Information Security Incident: An actual or suspected event such as a violation of computer security policies, acceptable use policies, or standard security practices. These events may adversely affect the security of KSU's information resources or systems. Examples include:

  • Web site defacement
  • Theft or loss of a computing device that may contain PII whether or not such device is owned by KSU
  • Unauthorized access to data, especially confidential data like a person's name and social security number
  • Computer infected with malware such as a worm, virus, Trojan Horse, or botnet
  • Reconnaissance activities such as scanning the network for security vulnerabilities
  • Data Breach
  • Misuse of Information Resources or Systems
  • Denial of Service attack
  • Security weakness such as an un-patched vulnerability

Personal Identifiable Information (PII): Per KRS 365.732 this is defined as individual's first name or first initial and last name in combination with any one (1) or more of the following data elements, when the name or data element is not redacted:

  • Social Security number;
  • Driver's license number; or
  • Account number or credit or debit card number, in combination with any required security code, access code, or password to permit access to an individual's financial account.

Information Technology Security Incident Response Team: – Members vary depending upon nature of the incident. Should contain at a minimum, General Counsel, CIO and Public relations. May include other individuals as needed such as the senior administrator for the affected unit, a representative from the police department, or director from human resources.

PROCESS:

Reporting Security Incidents:

  1. Any member of the KSU community who suspects or becomes aware of an Information Security Incident must report the incident immediately by:
  2. Contacting the IT Help Desk or Chief Information Officer by phone (preferred), e-mail or in person.
  3. Contacting the department supervisor, who must contact the CIO immediately.
  4. If the department supervisor is not available, then the individual must contact the division Vice President, who must contact the CIO immediately.

Responding to Incidents:

Once reported, the Chief Information Officer and General Counsel will conduct an initial investigation to determine if an information security incident has occurred by reviewing the type, scope and impact of the incident (see Appendix A). Based on the findings, one of the following processes will take place:

  1. If it has been determined that an information security incident has not occurred, the event will be documented and closed.
  2. If it has been determined that an information security incident has occurred and restricted or confidential data/information has been impacted, on a per incident basis, the creation of an Information Technology Security Incident Response Team (IT-SIRT), will be created to further investigate the incident. The incident will be