From Tremors to Earthquakes–Incident Response and Digital Forensics in a University Environment [CANCELED]

Nothing shifts the IT landscape like a major security incident. When preventative security controls inevitably fail, an incident response program is necessary to reduce the friction during the transition back to normal operations. Such a program should be able to handle both major and minor cybersecurity incidents. Like all cybersecurity operations, this can be challenging for university IT environments with distributed, federated governance. Oftentimes, personnel who are first responders are not well versed in security practices. Distributed incident response plans must take this into account. Information security teams can be quite small, with limited resources. At UC Davis, we have developed an operational incident response process for such a use case, which includes fast triage of minor incidents, full forensic analysis for major incidents, follow-up remediation, and communication protocols for all stakeholders. We present our approach for all stages of incident response: preparation, detection, remediation and recovery, including decision points for escalation and reporting.