Problem Response Plan

Created: July 2015
Revised / Approved: January 01, 2026
Next Revision / Approval: January 01, 2027
Author: Information Security Director

 

Table of Contents

• Revision Table
• Definitions
• Overview
• Identification / Escalation
• Incident Containment
• Remediate and Eradicate
• Recovery
• Lessons Learned
• Problem Response Procedural Flow Chart
• Emergency Resources
• Appendix A

---

Revision Table

 

Effective Date	Author	Version	Approved	Change Reference
07/15/2015	Director – Information Security	1.0	Christopher Waters	Initial Program Guide
12/13/2021	Gary Sheehan	2.0	Christopher Waters	Formatting / Legal Review
12/12/2022	Gary Sheehan	2.1	Christopher Waters	Formatting / Added Escalation Diagram
08/01/205	Gary Sheehan	2.2	Christopher Waters	Updates for clarity. Formatting
01/01/2026	Gary Sheehan	2.2	Christopher Waters	Updates for clarity. Formatting

 

Definitions

Availability: characteristic of the information by which authorized people can access it when it is needed.

Confidentiality: characteristic of the information by which it is available only to authorized people or systems.

Confidential Information: includes data and information regulated by state, federal or international laws, any data and information regulated by the Payment Card Industry and any Elon data and information that is not considered public.

Elon Assets:

• any equipment that is used in the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information, including printers, storage devices, computers, computer equipment, network equipment and systems and phone equipment and systems.
• any software or technology system used to store, transmit, process, create or present information or data for university use.
• any data or information used by Elon community members while doing business for and on behalf of Elon University.

Elon Data: any information resource that is maintained in electronic or digital format. Data may be accessed, searched, or retrieved via electronic networks or other electronic data processing technologies.

Elon Senior Leadership: University President and members of Senior Staff

Information Security: preservation of confidentiality, integrity, and availability of information.

Information Security Program: a segment of management processes that addresses the planning, implementation, maintenance, monitoring and improving information security within the University.

Integrity: characteristic of the information by which it is changed only by authorized persons or systems in an allowed way.

 

Overview

This Problem Response Plan is the documentation of a predetermined set of instructions and procedures to detect, respond to, and limit the potential impact of malicious cyber-attacks or similar incidents against Elon University’s information system/systems, including Elon Facilities, Elon Assets and Elon Data. This plan was written in accordance with the accepted practices and regulations of the National Institute of Standards and Technology. This Incident Response Plan is designed to provide a guide to address suspected or real incidents that may potentially compromise the integrity of the University’s network, systems, or data. The goal of this Plan is to provide guidance so that all aspects of a perceived or actual threat are managed thoroughly.

This Plan serves as a guideline for Elon University and the Elon Community to protect Elon Assets, Confidential Information and Elon Data from unauthorized access, use, disclosure, disruption, modification, or destruction to provide:

1. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;
2. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
3. Availability, which means ensuring timely and reliable access to and use of

Elon’s Incident Response Plan follows a standard approach to incident response and includes the following activities:

• Identification / Escalation (escalation is this plan refers to contacting the next level of support due to the seriousness or impact of the event)
• Containment
• Remediation
• Recovery
• Review

This Plan supersedes any other prior plans, policies or requirements related to these topics and will be reviewed and evaluated at least annually for potential updates.

 

Incident Identification / Escalation

Upon identification of a suspicious event (the creation and submission of a service ticket) an evaluation of the issue will be conducted by the Service Desk with approval of the Director. After the initial evaluation, the Service Desk Representative will perform one of the following:

1. Address and remediate the issue / event / incident and close the
2. Escalate the issue for further evaluation and identification to Enterprise Applications, TLT, System Administration, Network Support, or Information If the ticket is escalated to another group for remediation, the Service Desk will update the ticket to ensure it can be tracked as an “incident” rather than a support call.
3. Create a Problem Ticket and execute the Problem Response Process by escalating the problem to the appropriate Director. The Director will assume responsibility for containment, remediation, and recovery on the problem.

NOTE: All incidents that include a suspected Data Breach issue or are identified as a Data Breach MUST be escalated to the appropriate group Director for containment, remediation, and recovery in accordance with the Elon Data Breach Response Plan.

