Incident Response and Misuse of IT Facilities Policy

In the event of a security incident occurring, it is important that all Externis employees are aware of their responsibilities and the procedure by which incidents can be most effectively and efficiently brought to a satisfactory conclusion. The procedures as defined below are best practice within Externis Group. 

Where investigation of a security incident indicates misuse of IT facilities approved legal procedures will be implemented as defined in this policy.

Incident Reporting

The types of incidents that must be reported include, but are not limited to:

• Incidents reported from Systems and Networks (system failures, unusual activity)
• Anomalous events (unusual or suspicious behaviour noted in logs or activity reports)
• Reports from external sources (threats, customer queries, complaints, press reports)
• Incidents observed by network users (on local PC’s or servers)
• Any unauthorized access to Externis Data or Systems.

Reporting an incident

All observed or suspected security incidents; weaknesses or threats to should be reported to IT Services.
In no instance should any user attempt to prove a suspected weakness as this could lead to a potential misuse of the system. Where users note that any software does not appear to be working correctly, i.e. according to specification, they should report the matter to IT Services. 
Where a user suspects that the malfunction is due to a malicious piece of software e.g. a computer virus, they should stop using the computer, disconnect it from the Externis network and report the matter to IT Services.

Disabling Accounts/Network Connections

IT Services may disable user accounts and/or network connections:

• Pending investigation of a security incident or where investigation of an incident
• To contain a confirmed security breach and prevent other Externis network devices from becoming affected by the incident.

Records of Security Incidents

IT Services will collate and analyze records of security incidents and will report to the Externis Board any trends which emerge and recommend any additional action which should be taken to try to prevent their occurrence in the future.

Misuse of facilities

Where Externis employees or Third parties are found to have misused Externis IT facilities the Director of information Services will inform the Externis Head who will determine what further action should be taken.