ITS News and Information

Information Technology Services – Dr. Baz Abouelenein, Chief Information Officer
Last Revised: 03/07/17
Title: Security Incident Response Policy
Applicable: Wofford Students, Faculty and Staff
Contacts: IT Help Center x4357

Background: Compromises in security can occur at every level of computing from an individual's desktop computer to the largest and best-protected systems on campus. Incidents can be accidental incursions, or deliberate attempts to break into systems, and can be benign to malicious in purpose or consequence. Regardless, each incident requires careful response at a level commensurate with its potential impact to the security of individuals and the campus.

Policy: In the case when an information security incident is determined to be of potentially serious consequence, the responsibility for acting to resolve the incident and to respond to any negative impact rests with the College rather than individuals or departments. The Chief Information Officer and the Director of Risk Management will develop and maintain a detailed Security Incident Response Plan to respond to serious information security incidents.
 

Guidelines

1. All individuals and ITS support professionals are expected to prevent computer equipment under their control from being infected with viruses and other malware by following the provisions of the College’s Anti-Virus Policy.
2. Individual users should attempt to stop any observed information security incident as it occurs. Do not power down the computer. Disconnecting it from the campus network will stop any potentially threatening activity. Please leave the machine powered up.
3. Individuals must report information security incidents to an ITS support professional. ITS staff will help you assess the problem and determine how to proceed.  Security incidents may be reported by calling 864-597-4357, or sending an email to help@wofford.edu. To report an urgent security incident outside of normal work hours, please call Campus Safety at 864-597-4911.
4. Following the report, individuals should comply with directions provided by ITS support staff to repair the system, restore service, and preserve evidence of the incident.
5. No retaliatory action should be taken against a system or person believed to have been involved in the information security incident. Response actions should be guided by the IT Security policy.
6. ITS support professionals have additional responsibilities for information security incident handling, and reporting, for both the systems they manage personally and the systems of users. In general, ITS support professionals should, as much as feasible, follow suggested guidelines for incident handling as described in NIST Special Publication 800-61, “Computer Security Incident Handling Guide”.[i] 
7. Detailed processes for security incident responses, including credit card incidents, will be documented in the College’s Security Incident Response Plan.