Once the incident has been identified and escalated, work can begin on the subsequent response activities. The Director is responsible for:

1. Identifying the appropriate Incident Response Team (IRT) with the appropriate technical and communication skills to contain, remediate and recover from the Typically, an IRT will have the following member roles:
   1. Incident Response Leader (Generally, the Director assigned the problem)
   2. Technical Communication Liaison (Generally the Assistant Director)
   3. One or more technology specialists
2. Ensuring proper communication occurs to all relevant parties about the event or incident, and when necessary, ensuring the event information is escalated to the necessary University Senior Leadership and relevant stakeholders.
3. Ensuring the incident ticket is updated with all relevant information about the incident or event so proper follow-up can be executed if needed. Documentation is a crucial part of the incident Response. The determination of the severity of the incident may not be obvious during the initial phase of the response. Failure to document all activity beginning at the first phase of the response may result in loss of information and/or actions. It should always be assumed that a potential incident may result in legal review as required in a regulatory review, civil action, or criminal investigation. Note that certain communications, reports, and investigation records should be protected by attorney-client privilege when legal counsel participates in the response process. Accordingly, all such communications, documentation and working drafts should be marked as “Attorney-Client Privileged and Confidential” unless or until instructed otherwise by Elon Senior Leadership of legal counsel.

The Director will be responsible for coordinating the use of computer forensics personal and/or technology for one or more phases of this plan. Computer forensics can be utilized to collect and recover destroyed data, create forensic images of affected systems, analyze logs and data for suspicious activity, and coordinate with law enforcement if necessary. When contract computer forensics services are necessary, the contractor will be assigned as part of the response team and will report to the Director.

The Service Desk Representative and the Director should ensure all documentation regarding the identification, escalation, containment, remediation and recovery from the event or incident is recorded in the ticket. Information that should be recorded in the ticket includes, but should not be limited to:

• Time and date that the event
• Level of severity of the impact and/or potential
• Summary of the
• Name the system being targeted (include operating system, IP address and location).
• Attempted corrective actions and whether they were

In the event the ticket system is not available while this incident, a template has been devised (Appendix A) that can be used to record the necessary information until the ticket system is available. Once the ticket system is available the document can be uploaded as an attachment to the problem ticket.

Appendix A is a process flow diagram that shows the escalation process and relationship between the Problem Response Process, the Data Compliance Team, and the Emergency Operations Center.

 

Incident Containment

The purpose of this step is to minimize the potential impact of an incident, with an emphasis on acting swiftly to prevent a worsening situation. Once assigned the problem, the Director should convene an Incident Response Team (IRT) to assist with containment, remediation, and recovery. The IRT will likely be needed to work through the containment, remediation, and recovery phases for the incident.

To help minimize the risk and ensure containment of the incident, the following activities should be considered during this phase while also preserving evidence, log files and other artifacts crucial to retrospective forensic investigation, to identify affected persons or data:

• Secure the area where the incident
• Disable access to impacted data.
• Estimate the impact of
• Estimate the impact of
• Change authentication
• Preserve
• Do not alter affected
• Back up information
• Communicate with relevant

If the severity of the incident/event is critical, the Director must notify Elon University administration as soon as possible. If criminal activity is suspected, the Director must immediately contact Elon University Campus Safety & Police and notify them of the situation.

Remediate and Eradicate

During this phase, the IRT should determine the root cause of the incident and formulate and execute a plan to remediate the incident. Examples of remediation activities are:

• If the incident was caused by a virus, trojan, or malware, make sure all virus definitions are up to date and verify that the antivirus application is functioning properly on all systems.
• If the incident occurred because of an unpatched system or software, verify that all similar systems and all relevant software are reviewed. Also, make sure all software updates are
• If the incident is related to a vulnerability, then an analysis of the affected system as it relates to the vulnerability of the systems, applications, network, and data should be conducted.
• If the incident was a Data Breach, then the Data Breach Response Plan should be implemented as soon as possible.
• If the incident was related to the loss of utilities or a third-party service, the provider should be contacted immediately.

Remediation and eradication can take many forms based on the nature and severity of the incident. Problem Response Playbooks will be developed to help quickly address remediation efforts of known vulnerabilities, incidents, and events.

Communication and documentation are critical components within this phase of the plan.

 

Recovery

During this phase, the IRT should implement steps to ensure the data, application(s), systems, business process, or business procedures are restored to their original functioning status. To ensure a complete recovery the IRT should:

• Compare the affected resource against original
• Ensure business units evaluate the service/system to verify
• Restore the affected resource(s) to production environment
• Perform ongoing system monitoring to ensure system integrity and detect incident
• Ensure all stakeholders involved in the incident are informed about the recovery
• Communicate with appropriate constituency and departmental
• Continue to monitor the affected systems / applications and relevant network

 

Lessons Learned

The objective of this phase is to discuss the incident to determine potential enhancements in policies and/or procedures to reduce the likelihood of this type of incident in the future.

