This plan outlines the most general tasks for Incident Response.  It will be supplemented by specific internal guidelines and procedures that describe the use of security tools and communication channels. These internal guidelines and procedures are subject to amendment as technology changes. It is assumed that these guidelines will be documented in detail and kept up-to-date.

In addition to documenting procedures, all Information Technology managers shall become familiarized with the incident response process to recognize and report incidents as quickly as possible. All faculty and staff are encouraged to report suspected information security incidents as quickly as possible.

Incident Management guidelines and supporting Incident Management (IM) toolkit is provided below:

• Toolkit – IM – Response Guide
• Toolkit – IM – Leadership Summary
• Toolkit – IM – Email Leadership Summary
• Toolkit – IM – Manager Activity Tracking Sample
• Toolkit – IM – Technical Investigation Report
• Toolkit – IM – Checklist of significant steps for Incident Response and Handling

The Information Security department maintains and utilizes several tools that scan the University’s environment and network traffic, looking for threats. Depending on the severity of found threats or vulnerabilities, they may warn affected users, disconnect affected machines, or apply other mitigations.  In the absence of indications of sensitive data exposure, the information security department communicates vulnerabilities to the network/IP owner identified in the IPAM database (http://ipam.utoronto.ca/) and pursues available technology remedies to reduce that risk.

Additionally, the University at large may identify and report suspicious activities, adverse events, or running malicious code. The affected Unit may call an incident on their own or may work with Information Security to formalize the incident if required.

Where any data or other artifacts are collected in the investigation, it is imperative to retain those for forensic review and establish a chain of custody. This evidence might be used in litigation should it become necessary.

All units shall make the first attempt in classifying incidents according to the severity matrix listed in previous sections of this plan. If incidents are deemed medium or high severity, they need to be reported to the Institutional Security Response Team ( security.response@utoronto.ca.) for awareness, assistance and/or escalation to the CISO. The Insititutional Team can also assist in the classification of the incident if required.

Incident Response teams shall document their guidelines for interactions with stakeholders regarding incidents and prioritize incidents with the highest severity level. During incident handling, the organization will need to communicate with multiple stakeholders. Because these communications often need to occur quickly, Incident Response teams shall predetermine communication guidelines.

The incident manager will typically have the responsibility to handle communications as part of the incident response  process. In case a CSIRT was established to handle a particular incident, the incident manager will prepare the communication in coordination with the team and target the appropriate audience. The workflow and table are below.

*It refers to the time it would take for the incident response team to respond to incidents.

The Incident Response program’s primary objective is to mitigate and contain the risk associated with computer security incidents. Some of the most common types of incidents are:

• Phishing attacks,
• Malware and viruses,
• Denial of resources or services,
• Unauthorized access or attempts to gain unauthorized access,
• Inappropriate use of network resources,
• Ransomware
• Data breaches
• Changes to system hardware, firmware or software without owner’s knowledge,
• Any other unlawful activity involving computer networks and processing equipment.

Following the list of common incident types, playbooks are generally created to handle security incidents systematically and consistently. Incident response teams should leverage “Playbooks” as much as possible.  Some examples are provided below:

UTM – Ransomware playbook

General security incident response training, awareness and practices that shall be followed by Units:

• Review and adopt the Incident Response Plan (this document) or use it to create your own plans.
• Familiarize with the methodologies associated with the incident response process, including incident containment and playbooks.
• Review plans once a year and train team members as appropriate for operational readiness.
• Submit incident response plans to be incorporated in the DAI-IRSA annual assessment process.

Incident Response Handling (Practical Guide)

1. Review checklists and toolkits
2. CSIRT
3. Communication Plan
4. Incident Reporting
5. Tabletop Exercises

In addition to documenting procedures, units shall provide training and awareness to  staff and faculty to recognize and report incidents as quickly as possible.

When reporting an incident to information Security, follow the procedure detailed on the page linked below:

IRP Main Web Page

External resources may be required depending on the severity of the incident and the data types or assets involved. The engagement of those resources would typically incur additional costs to the Unit.   These may include: