project*

1.2 Purpose

The purpose of this policy is to outlay protocols and guidelines on how to effectively respond to incidents or events that affects the computers, data, or networks of Dream Land Department of Information Resources.

1.3 Scope

This policy explicitly applies to all departments and individual users of Dream Landing. Users who travel remotely and VPN into the main office shall also adhere to this policy. Any individual who has been issued an electronic or compute device, which includes cell phones, pagers, PDAs, iPads, and Android devices, maintains a fiduciary obligation to this organization. All networking resources, including servers, PCs, switches, routers, firewalls, and additional compute equipment is included within this policy.

1.4 Definitions

Information Systems: is defined as computers/mainframes that are used for collecting, storing processing data and delivering information. The primary operating system used for this information system is Microsoft Operating System (OS). Servers are also defined as information systems because they provide resources to be utilized for employees of Dream Land organization and external users.

Security Incident: is defined as an event in which there is a diversion from the normal security regulations. The unintentional disclosure, compromise of data, an unauthorized activity that disrupts the confidentiality, integrity, and/or the availability of Information systems.

Physical Security: physical protocols put into place to prevent human intrusion into a secure of confidential area. These protocols include key-pads, dead-bolt lock doors, security cameras, and personnel.

10

Employees

IT Technicians

Severity Levels

Level 1

Level 2

Level 3

Level 4

Identifying and Reporting Incidents

Dallas Jones

i. Employees: In the event of a Security incident, including suspicious events, all users must report promptly to the Computer Security Incident Response Team (CSIRT)/IT Technician, and/or company owner for issues relating to but not limited worms, viruses, spyware, malware, denial of service attacks, or other unusual encounters.

ii. IT Technician: The IT Technician must examine and determine if the attack is real and designate a severity level. If the severity is of significant level to alert and seek additional CSIRT support, the IT Technician will do so. The technician may also contact the CERT Coordination Center, which has the most recent information on viruses and worms.

Severity Levels

a) Severity Level One- a security incident that detected on an internal system that can be handled by anti-virus software (AVG)

b) Severity Level Two- small numbers of system probes detected on external systems

c) Severity Level Three- if a penetration or denial of service attempt(s) with limited impact on operations is detected and anti-virus software cannot handle it, this severity should be used because of potential risk to finances and public relation.

d) Severity Level Four- a threat to public safety or life

11

Eradication

Restoration

Log Of Security Incident

Annual Report

Mitigation and Containment

Dallas Jones

Eradication & Restoration

i. Eradication- Once the origins of the problem are identified, all malicious code and corrupting Security incidents are removed. The magnitude of damage must be assessed and a plan of action prepared and communicated to the appropriate parties

ii. Restoration- Once the above protocols are taken care of and upon authorization by the CSIRT/IT Technician and owner, the availability of affected systems, devices and network can be restored.

Documentation

i. Log of Security Incident – CSIRT/IT Technician shall maintain a log of all Security Incidents recording the date, time of recognition, the affected computer or device, a summary of the intrusion and the corrective measure taken to solve the issue.

I . Annual Report - CSIRT/IT Technician shall report annually to the CEO providing statistics and summary-level information about significant incidents reported, and provide recommendation to mitigate from known risk.

12

Questions?