IT Security Incident and Data Breach Response Procedure

Version: 1.4

Date: 23rd May 2018

Date

Name

Version

Change description

31-May-11

George R Vaughan

1.0

Second Draft

31-05-12

Mike Morris

1.1

Yearly Update

21-Nov-12

George R Vaughan

1.2

Document Review & Edit

23-April-18

Barun Shaw

1.3

Document Review – Data Breach Response process added as per GDPR requirement

23-May-2018

Jon Massie

1.4

Format amended

Table of Contents

General

Definitions

Procedure

Responsibilities

Security Incident Reporting

Security Alerts

IT Security Incident and Data Breach Response Flowchart

Reporting Procedure

Response to a Security Incident

Control

Appendix A – Response to Specific Information Security Incidents

Appendix B – Security Incident Tracker

Appendix C – IT Security Incident and Data Breach Reporting Form

Appendix D – Data Breach Notification: ICO

Appendix E – Data Breach Notification: Data Subjects

Appendix F – Data Breach Notification: Press/Media

1. General

The purpose of this procedure document is to explain and provide guidelines for IT security incident (including personal data breach) response at the Rugby Football Union (RFU).

1.1 Definitions

Security Incident: Each event which might damage the confidentiality and/or integrity and/or availability of the information/information assets

Security Alert: A report regarding a security incident sent by a monitoring system.

End Users/Users: Company employees who require access to company’s IT systems as part of their function and/or are exposed to internal information.

Threat: Undesired event which may damage the IT systems of the company.

Vulnerability – Information system weakness which may be exploited by a threat.

Attack – A series of acts designed to achieve classified or restricted access or information.

Personal Data - any information relating to an identifiable person who can be directly or indirectly identified by the information.

Personal Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. It also means that a breach is more than just about losing personal data.

2. Procedure

2.1Responsibilities

IT Helpdesk: responsible for monitoring IT Helpdesk mailbox for any email on IT security or data breach incident. Informing the Service Operations Manager in case any security incident is reported.
Head of Service Delivery: overall ownership of incident/data breach management

Service Operations Manager: defining, tracking, and monitoring IT security incidents.
Data Protection Officer (DPO): responsible for data breach incidents. In case the security incident involves personal data i.e. data breach, the Service Operations Manager will liaise with the DPO to assess the risk of data breach.
End users: responsible for alerting the IT Helpdesk of any security incident or suspicion of one.
RFU Management: responsible for disciplinary action for security violations by employees

2.2 Security Incident Reporting

Users shall report any security incident, suspicion of a security incident, any irregular activity noticed in the user accounts and in their surroundings or personal data breach to the IT Helpdesk/Legal Team by phone, email or in person.

Examples of security incidents:

Violation of IT policies by the employee or other employees.
Existence or suspicion of existence of a breach in the security of one of the systems.

Suspicion that information was damaged or about to be damaged (exposed, altered, or deleted).
Sudden lockdown of an account.
Unreasonable last entry date/time (where applicable).
Signs of unknown activity (example: new files, desktop changes).
Attempts (successful or unsuccessful) of retrieving unauthorized access to a system or information stored in it.

Service unavailability.
Change in the computer's software or hardware.

Examples of personal data breach:

access of personal information by an unauthorized third party;

sending personal data to an incorrect recipient;
computing devices containing personal data being lost or stolen; 
alteration of personal data without permission

2.3 Security Alerts

The IT Team shall use a variety of tools in order to monitor and detect unauthorized activity throughout the company's computing systems and network components (operating systems, network servers, applications, and such).
These tools must include IDS systems logging, auditing and analyzing log files on a regular basis (at least once a day).
Alerts produced by these tools shall be directed to the Service Operations Manager.

2.4 IT Security Incident and Data Breach Response Flowchart

2.5 Reporting Procedure

1. It is the responsibility of all of the end users to report any suspicion of a security incident and/or personal data breach immediately.

2. End users may consult the Service Operations Manager or the Legal team before reporting an incident.

3. The Service Operations Manager shall conduct a preliminary analysis of the incident and instruct the end user how to act.

4. If the preliminary analysis of the incident reveals involvement of personal data, then the Service Operations Manager shall liaise with the DPO to assess the risk of the personal data breach.

5. If the personal data breach is likely to result in a high risk to individual’s rights and freedoms then the ICO (or the appropriate supervisory authority) and/or the individuals shall be notified within 72 hours of being aware of the data breach.

6. The Service Operations Manager shall take all the necessary steps in order to manage the incident. Putting together a response team that involves additional expert members such as a DB, account manager, the legal department, and other relevant parties shall be considered.

7. When the necessary actions involve a change in the regular action of systems, such as disabling a system, the Head if Information Technology shall specifically approve such an action.

8. It is the responsibility of the Service Operations Manager to compose a report which includes:

Time and date of the event.
Contact details of the individual who reported the incident
Specific description of the event.
Description of the actions that were taken (if applicable).

