Evidence Collection Policy Essay

1.What are the main concerns when collecting inference?That you are thorough, collect anything, do it in the proper and official manner, and that you do not tamper with or alter boththing.2.What precautions are necessary to sustain evidence state? usu all(prenominal)y what is done is all of the evidence is duplicated several times and any mental processes obscure with the probe are done with the duplicates to ensure that the actual evidence isnt altered in any way.3.How do you ensure evidence trunk in its initial state?It is duplicated and then stored in climate controlled conditions.4.What education and procedures are necessary to ensure evidence is admissible in flirt?Whoever conducts the investigation does so in a previously mandated, official, and heavyly recognize manner. entropy Systems credentials Incident Response constitutionI. TitleA. realise discipline Systems shelter Incident Response insurance B. Number 20070103-sec misfortunerespC. Author(s) David Mil lar (ISC cultivation security measure) and Lauren Steinfeld (Chief Privacy Officer) D. Status ApprovedE. appointment Proposed 2005-10-24F. Date RevisedG. Date Approved 2007-01-03H. Effective Date 2007-01-16II. Authority and Responsibility study Systems and computing is responsible for the operation of Penns selective learning net domesticates (PennNet) as well as the establishment of instruction security policies, guidelines, and standards. The Office of Audit, Compliance andPrivacy has authorization to develop and oversee policies and procedures regarding the privacy of personal information. These offices therefore micturate the potentiality and responsibility to specify security chance response requirements to protect those networks as well as University data contained on those networks.III. Executive SummaryThis insurance defines the response to computer security concomitants.IV. PurposeThis indemnity defines the steps that force-out essential use to ensure that s ecurity accompanyings are identified, contained, investigated, and remedied. It also provides a process for documentation, appropriate reporting internally and externally, and communicating so that organizational learning occurs. Finally, it establishes responsibility and accountability for all steps in the process of addressing computer security incidents.V. Risk of Non- contourWithout an effective incident response process, corrective action whitethorn be delayed and ruinful effects unnecessarily exacerbated. Further, proper communication allows the University key learning opportunities to improve the security of data and networks. Individuals who fail to comply are subject to sanctions as appropriate chthonic Penn policies.VI. Definitionssecret University selective information includes* Sensitive Personally Identifiable instruction development relating to an separate that reasonably identifies the individual and, if agreed, could cause operative harm to that individual o r to Penn. Examples whitethorn include, besides are not limited to cordial security measures numbers, credit card numbers, bank account information, student grades or disciplinary information, salary or employee performance information, donations, patient health information, information Penn has promised to keep confidential, and account passwords or encryption keys employ to protect advance to hugger-mugger University Data.* Proprietary trainingData, information, or intellectual property in which the University has an exclusive legal interest or ownership right, which, if compromised could cause signifi plentyt harm to Penn. Examples may include, but are not limited to, vexation planning, financial information, trade secret, copyrighted literal, andsoftware or comparable material from a third party when the University has agreed to keep such information confidential.* Any otherwise data the disclosure of which could cause significant harm to Penn or its constituents. warranter Incident. There are two types of guarantor Incidents electronic computer certificate Incidents and Confidential Data Security Incidents.* A reckoner Security Incident is any event that threatens the confidentiality, integrity, or availability of University corpses, applications, data, or networks. University systems include, but are not limited to servers, desktops, laptops, workstations, PDAs, network servers/processors, or any other electronic data storage or transmission art.* A Confidential Data Security Incident is a subset of Computer Security Incidents that specifically threatens the security or privacy of Confidential University Data. User. A Penn user is any faculty, staff, consultant, contractor, student, or agent of any of the above.VII. ScopeThis constitution applies to all Users. It applies to any computing devices owned or leased by the University of Pennsylvania that visualise a Computer Security Incident. It also applies to any computing device regar dless of ownership, which either is used to store Confidential University Data, or which, if lost, stolen, or compromised, and based on its privileged admission fee, could lead to the unauthorized disclosure of Confidential University Data. Examples of systems in scope include, but are not limited to, a Users in person owned home computer that is used to store Confidential University Data, or that contains passwords that would give access to Confidential University Data. This insurance policy does not cover incidents involving the University of Pennsylvania Health System (UPHS) information systems, which has a separate incident response policy. ISC breeding Security leave behind coordinate with UPHS as appropriate when UPHS computing devices, data, or personnel are involved.VIII. pedagogy of PolicyA. Overview