Incident Handling Policy

Subject:

Information Technology

Policy:

IT Security Incident Response Policy

Revised:

03/07/2025          

Effective date:

5/15/2019

Review date:

Responsible Party:

 Information Technology Directory/CIO

Physical Copies

Roles and Responsibilities

This section provides roles and responsibilities for the key parties that may be involved with incident response activities.

Incident Response Team

The Incident Response Team (IRT) is responsible for the preparation, notification, response, and recovery activities that are required to prevent or limit impacts of security incidents. The members of the IRT and the responsibility associated with their role include:

If 1) is unavailable, the responsibilities should be performed by 2), then 3).

Roles and responsibilities may be expanded to include additional individuals and third parties based on the nature and severity of an incident.

Shared Responsibilities

The full IRT will share the following responsibilities under the guidance of the MTU CIO, CISO and ISO:

• Identifying, analyzing, reporting, and responding to security incidents in accordance with this plan.
• Ensuring incident response plans and supplemental documents are established and stored in a manner that ensures their availability in the event of major infrastructure outages or loss of facilities.

• Reviewing the quality and effectiveness of incident management activities and procedures.
• Maintaining up-to-date knowledge incident response best practices, common security threats, indicators of compromise, containment methods, etc.
• Maintaining appropriate contacts with law enforcement, regulatory bodies, and other relevant authorities as needed.
• Communicating the incident response requirements outlined within this plan to employees and relevant third parties.
• Determining the incident communication process for internal and external parties. This includes defining when, what, and to whom to communicate incident response information.
• Determining if additional follow-up and corrective actions are needed in response to security incidents.
• Preparing and maintaining policy guidelines for establishing and implementing incident response procedures.
• Coordinating communication and training related to the incident response policy and procedures.

Incident Response Procedures

Preparations 

1. Information Technology Services will:
   1. maintain a list of assets previous to a suspected security incident or request for investigation.
      1. Servers
         1. Inventory (Appendix C,System Inventory)
      2. Log inventory
         1. Solarwinds repository, (Appendix C, Log Inventory)
      3. Networks
         1. Network Diagram, floorplans, remote locations/cloud environment (Appendix C, Network Map)
      4. Applications
         1. Diagram outlining remote locations/cloud environments
            Appendix C, System Inventory
      5. Incident Response Team Directory
         1. Appendix D, Contact Information
2. Rank list by level of importance, identify backup locations and frequency, monitor traffic patterns so you can create baselines to be used for comparisons later.
   1. Appendix C, System Inventory
   2. Appendix C, Log Inventory

  c.   Maintain a Communication Plan to be used in the event of an incident
                                1. Appendix B, Communication Templates

Key stakeholders that will be involved in leading this communications plan include Executive Director of Communications and Marketing, University of Montana Legal Counsel, Director of Information Technology/CIO, and University of Montana CISO.

d. Apply security patches to firmware and applications regularly
                                1. Patch logs (Appendix C,System Inventory)

e. Use security software to protect data

  f. Provide Information Technology security training to all users.

Suspected Incident

When a suspected security incident or request for investigation has been identified the following shall occur:

1) Detect the issue

1. Gather everything possible on the incident.
2. Keep a Log Book

Logging of information is critical in situations that may eventually involve federal authorities and the possibility of a criminal trial. The implications from each security incident are not always known at the beginning of, or even during, the course of an incident. Therefore, a written log should be kept for all security incidents that are under investigation. The information should be logged in a location that cannot be altered by others.

