Main content
11
39
Our Hours Today:
Closed

CyberSecurity Investigation Clearance Form

A cybersecurity investigation is to be conducted only with the prior approval of the director of Campus Technology Services and senior campus executives. Each Security Investigation must be fully and completely documented. Nonemergency investigations must have approval of two senior college administrators (president or vice presidents).

Documentation of security investigations must include:

• Report of DMCA violation (nonemergency investigation)

• Other “due cause” documentation (emergency or nonemergency)

• Identification of security threat type

• Risk analysis – severity of threat and potential exposure

• Log files from threatened/compromised system

• Steps taken to contain threat

• Steps taken to contain possibility of exposure of sensitive materials or private information

• Steps necessary to prevent recurrence

The following policy pertains to all Security Investigations:

In an emergency, the Privileged User conducting the investigation may view, copy, modify, or delete data placed on a computer or network by another user – and not normally shared - if and only if the Privileged User has documented probable cause that the contents of the data poses an immediate threat to the system or network. Examples of an immediate threat would include a “Root Kit” or other “Trojan Horse” back door, a worm or virus, or other materials or activities that pose a threat to the normal operation of college computer networks or systems.

• The Privileged User conducting the investigation may view, copy, modify, or delete data placed on a computer or network by another user if the Privileged User has documented that there is probable cause that the account is being used for illegal purposes (copyright violation, commerce, harassment, piracy or other crime) and has a completed Security Investigation Clearance Form.

• The Privileged User conducting the investigation may not erase or tamper with any system log file for any reason other than to archive the log file. If it is necessary to remove a log file from the system due to storage limitations, then the log file must be archived to tape for permanent storage. The archived records must provide an uninterrupted history of events on the system for auditing purposes. Exceptions must be approved in writing by the director of Campus Technology Services and IT security personnel.

Investigation of: _____________________________________________

To be Conducted by: ______________________________________________

Approved By: Director of Campus Technology Services: ___________________________

 

Date: ______________

Senior Administrator #1 Date:________

Name: (Please Print) _______________

Signature________________________________ 

Senior Administrator #2 Date:________

Name: (Please Print) __________________

Signature________________________________  

 

Security Investigation Clearance Form