University Business - August 2007 - (Page 21)

VIEWPOINT Data Breach Incidents Don’t assume a breach has happened before an investigation has been done. By Alan Brill and Jim Leonard Editor’s Note: While reports of university network hacking are becoming more prevalent, the reality is not always what it seems. In the past year, a number of schools have determined that hacker-related incidents they thought had happened in fact had not. What follows is one such incident, a cautionary tale that ultimately saved untold time and expense. The names, as they say, have been changed to protect the innocent. HEN THE NEWS CAME from the IT team to the university’s general counsel, it was devastating. A computer worm had been identified in one of the university’s financial servers, and apparently the worm had discovered more than a quarter million credit card records. Even worse, the team had determined that the records were not encrypted, despite the claims made by the software vendor. As a major university with students from almost every state, the university understood that the potential cost of issuing notifications under 40 different data loss notification laws and providing basic remediation services could easily (and almost immediately) exceed $1 million. But rather than panic, university officials had a plan. With wisdom gleaned from earlier incidents, they understood that fast, sure-footed action was needed and knew that a number of organizations would have to be involved. Within hours of learning of the incident, a conference call was convened, chaired by the general counsel (who was involved in order to deal with the compli- W The cost of issuing data loss notifications and providing remediation services could easily exceed $1 million. cated reporting laws, as well as potential individual or class-action litigation). The call included senior management, the CFO’s representative, several IT representatives, and the university’s public relations team. The group then reached out to computer forensic specialists to serve as an independent source of technical assistance and, if needed, to provide support for the university’s remediation efforts. A computer forensic investigation was launched immediately to determine, based on objective evidence, exactly what had happened and to understand why unencrypted credit card data was on the server. At the same time, a task group began to plan how to carry out notification rapidly and effectively, should it be required THE FORENSIC ANALYSIS The technical investigation involved working closely with the university’s technical staff to gather the evidence from various machines. The key was to gather the data in a forensically sound way. That is, the procedures used to collect the various files, logs, and so on, had to be done in a way that could permit the data to be entered into evidence in any future court proceedings. If forensic accuracy were lost or a chain of custody broken, the evidence needed to defend the university’s interests could be rendered useless. Some of the data collection was done by the university’s IT staff. For