Security Incident Response and Investigation

Services (4)

Digital Forensics Examinations

The UFIT Information Security Office responds to and investigates information security incidents related to misuse or abuse of university information and information technology resources. An information security incident is defined as an event, whether electronic, physical or social that adversely impacts the confidentiality, integrity or availability of University of Florida data or information systems; or a real or suspected action, inconsistent with University of Florida Privacy or Acceptable Use policies. For example: Acquisition and preservation of hard drives, network and data files, email, and other media, Evidence/Artifact/Exhibit Chain-of-Custody and secure storage, Malware Analysis, Data Recovery, Litigation support, E-Discovery, Production and presentation of an investigative report and/or fact testimony, Post-Compromise or Post-Intrusion Analysis.

eDiscovery

The UFIT Information Security Office responds to requests for eDiscovery, or electronic discovery, services. eDiscovery refers to the process of identifying, collecting, and producing electronically stored information (ESI) in response to requests for information in legal cases, public records requests, or investigations.

Incident Response

The UFIT Information Security Office responds to and investigates information security incidents related to misuse or abuse of university information and information technology resources. An information security incident is defined as an event, whether electronic, physical or social that adversely impacts the confidentiality, integrity or availability of University of Florida data or information systems; or a real or suspected action, inconsistent with University of Florida Privacy or Acceptable Use policies. Incident Management services are triggered by an event or request, such as a report of a compromised host, wide-spreading malicious code, software vulnerability, or an event that was identified by an intrusion detection or logging system. Alerts and Warnings involves disseminating information that describes an intruder attack, security vulnerability, intrusion alert, computer virus, or hoax, and providing any short-term recommended course of action for dealing with the resulting p

Investigative Support

The following resources are available to network administrators that are registered in the UF Network Services database. Vulnerability Scan Database: Self-Serve Vulnerability Scanner, Enhanced Vulnerability Scanner, Security Tickets, Campus Security Scans, Blocked Hosts, Blocked Domains, Subnet Managers Search.