Re: Incident Response Procedures

[Steve Schuster <sjs74 () CORNELL EDU>]

Jason,

        I'd be willing to help out but this topic is so broad that it
would take an entire document to outline.  Is your desire to think through
enabling the right offices, building a security team, working through
responses for specific types of incidents, etc?

        There's a pretty good document on the ECAR site that outlines
incident resposne procedures taken from NIST Special Publication 800-61.

        If you'd like to give me a call I'd be happy to discuss what we
have in place, what's working, what's not and how we're moving forward.

sjs


\At 04:21 PM 7/21/2004, you wrote:
> We are working on formulating an Incident Response Policy and Procedure.
> We've scoured the net and found little that aids us in the Higher Ed sector;
> most are geared for business.  So, not wanting to unnecessarily reinvent the
> wheel, we are soliciting input.
>
> Does anyone have any IRP/Procedures that they would be willing to share?
>
> Thanks,
> Jason Brooks
>
> Jason Brooks
> Information Security Technician
> Longwood University
> 201 High Street
> Farmville, VA 23909
> (434) 395-2034
> mailto:brooksje () longwood edu
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at http://www.educause.edu/cg/.

---------------------------------------------------------------------------------------------------------------------
Steve Schuster
IT Security Office
Cornell University
Work -- (607)255-8825   Cell -- (607)351-1386
---------------------------------------------------------------------------------------------------------------------

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.