other particularly sensitive data, the original hard drives were sent to one of our laboratories for analysis, allowing day-to-day processing to continue on a backup server. Information collected included the contents of the file server, which housed financial data, as well as internet, proxy, and other log files. Because of the type of routers and network infrastructure in place, investigators were also able to capture what is called “Netflow” data, which documented very detailed internal systems processes. Once the data reached the computer forensic lab, engineers started piecing it all together and time-correlating the data on the various logs. Within hours, the foAlan Brill is senior managing director of Kroll Ontrack, a firm that provides technology-driven services and software to help recover, search, analyze, and produce data efficiently and costeffectively. Jim Leonard is senior client executive for Kroll. universitybusiness.com August 2007 | 21 http://universitybusiness.com

Table of Contents for the Digital Edition of University Business - August 2007

Contents
College Index
Company Index
Advisory Board
Editor's Note
People Watch
Sense of Place
Viewpoint
Admissions
On the Hill
Future Shock
Independent Outlook
Facility Focus
Wanted: Foreign Students
Service With a Star
Beneficial Benefits
Addition By Subtraction
Report from EduComm 2007
Report Card
Internet Technology
What's New
Calendar of Events
Direct Connect
End Note

University Business - August 2007

https://www.nxtbook.com/pmg/UB/UB_0520
https://www.nxtbook.com/pmg/UB/UB_0320
https://www.nxtbook.com/pmg/UB/UB_0120
https://www.nxtbook.com/pmg/UB/UB_1119
https://www.nxtbook.com/pmg/UB/UB_1019
https://www.nxtbook.com/pmg/UB/UB_0819
https://www.nxtbook.com/pmg/UB/UB_0719
https://www.nxtbook.com/pmg/UB/UB_0619
https://www.nxtbook.com/pmg/UB/UB_0419
https://www.nxtbook.com/pmg/UB/UB_0319
https://www.nxtbook.com/pmg/UB/UB_0119
https://www.nxtbook.com/pmg/UB/UB_1218
https://www.nxtbook.com/pmg/UB/UB_1118
https://www.nxtbook.com/pmg/UB/UB_1018
https://www.nxtbook.com/pmg/UB/UB_0918
https://www.nxtbook.com/pmg/UB/UB_0818
https://www.nxtbook.com/pmg/UB/UB_0718
https://www.nxtbook.com/pmg/UB/UB_0618
https://www.nxtbook.com/pmg/UB/UB_0518
https://www.nxtbook.com/pmg/UB/UB_0418
https://www.nxtbook.com/pmg/UB/UB_0318
https://www.nxtbook.com/pmg/UB/UB_0218
https://www.nxtbook.com/pmg/UB/UB_0118
https://www.nxtbook.com/pmg/UB/UB_1217
https://www.nxtbook.com/pmg/UB/UB_1117
https://www.nxtbook.com/pmg/UB/UB_1017
https://www.nxtbook.com/pmg/UB/UB_0917
https://www.nxtbook.com/pmg/UB/UB_0817
https://www.nxtbook.com/pmg/UB/UB_0717
https://www.nxtbook.com/pmg/UB/UB_0617
https://www.nxtbook.com/pmg/UB/UB_0517
https://www.nxtbook.com/pmg/UB/UB_0417
https://www.nxtbook.com/pmg/UB/UB_0317
https://www.nxtbook.com/pmg/UB/UB_0217EPUB
https://www.nxtbook.com/pmg/UB/UB_0217
https://www.nxtbook.com/pmg/UB/UB_0117
https://www.nxtbook.com/pmg/UB/UB_1216
https://www.nxtbook.com/pmg/UB/UB_1116
https://www.nxtbook.com/pmg/UB/UB_1016
https://www.nxtbook.com/pmg/UB/UB_0916
https://www.nxtbook.com/pmg/UB/UB_0816
https://www.nxtbook.com/pmg/UB/UB_0816CG