Manually written logs are preferable since on-line logs can be altered or deleted.
The types of information that should be logged are:

3. Dates and times of incident-related phone calls. 
4. Dates and times when incident-related events were discovered or occurred. 
5. Amount of time spent working on incident-related tasks. 
6. People you have contacted or have contacted you. 
7. Names of systems, programs or networks that have been affected

Users should immediately notify:

IT Helpdesk
Ph: 406-496-4244

2) Isolate the system

1. Server/Desktop/Laptop Device
   1. Disconnect network cable/turn off device WIFI
   2. Do not power off or reboot the system
       
2. Contain the breach
   1. Implement network segmentation to limit the attacker’s movement within the network
       
3. Secure critical systems

Prioritize security systems with sensitive data (student records, financial systems, research data), refer to:
(Appendix C, System Inventory)

3) Analyze

1. Computer Support/Information Technology/Network Services – Analyze the issue
   1. Investigate, analyze information, determining entry point/when it started and the breadth of the incident

1. Confiscate Hardware
    
2. Notify the owner, if the owner is not already aware.
    
3. Patch the threat’s entry point.

2.If the incident involves personally identifiable information/ financial account information

the incident would be a ‘High’ Severity– Notify Incident Response Operational Team

• Director Information Technology/CIO – Montana Technological University
• Assistant Director Information Technology – Network – Montana Technological University
• Assistant Director Information Technology – Information Services – Montana Technological University
• Executive Director of Marketing and Communications – Montana Technological University
• Chancellor – Montana Technological University
• Executive Vice-Chancellor/Provost – Montana Technological University
• Vice Chancellor of Administration and Finance/Liason Officer -Montana Technological University
• Chief Information Office – University of Montana
• Chief Information Security Officer – University of Montana
• Legal - UM
• Emergency Manager/Incident Commander

-Provide regular updates to incident Response Team on the status of the incident response

- If breach has been confirmed,

                Use caution when releasing information

All release of information must be authorized by the UM CISO, Montana TechCIO, Montana Tech Administration (Chancellor, Executive Vice Chancellor/Provost), approved by Legal -UM and the Executive Director of Communications and Marketing). 

Also, incident specific information, such as accounts involved, programs or system names, are not to be provided to any callers claiming to be a security officer from another site. All suspicious requests for information (i.e., requests made by callers claiming to be a CSA for another site), should be forwarded to the University of Montana CISO. If there is any doubt about whether you can release a specific piece of information contact the University of Montana CISO and appropriate Montana Tech administrative head.

Please note, that if Outlook Web/Web Email is available, you should also assume it has been compromised

Vice Chancellor of Administration and Finance is responsible for contacting Montana Risk Management and Torte Defense and approving Vendors (Appendix D)

Note: The insurance carrier can help with State/Federal Notification

4) Eradicate the problem

• Remove malware: Clean infected systems
• Remediate vulnerabilities: Patch systems, strengthen security controls (e.g... multi-factor authentication, intrusion detection systems).

5) Recover from the incident

• Restore critical systems from backups using Restore Process
• IT Team->EmergencyDocs->Emergency Response Binder ->RestoreProcess.docx

6) Post incident activity

• Conduct a thorough review: 
  
  After an incident has been fully handled and all systems are restored to a normal mode of operation, a follow-up postmortem analysis should be performed. The follow-up stage is one of the most important stages for handling a security incident. All involved parties (or a representative from each group) should meet and discuss actions that were taken and the lessons learned. All existing procedures should be evaluated and modified,
  
  Analyze the incident to identify weaknesses and areas for improvement in security measures and response procedures.
  
  Questions to ask:
  1. Was the response time adequate following the initial detection?
  2. Were notification processes followed? Were relevant stakeholders kept informed of the incident and response status?
  3. Were any steps or actions taken that might have inhibited the recovery?
  4. What would the staff and management do differently the next time a similar incident occurs?
  5. What corrective action can prevent similar incidents in the future?
  6. What additional tools or resources are needed to detect, analyze, and mitigate future incidents?

If applicable, a set of recommendations should be presented to the appropriate management levels. A security incident report should be written by a person designated by the Montana Tech Director of Information Technology/CIO and distributed to all appropriate personnel.
 

• Implement corrective actions: Make necessary changes to security policies, procedures and technologies
   
• Employee training: Conduct security awareness training for all employees to improve their ability to recognize and respond to phishing attacks.

