laws, regulations, contractual agreements or University policy. This includes (but is not limited to) full name or first initial and last name and employee ID (in combination), identifiable medical and health records, grades and other enrollment information, credit card, bank account and other personal financial information, social security numbers, grant reviews, dates of birth (when combined with name, address and/or phone numbers), user IDs when combined with a password, etc. Sensitive information does not include personal information of a particular individual which that individual elects to reveal (such as via opt-in or opt-out mechanisms) (see Information Management and Classification Standard).

Reporting and Responding to IT Security Incidents

Individuals

• Immediately report lost or stolen computer devices (including mobile devices) to ITS support and the ULPD.  The ISO will follow up to determine if there are information security issues related to sensitive or regulated data.
  • Attempt to stop any further damage from an IT security incident by disconnecting the computer from the campus network (do not turn the computer off).
  • Report IT security incidents to ULCIRT at SecureIT@louisville.edu. ULCIRT will help you assess the problem and determine how to proceed.
  • If the incident has potentially serious consequences and requires immediate attention, individuals should report the incident to the ITS Help Desk at 502-852-7997 and request 'priority one' status.
  • Following the report, individuals should comply with directions provided by ITS support staff or ULCIRT to repair the system, restore service, and preserve evidence of the incident.
  • No retaliatory action should be taken against a system or person believed to have been involved in the IT security incident. All response actions should be guided by the ITS security policy and all other applicable university policies.
  • All incidents should be kept confidential unless otherwise instructed by ITS or the ISO. Incidents involving criminal investigation must be kept strictly confidential. University counsel or other officials should be informed of employee subpoenas or requests for documents before any action is taken.
    

IT Support Professionals (Tier 1)

Department, college, or unit information technology support professionals have additional responsibilities for IT security incident handling and reporting for both the systems they manage personally for their units and the systems of users within their units. In the case of an IT security incident, Tier 1 support staff should:

• Respond quickly to reports from individuals.
• Take immediate action to stop the incident from continuing or recurring including deactivating or disconnecting the device if required. Lost or stolen devices should be deactivated/disabled immediately and remotely wiped when feasible.
• Report IT security incidents to ULCIRT at SecureIT@louisville.edu. They will help you assess the problem and determine how to proceed.
• If the incident has potentially serious consequences and requires immediate attention, individuals should report the incident to the ITS Help Desk at 502-852-7997 and request priority one status.
• Notify the appropriate college, department or unit administrator that an incident has occurred and that ULCIRT has been contacted.
• Refrain from discussing the incident with others until a response plan has been formulated and restrict information to only those with a need to know.

Follow ULCIRT guidance to repair the system, restore service, and preserve evidence of the incident.

Policy Authority/Enforcement: The University's Information Security Officer (ISO) is responsible for the development, publication, modification and oversight of these policies and standards. The ISO works in conjunction with University Leadership, Information Technology, Audit Services and others for development, monitoring and enforcement of these policies and standards.

Policy Compliance: Failure to comply with these policies and standards and/or any related information security and/or information technology policy, standard or procedure may result in disciplinary action up to and including termination of employment, services or relationship with the University and/or action in accordance with local ordinances, state or federal laws.

ISO-014 Protection from Malicious Software

Information Security Incident Response Team (ISIRT) isopol(@)louisville.edu

Computer Incident Response Team (ULCIRT) SecureIT@louisville.edu