Immediately containing and limiting the exposure is first priority. In certain situations, we must notify the Indiana Attorney General within two business days of becoming aware of the incident. Also, individuals effected by such incidents expect expeditious notification so that they can monitor their accounts. The most common complaints after an incident are about how long it took the organization to contain the exposure and to send notifications. At Indiana University, our goal is to notify the individuals affected within one week of our becoming aware of the possible exposure.
Reporting Suspected Sensitive Data Exposures
Time is critical
If you suspect a machine has been compromised and it stores/processes sensitive data, do not use the system. That means that you should not do a network scan of the system, run antivirus software, patch the system, reboot, unplug any cables, or power off the system.
- Steps to take as soon as the incident is suspected
If you suspect that a machine may be compromised and you know that it stores or processes sensitive data, please step away from the computer and do not use the system. That means you should not do a network scan of the system, run antivirus software, patch the system, reboot, unplug any cables, nor power off the system. Two reasons are:
Your actions may inadvertently trample over important evidence, including the modify, access, and create times of files that the attacker viewed or touched.
Your actions may tip off the attacker to know that you are aware that the machine is compromised. He or she may take action to remove evidence or delete files.
In the event of a possible security incident concerning sensitive institutional or personal data, report the incident as follows:
1. STEP AWAY from the computer
- DO NOT touch it, or take any action until advised by the Information Policy & Security Offices.
- DO NOT attempt to login, or alter the compromised system.
- DO NOT power it off.
These actions will delete forensic evidence that may be critical to your incident.
2. IMMEDIATELY CALL, no matter what time of day or night or weekday or weekend or holiday, until you get to a human. Try in this order:
- UISO directly at 812-855-UISO (8476) (business hours)
- UITS Network Operations Center at 812-855-3699 (24x7)
- UITS Support Center at 812-855-6789 (24x7)
When you reach the Support Center or Network Operations Center, ask staff to contact UITS Data Center Operations so that a PAGE can be sent to the University Information Security Office (UISO). A representative from UISO will then call you back.
Please ALSO REPORT the incident yourself, using one of the following methods:
- Use our online incident reporting form (authentication required).
- Send an email to outlining the incident details.
3. DO NOT discuss the incident with any other parties until you are authorized. This is critical to ensure that only accurate information is disseminated, rather than suppositions or guesses as to what happened.
4. Begin writing a detailed description to be shared with the Incident Team: what made you suspect the incident, what you know happened thus far, information on the machine and the data affected, and what actions have been taken so far.
5. For production services such as web sites or applications, plan remedial action to restore service and when. Consider bringing up a new machine to host the site or posting a "down for maintenance" banner.
NOTE: take caution if restoring service from a backup - especially if you're uncertain when the compromise occurred. Its possible you could restore a backup snapshot taken after the compromise.
- Investigation and coordination
The UIPO and UISO are charged with the investigation and coordination of incidents where the loss, corruption, inappropriate disclosure, or exposure of information assets is suspected. When the UIPO and/or UISO are notified, an Incident Team will be assembled to advise and assist in containing and limiting the exposure, in investigating the incident, in obtaining the appropriate approvals, and in handling notification to the affected individuals and agencies.
The organizational unit experiencing the incident is fully responsible for allocating the resources needed to lead and achieve an appropriate and timely resolution of the incident. The unit experiencing the incident "owns" the response to the incident. The UIPO and UISO will provide oversight and guidance to the process to ensure a consistent, efficient and thorough response, and to ensure that all necessary approvals are received.
For more information on information security incident management at IU, see: Information Security Incident Management.
- Collecting Information about IT-related incidents
- IP address(es)
- Operating system and version
- Manufacturer, model, and serial number
- Usernames of users and system administrators of the machine
- Approx. date/time of compromise, if known
- List of software installed
- Attack vector (if you know/suspect a particular program/service)
The UISO has experienced and certified forensic engineers on staff in the event that an in-depth investigation is necessary. The time required to conduct an investigation will vary greatly from one incident to another; no two incidents are alike. Accurately collecting all necessary information is essential to a forensic investigation, and must remain a higher priority than returning equipment within a designated time frame. While a two week minimum is usually reasonable, please understand that it is only an estimate.