Recommended actions to prevent reoccurrence.

For personal data breach the following additional information shall be collected:

Description of the nature of the personal data breach including, where possible:

the categories and approximate number of individuals concerned; and

the categories and approximate number of personal data records concerned;

a description of the likely consequences of the personal data breach; and
a description of the measures taken, or proposed to be taken, to deal with the personal data breach, including, where appropriate, the measures taken to mitigate any possible adverse effects.

2.6 Response to a Security Incident

1. A security incident may be handled in different ways based on its source and its potential damage. However, the general process of responding to such an event will include the following steps:

Preliminary analysis, data gathering, and documentation – This step shall be carried out throughout the entire process until the end of the event and will include gathering of all known information regarding the incident. The information will be gathered by the head of service delivery from internal sources (e.g. users, members of the System Team) as well as from external sources (e.g. the Internet, publicly published information, external specialists, advisors). All relevant information should be gathered and stored.

If the source of the event is a result of an employee's policy violation or if the incident requires legal actions, all data and evidence must be stored carefully.
Maintaining the integrity and reliability of the evidence is crucial for cases in which legal actions may take place. The legal advisor or any person on their behalf shall advise regarding the gathering and storing of evidence.

2. Immediate response – In any case in which the incident is not over, the Service Operations Manager shall take measures to ensure the fastest way to terminate the incident and prevent further damage.

3. The Service Operations Manager shall analyze the information gathered and identify the following elements:

Source of the event.

Systems involved in the incident (whether damaged or could be damaged by the incident).
Potential impact of the incident on the systems, their integrity, confidentiality, and availability.
Current status of the incident (e.g. over, ongoing).

4. Response plan – Building a response plan for the incident.

In case the event involves credit card data, the Service Operations Manager shall consider reporting the incident to the relevant credit card company and implementing the credit card company’s incident response protocols.

5. Execution of the response plan.

6. Learning from mistakes – After the event is over, the Service Operations Manager shall study the event in order to identify and understand the breaches, vulnerabilities, and malfunctions which enabled the incident to occur and define the measures which must be taken in order to prevent the reoccurrence of the event.

7. Summary report – The Service Operations Manager shall compose a report. Refer to point ‘8’ of the previous section for details of the report.

8. The summary report shall be communicated to all relevant parties for the handling of similar events.

9. Implementation of rectification and prevention measures which will include the following:

Repairing of the damage which was not repaired during the event.
Installation of relevant software updates.
Implementation of extra monitoring measures.
Updating relevant security policies.
Notifying the employees of the incident and its results.

Taking legal actions against external relevant elements.
Taking disciplinary actions against relevant internal elements.

3. Control

3.1 The Service Operations Manager shall initiate check-ups and drills in order to examine the implementation of this procedure, at least once every year.

3.2 The Service Operations Manager shall initiate annual training for all parties of the incident response process as part of company’s awareness plan.

4. Appendix A – Response to Specific Information Security Incidents

This appendix emphasises the method of dealing with specific IS incidents.

No.

Event

Response

Alert of a communication components’ breach (System logs, unexplained changes in system/security files)

[May affect confidentiality, integrity, availability]

Inform the Service Operations Manager
The system team will take measures in order to discover the source of the breach and to assess the amount of damage caused.
The team will implement countermeasures in order to prevent another similar breach.
The Service Operations Manager will consider updating the company’s management or law enforcement authorities.

Denial of Service (DoS) attacks, unexplained server failure.

[May affect availability]

The system team will inform the Service Operations Manager. The team will investigate the event’s source and properties.
The team will consider the possibility for of a system security upgrade.
The Service Operations Manager will update management, if necessary.

An employee has shared their user ID and/or password with another person.

Immediate report to the employee’s direct manager, who will consider taking disciplinary measures along with the HR team.

Employee operated under another employee’s user identity, after leaving their station unlocked.

[Disciplinary]

The exposed employee’s password will be replaced immediately.
The event will be reported to the direct manager and the Service Operations Manager.
Both employees will be warned against any other security exceptions.

Employee intentionally exposed other employee’s password.

[Disciplinary]

The event will be reported to the direct manager and the Service Operations Manager
The exposed employee’s password will be replaced immediately and will be handed to them personally.
The employee will be warned against any other security exceptions.

Employee discovered unsuccessful access attempts to their account by a foreign entity (initial discovery).

[Attempt to affect confidentiality, integrity, and availability]

The employee will immediately report the incident to the direct manager and Service Operations Manager. The employee will replace their password.
The system team will investigate the event.
The team will consider the possibility of system or user security upgrades.

Appendix B – Security Incident Tracker

Appendix C – IT Security Incident and Data Breach Reporting Form

Appendix D – Data Breach Notification: ICO

Appendix E – Data Breach Notification: ICO

Appendix F – Response to Specific Information Security Incidents