Great American Title Company is hereinafter referred to as "the company."
1.0 Overview
A security incident can come in many forms: a malicious attacker gaining access to the network, a virus or other malware infecting computers, or even a stolen laptop containing confidential data. A
2.0 Purpose
This policy is intended to ensure that the company is prepared if a security incident were to occur. It details exactly what must occur if an incident is suspected, covering both electronic and physical security incidents. Note that this policy is not intended to provide a substitute for legal advice, and approaches the topic from a security practices perspective.
3.0 Scope
The scope of this policy covers all information assets owned or provided by the company, whether they reside on the corporate network or elsewhere.
4.0Policy
4.1Types of Incidents
A security incident, as it relates to the company's information assets, can take one of two forms. For the purposes of this policy a security incident is defined as one of the following:
•Electronic: This type of incident can range from an attacker or user accessing the network for unauthorized/malicious purposes, to a virus outbreak, to a suspected Trojan or malware infection.
•Physical: A physical IT security incident involves the loss or theft of a laptop, mobile device, PDA/Smartphone, portable storage device, or other digital apparatus that may contain company information.
4.2 Preparation
Work done prior to a security incident is arguably more important than work done after an incident is discovered. The most important preparation work, obviously, is maintaining good security controls that will prevent or limit damage in the event of an incident. This includes technical tools such as firewalls, intrusion detection systems, authentication, and
4.3 Confidentiality
All information related to an electronic or physical security incident must be treated as Confidential information until the incident is fully contained. This will serve both to protect employees' reputations (if an incident is due to an error, negligence, or carelessness), and to control the release of information to the media and/or customers.
4.4 Electronic Incidents
When an electronic incident is suspected, the company's goal is to recover as quickly as possible, limit the damage done, and secure the network. Contact the IT Manager immediately. As directed by the IT Manager, the following steps should be taken in order:
1.Remove the compromised device from the network by unplugging or disabling network connection. Do not power down the machine.
2.Disable the compromised account(s) as appropriate.
3.Report the incident to the IT Manager.
4.At the discretion of the IT Manager, Backup all data and logs on the machine, or copy/image the machine to another system.
5.Determine exactly what happened and the scope of the incident. Was it an accident? An attack? A Virus? Was confidential data involved? Was it limited to only the system in question or was it more widespread?
6.Notify company management/executives as appropriate.
7.Contact an IT Security consultant as needed.
8.Determine how the attacker gained access and disable this access.
9.Rebuild the system, including a complete operating system reinstall.
10.Restore any needed data from the last known good backup and put the system back online.
11.Take actions, as possible, to ensure that the vulnerability (or similar vulnerabilities) will not reappear.
12.Reflect on the incident. What can be learned? How did the Incident Response team perform? Was the policy adequate? What could be done differently?
13.Consider a vulnerability assessment as a way to spot any other vulnerabilities before they can be exploited.
4.5 Physical Incidents
Physical security incidents are challenging, since often the only actions that can be taken to mitigate the incident must be done in advance. This makes preparation critical. Applicable policies, such as those covering NPI and confidential data, should be reviewed.
Physical security incidents are most likely the result of a random theft or inadvertent loss by a user, but they must be treated as if they were targeted at the company.
The company must assume that such a loss will occur at some point, and periodically survey a random sampling of laptops and mobile devices to determine the risk if one were to be lost or stolen.
4.5.1 Response
User must fill out a Security Incident Report and give to supervisor or IT Manager. Establish the severity of the incident by determining the data stored on the missing device. This can often be done by referring to a recent backup of the device. One important question must be answered:
Was Confidential data involved?
•If not, refer to "Loss Contained" below
•If Confidential data was involved, refer to "Data Loss Suspected" below.
4.5.2 Loss Contained
First, change any usernames, passwords, account information, WEP/WPA keys, passphrases, etc., that were stored on the system. Replace the lost hardware and restore data from the last backup. Notify the applicable authorities if a theft has occurred.
4.5.3 Data Loss Suspected
First, notify the executive team, legal counsel, and/or public relations group so that each team can evaluate and prepare a response in their area.
Change any usernames, passwords, account information, WEP/WPA keys, passphrases, etc., that were stored on the system. Replace the lost hardware and restore data from the last backup. Notify the applicable authorities as needed if a theft has occurred and follow disclosure guidelines specified in the notification section.
Review procedures to ensure that risk of future incidents is reduced by implementing stronger physical security controls.
4.6 Notification
If an electronic or physical security incident is suspected to have resulted in the loss of
4.7 Managing Risk
Managing risk of a security incident or data loss is the primary reason to create and maintain a comprehensive security policy. Risks can come in many forms: electronic risks like data corruption, computer viruses, hackers, or malicious users; or physical risks such as loss/theft of a device, hardware failure, fire, or a natural disaster. Protecting critical data and systems from these risks is of paramount importance to the company.
4.8 Applicability of Other Policies
This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.
5.0 Enforcement
This policy will be enforced by the Manager and/or Executive Team. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property (physical or intellectual) are suspected, the company may report such activities to the applicable authorities.
6.0 Definitions
Encryption The process of encoding data with an algorithm so that it is unintelligible without the key. Used to protect data during transmission or while stored.
Malware Short for "malicious software." A software application designed with malicious intent. Viruses and Trojans are common examples of malware.
Mobile Device A portable device that can be used for certain applications and data storage. Examples are PDAs or Smartphones.
PDA Stands for Personal Digital Assistant. A portable device that stores and organizes personal information, such as contact information, calendar, and notes.
Smartphone A mobile telephone that offers additional applications, such as PDA functions and email.
Trojan Also called a "Trojan Horse." An application that is disguised as something innocuous or legitimate, but harbors a malicious payload. Trojans can be used to covertly and remotely gain access to a computer, log keystrokes, or perform other malicious or destructive acts.
Virus Also called a "Computer Virus." A replicating application that attaches itself to other data, infecting files similar to how a virus infects cells. Viruses can be spread through email or via
WEP Stands for Wired Equivalency Privacy. A security protocol for wireless networks that encrypts communications between the computer and the wireless access point. WEP can be cryptographically broken with relative ease.
WPA Stands for WiFi Protected Access. A security protocol for wireless networks
that encrypts communications between the computer and the wireless access point. Newer and considered more secure than WEP.
7.0 Revision History
Revision 1.0, 10/13/2012
Revision 2.0, 09/01/2014