of Penns Incident Response ProgramAll Computer Security Incidents must be inform to ISC Information Security promptly. agnize part B below.All Confidential Data Securit y Incidents musta. Generate the creation of an speedy Response police squad, as designated by theInformation Security Officer (ISO), on a per incident basis. See Section C below. b. Follow appropriate Incident Handling procedures. See Sections C and D below. iii. ISC Information Security, under the direction of the Vice professorship for Information Systems and Computing (VP-ISC) is responsible for logging, investigating, and reporting on security incidents. See Sections D and E below.B. Identifying and Reporting Computer Security Incidentsi. Users and Local Support Providers (LSPs). In the event that a User or an LSP detects a suspected or confirmed Computer Security Incident, the User must report it to his or her Local Security Officer or IT Director for issues including but not limited to viruses, worms, local attacks, denial of service attacks, or possible disclosure of Confidential University Data. ii. Local IT Management. Local IT Management must notify ISC Information Secu rity of all Computer Security Incidents, except for categories of incidents that ISC Information Security may designate in Appendix I of this policy. iii. ISC Information Security. ISC Information Security shall notify appropriate systems administrators and other personnel of all requisite and attack incidents, as well as all suspicious bodily function incidents when it believes that an administrators system is at risk. The systems administrators leave behind then work with ISC Information Security to properly address the incident and minimize the risk of future occurrences.C. Immediate Response teami. Purpose. The target of each Immediate Response aggroup is to supplement Penns information security infrastructure and minimize the threat of damage resulting from Computer Security Incidents. ii. Per Incident Basis. An Immediate Response team shall be created for Confidential Data Security Incidents. iii. Membership. Membership on the Immediate Response Team shall be as designate d by the ISO. In virtually cases, members shall include a deputy from ISC Information Security and from the affected School or Centers technical and focusing staff. iv. Responsibilities. Responsibilities of the Immediate Response Team are to treasure the incident and follow incident handling procedures, appropriate to the incident as checkerd by the ISO. v. Confidentiality.Immediate Response Team members bequeath persona information about security incidents beyond the ImmediateResponse Team only on a need-to-know basis, and only after consultation with all other team members. D. Incident Handling. For incidents requiring the formation of an Immediate Response Team, the side by side(p) is a list of response priorities that should be reviewed and followed as recommended by the ISO. The most important items are listed first i. Safety and Human Issues. If an information system involved in an incident affects human life and resort, responding to any incident involving any life- sarcastic or safety-related system is the most important priority. ii. approach Urgent Concerns. Schools and Centers may have urgent concerns about the availability or integrity of small systems or data that must be intercommunicate promptly. ISC Information Security shall be available for consultation in such cases. iii. Establish Scope of Incident. The Immediate Response Team shall promptly work to establish the scope of the incident and to identify the extent of systems and data affected.If it appears that personally identifiable information may have been compromised, the Immediate Response Team shall immediately inform the VP-ISC and the Chief Privacy Officer (CPO). iv. Containment. Once life-critical and safety issues have been resolved, the Immediate Response Team shall identify and implement actions to be haven to reduce the potential for the spread of an incident or its consequences crosswise additional systems and networks. Such steps may include requiring that the sys tem be disconnected from the network. v. Develop Plan for preservation of Evidence. The Immediate Response Team shall develop a plan promptly upon learning about an incident for identifying and implementing appropriate steps to preserve evidence, consistent with needs to restore availability.Preservation plans may include preserving relevant logs and screen captures. The affected system may not be rebuilt until the Immediate Response Team determines that appropriate evidence has been preserved. Preservation will be addressed as quickly as possible to restore availability that is critical to maintain business operations. vi. inquire the Incident. The Immediate Response Team shall investigate the causes of the incident and future obviating(prenominal) actions. During the investigation phase, members of the incident response team will attempt to determine exactly what happened during the incident, especially the vulnerability that made the incident possible. In short, investigators wi ll attempt to answer the hobby questions Who? What? Where? When? How? vii. Incident-Specific RiskMitigation.The Immediate Response Team shall identify and recommend strategies to mitigate risk of harm arising from the incident, including but not limited to reducing, segregating, or better protecting personal, proprietary, or mission critical data. viii. Restore Availability. Once the above steps have been taken, and upon authorization by the Immediate Response Team, the availability of affected devices or networks may be restored. ix. Penn-Wide Learning. The Immediate Response Team shall develop and arrange for implementation