IT Security Incident Response Policy

The IT Security Incident Response Policy defines the responsibilities of KU Lawrence campus staff when responding to or reporting security incidents. It delineates roles within the Computer Security Incident Response Team (CSIRT) and outlines which members of University administration should be involved in different types of security incidents.

Roles and responsibilities:

IT Security Officer—The IT Security Officer is responsible for assessing the initial scope of a security incident, assembling the Enterprise Incident Management Team, and appointing the Incident Manager.

Incident reporting—All members of the University community are required to report actual or suspected security incidents. All suspected security incidents should be reported to the KU Customer Service Center at 785-864-8080 or itcsc@ku.edu.

Incident manager—This role is designated by the IT Security Officer and will lead the response to the incident. This is a technical role and will coordinate the work of log collection, evidence preservation, and analysis activities.

Enterprise Incident Management Team:

When a breach of Category 1 data has been declared, the following University administration roles will be added to the incident response team:

• Senior administrator for impacted unit(s)
• Chief Information Officer
• IT Security Officer
• Representative from the Office of General Counsel
• Director of Security
• Director of Strategic Communications
• Others on an as-needed basis

The Enterprise Incident Management Team will work with the Director of Strategic Communications to determine when and how to inform individuals outside the EIMT regarding the incident.

Members of the Enterprise Incident Management Team and all IT staff shall receive annual incident response training. Tabletop exercises recreating a significant security incident will be conducted at minimum every two years.

Incident Severity Levels:

Incident response will be addressed based on the severity of the incident. Incident severity takes several factors into account: sensitivity of the data involved, number of end users impacted, and its overall impact on the ability of the University to fulfill its mission. Incident severity also will be used to determine who manages an incident, who is informed about an incident, and the extent and immediacy of the response to the incident.

High:

A security incident will be considered “high” if any of the following characteristics are present:

1. Threatens to impact (or does impact) systems critical to the University’s ability to function normally. This includes but is not limited to: email, courseware, human resources, financials, internet connectivity, or portions of the campus network
2. Poses a serious threat of financial risk or legal liability
3. Threatens to expose (or does expose) Category 1 data as defined by the Data Classification Policy
4. Threatens to propagate to or attack other networks, or organizations internal or external to the University
5. Terroristic threats or other threats to human life or property when received by the IT Security Office

Medium:

A security incident will be considered “medium” if any of the following characteristics are present:

1. Threatens to impact (or does impact) a significant number of systems or people. The University can still function, but a group,  department, unit, or building may be unable to perform its mission
2. Systems impacted contain only Category 2 and/or Category 3 data
3. Impacts a non-critical system or service

Low:

Low severity incidents have no characteristics from the “medium” or “high” categories and may include the following:

1. Only a small number of people or systems are impacted
2. Systems impacted contain only Category 3 data
3. Little to no risk of the incident spreading or impacting other organizations or networks

Incident Response Summary Table:

The following table summarizes how IT security incidents will be handled based on severity. It includes response times, who will manage each type of incident, and reporting requirements.