University Business - August 2007 - (Page 21)

VIEWPOINT Data Breach Incidents Don’t assume a breach has happened before an investigation has been done. By Alan Brill and Jim Leonard Editor’s Note: While reports of university network hacking are becoming more prevalent, the reality is not always what it seems. In the past year, a number of schools have determined that hacker-related incidents they thought had happened in fact had not. What follows is one such incident, a cautionary tale that ultimately saved untold time and expense. The names, as they say, have been changed to protect the innocent. HEN THE NEWS CAME from the IT team to the university’s general counsel, it was devastating. A computer worm had been identiﬁed in one of the university’s ﬁnancial servers, and apparently the worm had discovered more than a quarter million credit card records. Even worse, the team had determined that the records were not encrypted, despite the claims made by the software vendor. As a major university with students from almost every state, the university understood that the potential cost of issuing notiﬁcations under 40 diﬀerent data loss notiﬁcation laws and providing basic remediation services could easily (and almost immediately) exceed $1 million. But rather than panic, university ofﬁcials had a plan. With wisdom gleaned from earlier incidents, they understood that fast, sure-footed action was needed and knew that a number of organizations would have to be involved. Within hours of learning of the incident, a conference call was convened, chaired by the general counsel (who was involved in order to deal with the compli- W The cost of issuing data loss notiﬁcations and providing remediation services could easily exceed $1 million. cated reporting laws, as well as potential individual or class-action litigation). The call included senior management, the CFO’s representative, several IT representatives, and the university’s public relations team. The group then reached out to computer forensic specialists to serve as an independent source of technical assistance and, if needed, to provide support for the university’s remediation eﬀorts. A computer forensic investigation was launched immediately to determine, based on objective evidence, exactly what had happened and to understand why unencrypted credit card data was on the server. At the same time, a task group began to plan how to carry out notiﬁcation rapidly and eﬀectively, should it be required THE FORENSIC ANALYSIS The technical investigation involved working closely with the university’s technical staﬀ to gather the evidence from various machines. The key was to gather the data in a forensically sound way. That is, the procedures used to collect the various ﬁles, logs, and so on, had to be done in a way that could permit the data to be entered into evidence in any future court proceedings. If forensic accuracy were lost or a chain of custody broken, the evidence needed to defend the university’s interests could be rendered useless. Some of the data collection was done by the university’s IT staﬀ. For other particularly sensitive data, the original hard drives were sent to one of our laboratories for analysis, allowing day-to-day processing to continue on a backup server. Information collected included the contents of the ﬁle server, which housed ﬁnancial data, as well as internet, proxy, and other log ﬁles. Because of the type of routers and network infrastructure in place, investigators were also able to capture what is called “Netﬂow” data, which documented very detailed internal systems processes. Once the data reached the computer forensic lab, engineers started piecing it all together and time-correlating the data on the various logs. Within hours, the foAlan Brill is senior managing director of Kroll Ontrack, a ﬁrm that provides technology-driven services and software to help recover, search, analyze, and produce data eﬃciently and costeﬀectively. Jim Leonard is senior client executive for Kroll. universitybusiness.com August 2007 | 21 http://universitybusiness.com

Table of Contents for the Digital Edition of University Business - August 2007

Contents
College Index
Company Index
Advisory Board
Editor's Note
People Watch
Sense of Place
Viewpoint
Admissions
On the Hill
Future Shock
Independent Outlook
Facility Focus
Wanted: Foreign Students
Service With a Star
Beneficial Benefits
Addition By Subtraction
Report from EduComm 2007
Report Card
Internet Technology
What's New
Calendar of Events
Direct Connect
End Note

University Business - August 2007