Incident Handling and Response, Presented at Security Professionals Conference

After the tragic events of April 16, 2007, at Virginia Tech, IT professionals and university legal counsel had to quickly address the need to collect and preserve data in the event of future litigation. Performing tasks while dealing with grief and protecting academic freedom and privacy issues has required a delicate approach.

With a mixture of centralized and local IT service providers, higher ed presents unique challenges to effective incident response. The University at Albany has developed a web-based incident management and reporting tool that provides immediate sharing of incident information with local responders and real-time incident response functionality (e.g., switch port control).

The University of Florida and the University of Pennsylvania both regularly generate summary reports of computer incidents for information security managers. The reports help identify units that need improvement, assist with planning and risk assessment, and have contributed to an improvement in the security posture of both universities.

The EDUCAUSE/Internet2 Security Task Force Model Policy Subgroup will survey its model security policy wiki, an inventory of policy samples, organized around 10 industry standard topics. This session will drill down on decision points in four custom models: security management, data classification, incident response, and security planning.