...
A. Event Categorization
This list is not comprehensive and other categories may be added to help with the reporting process. Security events must be categorized according to the potential impact or threat to the confidentiality, integrity, and availability of the University's electronic information and/or information systems. Categorization is necessary in order to assess the risk to the University's business services and operations, and to determine the appropriate response.
Incident Types
TYPE
DESCRIPTION
Attempted Intrusion
A significant and/or persistent attempted intrusion that stands out above the daily activity and could result in unauthorized access of the target electronic information or information system.
Denial of Service
Intentional or unintentional denial of service (successful or persistent attempts) that affects or threatens to affect a critical service or denies access to all or one or more large portions of the University's network.
Malicious Code
All instances of successful infection or persistent attempts at infection by malicious code, such as viruses, Trojan horses, or worms.
Policy Violation
Access or use of the university's electronic information or information systems that violates Rowan policies and may present a risk to the University's electronic information or information systems.
Reconnaissance Activity
Instances of unauthorized port scanning, network sniffing, resourcing mapping probes and scans, and other activities that are intended to collect information about vulnerabilities in the University's network and to map network resources and available services.
Social Engineering
An instance (or instances) where an attacker uses human interaction to obtain or compromise information about the University, its personnel, or its information systems.
System Compromise/Intrusion
All unintentional or intentional instances of system compromise or intrusion by unauthorized persons, including user-level compromises, root (administrator) compromises, and instances in which users exceed privilege levels.
Unauthorized Use
Any activity that is not recognized as being related to University business or normal use.
Incident Severity Levels
Rating the severity of an incident is a subjective measure of its threat to Rowan's operations. The severity level helps determine the priority for handling the incident, who manages the incident, and the incident response plan.
The following factors help determine severity level:
- Scope of impact, such as department, school or unit, campus, or University-wide.
- Criticality of the information system.
- Sensitivity of the information stored on or accessed through the system or service.
- Probability of propagation. Is the incident contained or can it spread beyond its current boundaries?
| SEVERITY | DESCRIPTION |
|---|---|
| Critical | Potential operational disruption across a campus or all campuses. May have one or more of the following characteristics:
|
| High | Potential operational disruption of a school or unit (e.g., Camden or SOM University Hospitals). May have one or more of the following characteristics:
|
| Medium | Impact to a business unit that is serious and possibly results in an operational disruption. May have one or more of the following characteristics:
|
| Low | Impact to a business unit is minor and may present an operational risk if not addressed immediately. May have one or more of the following characteristics:
|
B. INCIDENT HANDLING AND REPORTING
...