Re: Compromised Accounts Procedures

["Pollock, Joseph" <PollockJ () EVERGREEN EDU>]

Our process is still evolving - this hasn't happened frequently.  In the most recent case, we observed that the 
contents of the mailbox had been deleted and some rules set to delete incoming mail.

I had a conversation with the user and said not only should the original password not be reused, it should be changed 
on any other account where it had been used (there may have been information concerning social networking accounts in 
the mailbox folders, etc.)  The user reply was "You mean, like on my bank account?"   Sigh...

Joe Pollock
Network Services
The Evergreen State College

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Bidwell, 
Lesley
Sent: Wednesday, May 23, 2012 12:07 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Compromised Accounts Procedures

We follow a similar process and also verify that no rules have been added to mail accounts to forward or delete 
messages.  

Lesley A. Bidwell
Director of Networking and Telecommunications Services SUNY College at Oneonta
607 436 2628
Lesley.Bidwell () oneonta edu


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Rich 
Graves
Sent: Wednesday, May 23, 2012 2:25 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Compromised Accounts Procedures