The document discusses incident response at a university fusion center. It outlines common security incidents like phishing, ransomware attacks, and lost/stolen devices. Effective response requires clear policies, a well-coordinated incident response team (CSIRT), and standardized procedures. The CSIRT is led by a CISO and includes experts from IT, legal, auditing, and HR. The CSIRT's key responsibilities are identifying, mitigating, reviewing, and reporting security incidents to preserve data confidentiality, integrity and system availability.

1. Fusion Center ITS
Security and Privacy
Operations
Enhancing cybersecurity and upholding data privacy in incident response
and security operations.
by Muhammad Atif Imtiaz

2. Overview Incident Response
Security Goals
Preserve confidentiality, integrity and
availability of enterprise data
Incident Benefits
Improve efficiency, reduce impact, and
provide legal evidence
University Policies
Defined policies mandate incident reporting
and response
General Procedures
Standardized steps to identify, mitigate and
review incidents

3. Incident Response
• Phishing - Accounts Compromised: Employees fall victim to phishing scams, leading to
compromised user accounts and access to sensitive university data.
• Compromised File: Malicious files are unknowingly downloaded, introducing malware or
ransomware into the university's systems.
• Ransomware: Critical university data is encrypted by ransomware, preventing access and
disrupting operations until a ransom is paid or the incident is resolved.
• Stolen Property: University-owned laptops, mobile devices, or other equipment containing
sensitive information are lost or stolen, posing a data breach risk.
• Final Comments: Effective incident response requires a well-coordinated team, clear policies,
and robust procedures to mitigate the impact and ensure the university's security and operations
are restored.

4. What is an Incident
A computer security incident is any accidental or deliberate action that
compromises the confidentiality, integrity, or availability of data and IT
resources.
Incidents also include the use of technology for criminal activities like
fraud, theft, and child pornography.
Policy violations may be considered security incidents as well.

5. Incident Response Goals
1 Preserve confidentiality,
integrity, and availability
Safeguard enterprise information assets
2 Minimize impact on the university
Rapidly contain and resolve incidents
3 Provide data for management
decisions
Equip leaders to choose appropriate actions
4 Establish a repeatable process
Ensure a structured, logical response
approach

6. Incident Response Goals (con't)
Increase the efficiency and effectiveness of incident response to minimize impact.
Reduce the financial and human resource burden on the university.
Provide legal evidence in case of liability issues.

7. University Policies
Incident Reporting
University policies require IT
administrators to report and
respond to security incidents.
Key Policies
1. 4-OP-H-5 Information
Technology Security
2. 4-OP-D-2-G Payment Cards
3. 4-OP-H-12 Information
Privacy
Incident Response
The policies outline the
university's requirements for
incident response and
management.

8. Team Leadership and Duties
1 CSIRT Leader
CISO or operations lead manages CSIRT
2 Convene CSIRT
Assemble the security incident response team
3 Coordinate Response
Direct team training, manage incidents, and report to CIO

9. Team Expertise
Chief
Information
Officer (CIO)
Provides executive
leadership and
oversight for IT
strategy and
operations.
Chief Auditor
Office
Ensures compliance
with policies,
procedures, and
regulations.
Legal
Provides legal
guidance and risk
assessment for
incident response.
Human Resources
Manages personnel
issues and employee
disciplinary actions.

10. # **Role of the CSIRT**
1
1
5
5
10
10
—
Key Responsibilities
The CSIRT serves as the first responder to computer security incidents, performing vital functions in
identifying, mitigating, reviewing, and reporting findings to management.
CSIRT activities include incident identification, triage, containment, eradication, and recovery - ensuring
the confidentiality, integrity, and availability of IT assets.
The CSIRT coordinates closely with stakeholders like IT, legal, HR, and leadership to effectively manage
and document the incident response process.