Re: Releasing details

["Bristol, Gary L." <gbristol () OU EDU>]

This type of action is usually handled by our campus PD.

A complaint is filed by Ms. Joan Doe and all interaction is with the campus PD.
The campus PD works with the Campus IT department to gather the information and determines is further action can be 
taken.


Gary L. Bristol
CISSP, RHCE
University of Oklahoma
175 Kuhlman Court
Norman, OK 73019

Desk: 405-325-2236
Cell: 405-409-6406


**********************************************************************

This transmission may contain information that is privileged, confidential
and/or exempt from disclosure under applicable law. If you are not the
intended recipient, you are hereby notified that any disclosure, copying,
distribution, or use of the information contained herein (including any
reliance thereon) is STRICTLY PROHIBITED. If you received this transmission
in error, please immediately contact the sender and destroy the material in
its entirety, whether in electronic or hard copy format. Thank you

**********************************************************************
From: Theresa Rowe [mailto:rowe () OAKLAND EDU]
Sent: Tuesday, January 22, 2008 3:32 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Releasing details

We sometimes get requests from student and staff that read something like the following:

"Joan Doe called the Help Desk asking for if we could trace an IP address of a
computer that sent an email from her account on January 19 sometime around 3:30 AM.
She said that someone had hacked into her email account and deleted some
messages as well as sent some. She has since then changed her password but is now
looking to take action on the person that sent it."

Do you have protocols on how you handle such an incident?  In most of these cases, the logins look authentic - i.e., 
the real ID and password were used.


--
Theresa Rowe
Chief Information Officer
rowe () oakland edu<mailto:rowe () oakland edu>
Oakland University