of a communications plan to spread learning from the security incident passim Penn to individuals best able to reduce risk of recurrence of such incident.E. old Response Team (SRT). If the ISO or CPO in their judgment believe that the incident reasonably may cause significant harm to the subjects of the data or to Penn, each may recommend to the VP-ISC or As sociate Vice President for Audit, Compliance and Privacy (AVP-OACP) that a Senior Response Team be established. The Senior Response Team shall be comprised of senior-level officials as designated by the VP-ISC or AVP-OACP. The Senior Response Team shall i. Establish whether additional executive management should be briefed and the plan for such briefing. ii. Determine, with final approval by the everyday Counsel, whether Penn shall make best efforts to notify individuals whose personal identifiable information may have been at risk. In making this determination, the following factors shall be considereda. legal duty to notifyb. length of compromisec. human involvementd. esthesia of datae. existence of evidence that data was accessed and acquiredf. concerns about personnel with access to the datag. existence of evidence that machine was compromised for reasons other than accessing and acquiring datah. additional factors recommended for consideration by members of the Immediate Resp onse Team or the Senior Response Team. iii. Review and approve any external communication regarding the incident.F. Documentationi. Log of security incidents. ISC Information Security shall maintain a logof all reportable security incidents recording the date, School or Center affected, whether or not the affected machine was registered as a critical host, the type of Confidential University Data affected (if any), number of subjects (if applicable), and a summary of the reason for the intrusion, and the corrective measure taken. ii. life-sustaining Incident Report. ISC Information Security shall issue a Critical Incident Report for every reportable security incident affecting machines qualifying as Critical Hosts, or other priority incidents in the judgment of ISC Information Security describing in detail the circumstances that led to the incident, and a plan to pass the risk. iii. Annual Summary Report. ISC Information Security shall provide annually for the VP-ISC and AVP-OACP a report providing statistics and summary-level information about all significant incidents reported, and providing recommendations and plans to mitigate cognise risks.IX. Best PracticesA. Preserving Evidence It is essential to consult Penn Information Security when handling Computer Security Incidents. However, if Information Security is not available for fate consultation, the following practices are recommended i. Generally, if it is necessary to copy computer data to preserve evidence for an incident, it is a good idea to use bit-wise file-system copy utilities that will produce an exact image, (e.g.UNIX dd) rather than to use file level utilities which can alter some file meta-data.ii. When making forensic backups, always take a cryptographic hash (such as an SHA-1 hash) of both the original aspiration and of the copied object to verify the authenticity of the copy. Consult your System Administrator if you have questions. iii. Assigning members to an Immediate Response Team In cases where an incident involves an investigation into misconduct, the School or Center should consider carefully whom to assign to the Immediate Response Team. For example, one may not wish to assign an IT master copy who works closely with the individual(s) being investigated.X. ComplianceA. Verification ISC Information Security and the Office of Audit, Compliance and Privacy will verify any cognize computing security incidents as having been reported and documented as be by this policy. B. Notification Violations of this policy will be reported by ISC Securityand the Office of Audit, Compliance and Privacy to the Senior Management of the clientele Unit affected. C. Remedy The incident will be recorded by ISC Information Security and any required action to mitigate the denigratory affects of the attack will be initiated in cooperation with the trading Unit Security Officer/Liaison. D. Financial Implications The owner of the system shall bear the costs associated with ensu ring compliance with this policy.E. Responsibility Responsibility for compliance with this policy lies with the system administrator, system owner, and Business Units Senior Manager. F. Time Frame All incidents involving critical hosts systems and networks must be reported immediately. All other incidents should be reported within one business day of determining something has occurred. G. Enforcement Compliance with this policy will be enforced by disconnecting any machines that may compromise the University network, or other machines with Confidential University Data. Workforce members not adhering to the policy may be subject to sanctions as defined by University policies. H. Appeals Appeals are firm by the Vice President for Information Systems and Computing.XI. References1. PennNet Computer Security Policy at www.net.isc.upenn.edu/policy/approved/20040524-hostsecurity.html 2. Critical PennNet Host Security Policy at www.net.isc.upenn.edu/policy/approved/20000530-hostsecurity.ht ml 3. Policy on Computer disconnection from PennNet at www.upenn.edu/computing/policy/disconnect.html 4. Adherence to University Policy at www.hr.upenn.edu/policy/policies/001.asp 5. Policy on Security of Electronic Protected Health Information (ePHI) at www.upenn.edu/computing/security/policy/ePHI_Policy.html Appendix IThe following category of incidents need not be reported to Penn Information Security * Unsuccessful network scans