https://www.nxtbook.com/pmg/UB/UB0716
https://www.nxtbook.com/pmg/UB/GlobalSellSheet
https://www.nxtbook.com/pmg/UB/UB_0616
https://www.nxtbook.com/pmg/UB/UB_0516
https://www.nxtbook.com/pmg/UB/UB0416
https://www.nxtbook.com/pmg/UB/UB0316
https://www.nxtbook.com/pmg/UB/UB_0216r2
https://www.nxtbook.com/pmg/UB/UBGuide
https://www.nxtbook.com/pmg/UB/UB0116
https://www.nxtbook.com/pmg/UB/UB
https://www.nxtbook.com/nxtbooks/pmg/ub201511
https://www.nxtbook.com/nxtbooks/pmg/ub201510
https://www.nxtbook.com/nxtbooks/pmg/ub201509
https://www.nxtbook.com/nxtbooks/pmg/ub201508
https://www.nxtbook.com/nxtbooks/pmg/ub201508_ConsultantsGuide
https://www.nxtbook.com/nxtbooks/pmg/ub201507
https://www.nxtbook.com/nxtbooks/pmg/ub201506
https://www.nxtbook.com/nxtbooks/pmg/ub201506_AudioVisualSolutions
https://www.nxtbook.com/nxtbooks/pmg/ub201505
https://www.nxtbook.com/nxtbooks/pmg/ub201504
https://www.nxtbook.com/nxtbooks/pmg/ub201503
https://www.nxtbook.com/nxtbooks/pmg/ub201502
https://www.nxtbook.com/nxtbooks/pmg/ub201501
https://www.nxtbook.com/nxtbooks/pmg/ub201501_FinancialServicesGuide
https://www.nxtbook.com/nxtbooks/pmg/ub201412
https://www.nxtbook.com/nxtbooks/pmg/ub201411
https://www.nxtbook.com/nxtbooks/pmg/ub201410
https://www.nxtbook.com/nxtbooks/pmg/ub201409
https://www.nxtbook.com/nxtbooks/pmg/ub201408
https://www.nxtbook.com/nxtbooks/pmg/ub201408_ConsultantsGuide
https://www.nxtbook.com/nxtbooks/pmg/ub201407
https://www.nxtbook.com/nxtbooks/pmg/ub201406
https://www.nxtbook.com/nxtbooks/pmg/ub201406_AudioVisualSolutions
https://www.nxtbook.com/nxtbooks/pmg/ub201405
https://www.nxtbook.com/nxtbooks/pmg/ub201404
https://www.nxtbook.com/nxtbooks/pmg/ub201403
https://www.nxtbook.com/nxtbooks/pmg/ub201402
https://www.nxtbook.com/nxtbooks/pmg/ub201401
https://www.nxtbook.com/nxtbooks/pmg/ub201401_FinancialServicesGuide
https://www.nxtbook.com/nxtbooks/pmg/ub201312
https://www.nxtbook.com/nxtbooks/pmg/ub201311
https://www.nxtbook.com/nxtbooks/pmg/ub201310
https://www.nxtbook.com/nxtbooks/pmg/ub201309
https://www.nxtbook.com/nxtbooks/pmg/ub201308
https://www.nxtbook.com/nxtbooks/pmg/ub201308_ConsultantsGuide
https://www.nxtbook.com/nxtbooks/pmg/ub201307
https://www.nxtbook.com/nxtbooks/pmg/ub201306_AudioVisualSolutions
https://www.nxtbook.com/nxtbooks/pmg/ub201306
https://www.nxtbook.com/nxtbooks/pmg/ub201305
https://www.nxtbook.com/nxtbooks/pmg/ub201304
https://www.nxtbook.com/nxtbooks/pmg/ub201303
https://www.nxtbook.com/nxtbooks/pmg/ub201302
https://www.nxtbook.com/nxtbooks/pmg/ub201301
https://www.nxtbook.com/nxtbooks/pmg/ub201301_FinancialServicesGuide
https://www.nxtbook.com/nxtbooks/pmg/ub1212
https://www.nxtbook.com/nxtbooks/pmg/ub1112
https://www.nxtbook.com/nxtbooks/pmg/ub1012
https://www.nxtbook.com/nxtbooks/pmg/ub0912
https://www.nxtbook.com/nxtbooks/pmg/ub_cg12
https://www.nxtbook.com/nxtbooks/pmg/ub070812
https://www.nxtbook.com/nxtbooks/pmg/ub0612
https://www.nxtbook.com/nxtbooks/pmg/ub_avguide0612
https://www.nxtbook.com/nxtbooks/pmg/ub0512
https://www.nxtbook.com/nxtbooks/pmg/ub0412
https://www.nxtbook.com/nxtbooks/pmg/ub0312
