{"id":228,"date":"2014-12-09T09:25:55","date_gmt":"2014-12-09T08:25:55","guid":{"rendered":"https:\/\/wpethzprd.ethz.ch\/its\/?p=228"},"modified":"2014-12-09T09:25:55","modified_gmt":"2014-12-09T08:25:55","slug":"how-to-respond-to-it-security-incidents","status":"publish","type":"post","link":"https:\/\/blogs.ethz.ch\/its\/2014\/12\/09\/how-to-respond-to-it-security-incidents\/","title":{"rendered":"How to Respond to IT Security Incidents"},"content":{"rendered":"<p>Security incidents can be triggered by a variety of hazards.<!--more--><\/p>\n<h2>Safety measures that you can implement today<\/h2>\n<p>Prevention and information: Familiarize yourself with the <a href=\"https:\/\/www1.ethz.ch\/safeit\/index_EN\" target=\"_blank\">safeIT<\/a> campaign and our &#171;<a href=\"https:\/\/www1.ethz.ch\/id\/documentation\/rechtliches\/IT-Best_Practice_Rules.pdf\">Best Practice<\/a>&#187; recommendations. Use strong passwords (see bottom of post)<\/p>\n<h2>Self-help &#8211; act quickly<\/h2>\n<p>If you notice that your computer or mobile device is acting strangely, is inexplicably slow, or appears to have been compromised, act immediately. What does the term &#171;compromise&#187; mean? A system, database or even a single file is considered compromised if data might have been manipulated and if the system owner (or administrator) no longer has control over proper functioning or correct content, or whatever other goal the attacker has attained by manipulation (loosely translated &#8211; Wikipedia).<\/p>\n<p>Contact your IT supporter or the Service Desk immediately and have your device checked as soon as possible.<\/p>\n<h2>Support &amp; emergency measures<\/h2>\n<p>Contact your <a href=\"https:\/\/www1.ethz.ch\/id\/about\/departments\/index_EN\" target=\"_blank\">ISG<\/a> (IT Support Group in your department) or the <a href=\"https:\/\/www1.ethz.ch\/id\/servicedesk\/index_EN\" target=\"_blank\">ITS Service Desk<\/a>  immediately for help. The staff will help with analysis and cleaning of the compromised device. The Service Desk will either escalate your case to the responsible technical group or to our <a href=\"https:\/\/www1.ethz.ch\/id\/services\/list\/security\/index_EN\" target=\"_blank\">ITS security team<\/a> or connect you with them.<\/p>\n<p>In case of escalation our <strong>security team<\/strong> will close all security breaches and take all necessary and proportionate measures in answer to alerts from other trusted security agencies worldwide. The security team checks all related alerts to determine whether they are a threat to ETH Zurich&#8217;s IT. Publications, such as e.g. <a href=\"https:\/\/www1.ethz.ch\/id\/services\/list\/security\/comp_sec\/windows\" target=\"_blank\">winsecnews<\/a> (Windows Security for System Admins), inform user groups about vulnerabilities and necessary measures.<\/p>\n<h2>Posts in the ITS blog<\/h2>\n<ul>\n<li><a href=\"https:\/\/blogs.ethz.ch\/id\/2014\/04\/17\/change-passwords-security-gap-heartbleed\/\" target=\"_blank\">Change Passwords: Security gap Heartbleed<\/a><\/li>\n<li><a href=\"https:\/\/blogs.ethz.ch\/id\/2014\/03\/25\/it-security-risky-business\/\" target=\"_blank\">IT Security \u2013 Risky Business?<\/a><\/li>\n<li><a href=\"\/\/blogs.ethz.ch\/id\/2013\/07\/01\/it-security-during-the-holidays\/\" target=\"_blank\">IT Security during the Holidays<\/a><\/li>\n<\/ul>\n<h2> Use secure passwords<\/h2>\n<p>Refer to the IT brochure for <a href=\"https:\/\/www1.ethz.ch\/id\/documentation\/welcome_EN.pdf\" target=\"_blank\">staff<\/a>  or <a href=\"https:\/\/www1.ethz.ch\/id\/documentation\/leporelloEN.pdf\" target=\"_blank\">students<\/a>.<\/p>\n<ol>\n<li><strong>Change<\/strong><strong> password<\/strong><br \/>\nChoose a password that you can easily remember. For security reasons, it should contain at least 8 characters with upper and lower case letters, numbers and special characters. Change it often at irregular intervals. We recommend different passwords for various IT services.<\/li>\n<li><strong>Password-disclosure \/ IT security<\/strong><br \/>\nIgnore any request to disclose login information. No reputable service supplier will ever ask you for your username or password by email! Make sure to logon to absolutely trustworthy web sites only. If in doubt, check with your IT Support contact first. More information on the subject of IT security can be found in our IT Awareness program &#171;<a href=\"https:\/\/www1.ethz.ch\/safeit\/index_EN\" target=\"_blank\">safeIT<\/a>&#171;.<\/li>\n<li><strong>Forgot password<\/strong><br \/>\nFor security reasons, we never issue passwords over the phone. However, you can register a <a href=\"https:\/\/www1.ethz.ch\/id\/servicedesk\/guide\/secret_question\/index_EN\" target=\"_blank\">secret question<\/a>,  mobile phone number and alternate email address. This way the Service Desk can identify you and send you a new password. You can also contact the Service Desk or your department administrator and ask to pick up your new password personally.<\/li>\n<\/ol>\n<h2>Complex passwords &#8211; tips from ITS Service Desk<\/h2>\n<p>Complex and secure passwords are easy to create with a mnemonic:<br \/>\nWntyBopTd2w? (Why not take your bike or public transportation daily to work?)<\/p>\n<p>\u00d4\u00f9\u00a5 ITS blog <a href=\"https:\/\/blogs.ethz.ch\/id\/2013\/01\/10\/guidelines-for-a-foolproof-password\/\" target=\"_blank\">post<\/a>  &#171;Guidelines for a Foolproof Password&#187;<br \/>\n\u00d4\u00f9\u00a5 ITS-Blog post &#171;Das eigene nethz-Passwort richtig \u00e4ndern&#187; (German)<br \/>\n\u00d4\u00f9\u00a5 <a href=\"https:\/\/www1.ethz.ch\/id\/services\/list\/security\/richtlinien\/password_rules_EN\" target=\"_blank\">ITS site<\/a>  with password rules &#171;Password Rules for your Security&#187;<br \/>\n\u00d4\u00f9\u00a5 <a href=\"http:\/\/www.multimedia.ethz.ch\/misc\/safeIT\/?doi=10.3930\/ETHZ\/AV-9f330fb1-93a4-4ab2-b945-9b7a14a83dc5&amp;autostart=false\">safeIT-Cartoon<\/a> \u00abAvoid the misuse of systems and passwords \u00bb<br \/>\n\u00d4\u00f9\u00a5 <a href=\"https:\/\/www1.ethz.ch\/id\/documentation\/safeIT.pdf\" target=\"_blank\">safeIT Flyer <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security incidents can be triggered by a variety of hazards.<\/p>\n","protected":false},"author":292,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"class_list":["post-228","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts\/228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/users\/292"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/comments?post=228"}],"version-history":[{"count":0,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts\/228\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/media?parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/categories?post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/tags?post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}