7) Implement necessary steps to prevent the incident from occurring in the future 

Severity

Severity should be defined for every incident by using the system’s criticality within Montana Technological University’s List of Critical Systems  (Appendix C, System Inventory) and considering the sensitivity of information stored on or access by the system. The Incident Response Team will prioritize the incident based upon its potential impact.

Impact addresses the potential effect an incident is likely to have on staff, students, reputation, or financial position of MTU. If an incident falls under multiple scenarios, the most severe scenario will be chosen.

Severity Table

Communication Systems

The communication channels that will be used during an incident are outlined in the table below. During a high-visibility, critical, and/or extremely pervasive incident, the IRT may leverage a specific physical or virtual “Situation Room” to centralize communications and operations.

If a “Situation Room” is established, the incident commander will ensure that the following actions occur:

• Publish situation room location, web conferencing, phone bridge, and (as applicable) hours staffed.
• Develop a shift schedule for round-the-clock operations if applicable.
• Coordinate food, beverage, and break schedules.
• Monitor and manage phones.
• Monitor and manage incident emails and mailing list, and members/groups/teams’ activities.
• Track official daily operational schedules and meeting schedules.
• Establish a digital repository for incident-related logs, evidence, emails, documents, etc.
• Establish a physical repository and evidence custodianship.
• Monitor open-ticket actions.
• Return any resources loaned or displaced during incident.
• As appropriate, shred any documents not requiring retention.
• Clean all white boards.
• Request a resupply of items needing to be replenished for future incidents.

Internal Notifications

In the event of an incident, it is critical that relevant internal stakeholders are notified and updated appropriately as outlined in this section. The CIO or CISO will inform the IRT and other key individuals of the security incident and provide them with any information necessary.

Executive Team & Board of Regents Escalation

Security incidents may need to be escalated beyond the IRT to leadership depending on the severity of the incident. Incidents will be escalated based on the following scale:

External Legal Counsel

The University of Montana General Counsel is responsible for determining if external legal counsel needs to be engaged. Generally, incidents that involve potential unauthorized access to regulated client or employee data will require input from external, specialty counsel.

See (Appendix D, Contact Information) for contact information

Service Providers and Other External Parties
 

Depending on the nature of the incident, communication with other outside parties may be necessary, such as technology service providers or incident response specialists. These include, but are not limited to:

• [Incident response consultant]
• [Forensics specialists]
• [Public relations firm]
• [Software vendors]
• [and more][A1] 

External service providers will not be engaged without approval from the State of Montana’s Risk Management and Tort Defense, UM CISO and MTU Director of I.T./CIO to ensure the service provider is appropriate and has been pre-approved or is approved by MTU’s cyber insurance provider as needed. The current cyber insurer may need to provide approval before a third-party is engaged in order to ensure any claim is covered. To facilitate this, the UM CISO will engage MTU’s Vice Chancellor of Administration and Finance and UM Legal Counsel to contact the insurer as soon as practicable following discovery of a security incident, in order to facilitate quick response. Please refer to the Insurance Notification section for details.

The MTU Director of I.T./CIO  is responsible for acting as the primary point of contact for external service providers and ensuring that they receive clear direction and appropriate oversight throughout the response process.

Regulatory and Law Enforcement Reporting
 

The Vice Chancellor of Administration and Finance in consultation with internal and external Legal Counsel, is responsible for determining the extent that Federal and State regulatory notification need to be made in connection with a security incident. There could be additional regulatory and law enforcement reporting requirements based on the incident scope and potential impact on clients and employees.

Notifications to Affected Parties
 

Certain security incidents will require notification to students, partners, staff, or other individuals, when authorized by Legal Counsel. An assessment will be required to determine the extent of the incident, the type of information access or obtained, and the likely risk of harm caused to constituents by the incident, to determine the notification requirements.

The Director of Information Technology/CIO in consultation with the UM CISO and internal and external Legal Counsel, is responsible for identifying and approving the notifications that need to be issued to individuals in response to security incidents.