At an appropriate time, the Director responsible for the incident should schedule a “Lessons Learned” meeting with the IRT and affected stakeholders to discuss the problem that occurred and determine if preventative measures could be taken to avoid the incident in the future.

On a quarterly basis, the Information Security Advisory Committee (ISAC) will be responsible for reviewing the incidents over the past 90 days and determining if changes to technology, process policy or procedures are required to prevent further incidents. The Director of Information Security will be responsible for facilitating this discussion. Questions and comments the ISAC can ponder can include:

• What happened? Worm? Virus? Theft? Hacker? Other?
• Why did it happen? Are there vulnerable areas that need to be addressed?
• Where did this incident occur? Was it being monitored?
• How did the incident occur? What was the severity? Was it minimal, serious, or critical?
• Are there potential weaknesses in the system that need to be remediated?
• Was it an internal lapse? If so, how can it be fixed? Was it an unforeseeable external occurrence? If so, how can it be avoided in the future?
• Discuss the results from the “Lessons Learned” follow-up Additional procedures or a change in policy, if needed.

After consolidating the information obtained from the meeting, the ISAC may make recommendations to the Information Security Executive Committee for updates or upgrades to current technologies, processes, policies, or procedures.

 

Problem Response Procedural Flow Chart

Incident Reporting Mechanism

• Community Member reports an event or incident to the Service Desk through the Ticket System (TDX).
• or Another support group within the community will relay information or an incident to the Campus Technology Service Desk.
  • Application generates a ticket.
• Proceed to Campus Technology Service Desk section

Campus Technology Service Desk

1. Evaluate the reported incident (Create a ticket if necessary).

2. Is this an incident or a Problem Ticket?

   • If “Problem”: Proceed to the Responsible Director / IRL section.
   • If “Incident”: Proceed to step 3.

3. Service Desk will conduct containment, remediation and recovery activities.

4. Ensure to update the ticket with all the details necessary to track and review the incident or event.

5. Notify the community member who reported the incident and close the ticket.

Responsible Director / IRL

1. Service Desk Representative will Classify the ticket appropriately and assign the ticket to the appropriate group Director based on the nature of the incident.

2. Is this a “Data Breach” incident?

   • If “Yes”:  Proceed to the Escalation / CIO / Legal / Compliance section

   • If “No”:

     1. Director convenes a Problem Response Team.

     2. Does this problem require senior leadership notification?

        • If “Yes”: Director ensures that Elon Leadership stays informed regarding the status of this problem using SOAR Channel then proceed to Incident Response Team & Resolution section.

        • If “No”: Proceed directly to Incident Response Team & Resolution section.

Incident Response Team & Resolution

1. The Incident Response Team conducts the containment, remediation, and recovery activities.

2. The Director and IRT will ensure to update the ticket with all the details necessary to track and review the incident.

3. The Director and IRT will ensure proper communication with all relevant parties throughout the containment, remediation and recovery activities.

4. Problem solved?

   • If “No”: Loops back step 1 in this section.

   • If “Yes”: The Director notifies all relevant stakeholders that the problem has been resolved and we are back to “normal” operations.

Escalation / CIO / Legal / Compliance

1. IRL notifies the appropriate leadership (CIO) and stakeholders.

2. Leadership will refer to the Data Breach Plan and Process to address this issue.

3. Go to Data Breach Plan and Process.

Emergency Resources

Outside consultants may also be activated and included in the CSIRT by the Incident Response Leader. Outside consultants include but are not limited to:

1. Rusty Gilmore & Associates (Forensic Investigator Risk Management Associates)

• Contact: Russell Gilmore
• Phone:
  • During business hours (Monday-Friday, 8:00 AM-5:00 PM): 919-834-8584 ext. 315
  • After business hours (Please leave message): 919-417-1787
• Email: rgilmore@rmasecurity.com

2. Allied World Insurance (Elon’s cyber insurance provider)

• Contact: Incident Evaluation Hotline
• Phone:
  • During business hours(Monday-Friday, 8:00 AM-5:00 PM): 1-844-736-2428
  • After business hours(Please leave message): 1-844-736-2428
• Email: AWCyberEvent@awac.com
• To initiate Service, you must provide:
  • the full name of the insured organization
  • the name and phone number of the individual authorized to discuss this matter, and if available.
  • the insurance policy number.

3. IT Escalation

1. First Contact

   Christopher Waters
   336-633-8683

2. Second Contact

   Patrick Donohue
   336-269-9015

3. Third Contact

   Gary Sheehan
   336-317-6996

 

Appendix A

 Problem/Incident Resolution Escalation Process