---

RATIONALE:

This document is intended to set forth the standard process to follow in the case of a network-based incident and to provide guidelines for judging that incident's severity. The guiding principle for OIT incident handling is to make the most effective use of OIT resources to preserve IT integrity while minimizing impact on individual users and the UMBC user community as a whole. Since locking a user's account may prevent that user from performing academic or regular work, it is treated with all due consideration and is only done when necessary. If all OIT incident handlers follow the process outlined below, everyone will know what to expect, how to behave, and be generally protected should someone issue a complaint over action taken.

GUIDELINES:

Base process:

The OIT incident handler is to contact either the CIO or the Director of Infrastructure and Support with the issue and related details. Contact should be attempted via work phone, pager/cell phone, and home phone for each.

Note that any measures taken in time-critical incidents (without Administration approval) are intended to be temporary and must be reviewed by an Administration official within two working days.

Sample cases:

Issue	Criticality	Probable Cause	Suggested Action
System is attacking others via network	Judgment call based on intensity of attack; network saturation is time-critical, 1 attack/day is non-time-critical	- Compromised system (virus, trojan, other) - Malicious user	Block attacking system's network access
System is sending out worm-style email (e.g. Sircam)	Non-time-critical	- Infected system	Notify owner; if not resolved or acknowledged within two business days, block infected system's access to network
Multiple logins from all over the country/globe to an account	Non-time-critical (unless account is performing active/intense attacks)	- Compromised account	Lock the user account
Reasonable belief that account is being used to attack other systems	Judgment call based on intensity of attack	- Compromised account - Malicious user	Lock the user account

Note that any email notification of a user should be CC'd to the CIO, the Director, and abuse@umbc.edu.

DEFINITIONS:

Incidents are considered "time-critical" if an OIT incident handler has reason to believe that an incident originating within the UMBC domain poses a threat to:

• IT integrity within UMBC;
• IT integrity outside UMBC;
• The health or safety of self or others;

AND that even a relatively small delay (on the order of 30 minutes) in addressing the incident will make the threat/impact significantly more severe.

"IT integrity" refers to data integrity, data confidentiality, system availability, network availability, system performance, network performance, and the reliable availability of other services and hardware offered or used by OIT and the UMBC campus.

"Locking an account" entails one or more of the following: randomizing the account's password (Core or departmental), denying access to MyUMBC, and LDAP-based deactivation (which denies the account access to Core logins, ResNet/DHCP, modems, and remote access to Core email).

"Blocking a system's network access" entails blocking network traffic to and from the system at the router.

Current CIO: Jack Suess
Current Director of Infrastructure and Support: Mike Carlin
Current Vice Provost For Academic Affairs: Dr. Moreira

PROCEDURE REFERENCE: