Information Protection and Security

• A laptop containing sensitive information is stolen (physical intrusion or theft).
• Sensitive information is inadvertently posted on a web site without access restrictions (configuration error). 
• Access restrictions are inadvertently changed or removed, exposing the data (configuration error).
• A system compromise raises questions as to the continuing confidentiality of the data (intrusion).  
• Keylogging software or other spyware is found on a host (malware). 

Recovery advice depends on the particular compromise vector.  Refer to advice on the presenting incident as well as responding to the data exposure issue.
 

• Preserve any log files that show access to the sensitive data.
• Secure all copies of the material from further compromise using the most suitable method(s):
  • Remove the sensitive data from the host or web pages
  • Disconnect the host from the network
  • Physically secure the data in a location with limited (and, if possible, logged) access.   Suggested method:
    • Place the material in an envelope
    • Seal the envelope and sign across the sealed flap
    • Secure the in a locked drawer or cabinet
• Notify key staff.   This may include:
  • Dean or departmental director, business manager, immediate supervisor
  • Data Custodian
  • Law enforcement, Risk Management, and Property Management  (See procedures for Physical Intrusion or Theft.)
  • Notify  abuse@rutgers.edu of the incident.  See How do I report a computer abuse incident?  for guidance as to what information to provide.
• Include information as to the scope of the loss.  Suggested descriptive metrics:
  • the type of data.  Examples include:
    • Social Security Numbers
    • credit card numbers
    • human subject research data
    • protected health information
    • financial records
    • student records
    • other NPPI (Non-public personal information)
    • passwords associated with accessing sensitive data, regardless of the location of the data
  • estimate of the number of records exposed or lost
  • estimate of the number of individuals that may be impacted
• If the material was on a web site:
  • take steps to remove cached copies from search engines.  
  • identify other departmental or University sites with copies of the information (or similar information). Scanning tools are cited on the NPPI page.