https://www.nxtbook.com/nxtbooks/pmg/ub0212
https://www.nxtbook.com/nxtbooks/pmg/ub_financeguide0112
https://www.nxtbook.com/nxtbooks/pmg/ub1211
https://www.nxtbook.com/nxtbooks/pmg/ub1011
https://www.nxtbook.com/nxtbooks/pmg/ub0911
https://www.nxtbook.com/nxtbooks/pmg/ub_cg11
https://www.nxtbook.com/nxtbooks/pmg/ub0711
https://www.nxtbook.com/nxtbooks/pmg/ub0611_av
https://www.nxtbook.com/nxtbooks/pmg/ub0611
https://www.nxtbook.com/nxtbooks/pmg/ub0511
https://www.nxtbook.com/nxtbooks/pmg/ub0411
https://www.nxtbook.com/nxtbooks/pmg/ub0311
https://www.nxtbook.com/nxtbooks/pmg/ub0211
https://www.nxtbook.com/nxtbooks/pmg/ub0111
https://www.nxtbook.com/nxtbooks/pmg/ub_financeguide0111
https://www.nxtbook.com/nxtbooks/pmg/ub1110
https://www.nxtbook.com/nxtbooks/pmg/ub1010
https://www.nxtbook.com/nxtbooks/pmg/ub0910
https://www.nxtbook.com/nxtbooks/pmg/ub_2010financeguide
https://www.nxtbook.com/nxtbooks/pmg/ub_2010consultants
https://www.nxtbook.com/nxtbooks/pmg/ub_2010avguide
https://www.nxtbook.com/nxtbooks/pmg/ub0710
https://www.nxtbook.com/nxtbooks/pmg/ub0610
https://www.nxtbook.com/nxtbooks/pmg/ub0510
https://www.nxtbook.com/nxtbooks/pmg/ub0410
https://www.nxtbook.com/nxtbooks/pmg/ub0310
https://www.nxtbook.com/nxtbooks/pmg/ub0210
https://www.nxtbook.com/nxtbooks/pmg/ub0110
https://www.nxtbook.com/nxtbooks/pmg/ub1109
https://www.nxtbook.com/nxtbooks/pmg/ub1009
https://www.nxtbook.com/nxtbooks/pmg/ub0909
https://www.nxtbook.com/nxtbooks/pmg/ub0709
https://www.nxtbook.com/nxtbooks/pmg/ub_fg09
https://www.nxtbook.com/nxtbooks/pmg/ub0609
https://www.nxtbook.com/nxtbooks/pmg/ub0509
https://www.nxtbook.com/nxtbooks/pmg/ub0409
https://www.nxtbook.com/nxtbooks/pmg/ub0309
https://www.nxtbook.com/nxtbooks/pmg/ub0209
https://www.nxtbook.com/nxtbooks/pmg/ub0109
https://www.nxtbook.com/nxtbooks/pmg/ub1208
https://www.nxtbook.com/nxtbooks/pmg/ub1108
https://www.nxtbook.com/nxtbooks/pmg/ub1008
https://www.nxtbook.com/nxtbooks/pmg/ub0908
https://www.nxtbook.com/nxtbooks/pmg/ub0808
https://www.nxtbook.com/nxtbooks/pmg/ub0708
https://www.nxtbook.com/nxtbooks/pmg/ub0608
https://www.nxtbook.com/nxtbooks/pmg/ub0508
https://www.nxtbook.com/nxtbooks/pmg/ub0408
https://www.nxtbook.com/nxtbooks/pmg/ub0308
https://www.nxtbook.com/nxtbooks/pmg/ub0208
https://www.nxtbook.com/nxtbooks/pmg/ub0907
https://www.nxtbook.com/nxtbooks/pmg/ub0807
https://www.nxtbook.com/nxtbooks/pmg/ub0707
https://www.nxtbook.com/nxtbooks/pmg/ub0607
https://www.nxtbook.com/nxtbooks/pmg/ub0507
https://www.nxtbook.com/nxtbooks/pmg/ub0407
https://www.nxtbook.com/nxtbooks/pmg/ub0307
https://www.nxtbook.com/nxtbooks/pmg/ub0207
https://www.nxtbook.com/nxtbooks/pmg/ub0107
https://www.nxtbook.com/nxtbooks/pmg/ub1206
https://www.nxtbook.com/nxtbooks/pmg/ub1106
https://www.nxtbook.com/nxtbooks/pmg/ub1006
https://www.nxtbook.com/nxtbooks/pmg/ub0906
https://www.nxtbook.com/nxtbooks/pmg/ub0806
https://www.nxtbook.com/nxtbooks/pmg/ub0706
https://www.nxtbook.com/nxtbooks/pmg/ub0606-GG
https://www.nxtbook.com/nxtbooks/pmg/ub0606
https://www.nxtbook.com/nxtbooks/pmg/ub0506
https://www.nxtbook.com/nxtbooks/pmg/ub0406
https://www.nxtbookmedia.com