Hosting.com - First Name in Hosting

RFC1244 - Page 73


Page Navigation:

1  2  3  4  5  6  7  8  9  10  11  12  13  14  15  16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31  32  33  34  35  36  37  38  39  40  41  42  43  44  45  46  47  48  49  50  51  52  53  54  55  56  57  58  59  60  61  62  63  64  65  66  67  68  69  70  71  72  73  74  75  76  77  78  79  80  81  82  83  84  85  86  87  88  89  90  91  92  93  94  95  96  97  98  99  100  101 

Printable Version: RFC1244.PDF

<< Prev. Page     Next Page >>

RFC 1244                 Site Security Handbook                July 1991


      lead to additional confusion and wasted or ineffective effort.

      The single point of contact may or may not be the person "in
      charge" of the incident.  There are two distinct rolls to fill
      when deciding who shall be the point of contact and the person in
      charge of the incident.  The person in charge will make decisions
      as to the interpretation of policy applied to the event.  The
      responsibility for the handling of the event falls onto this
      person.  In contrast, the point of contact must coordinate the
      effort of all the parties involved with handling the event.

      The point of contact must be a person with the technical expertise
      to successfully coordinate the effort of the system managers and
      users involved in monitoring and reacting to the attack.  Often
      the management structure of a site is such that the administrator
      of a set of resources is not a technically competent person with
      regard to handling the details of the operations of the computers,
      but is ultimately responsible for the use of these resources.

      Another important function of the POC is to maintain contact with
      law enforcement and other external agencies (such as the CIA, DoD,
      U.S.  Army, or others) to assure that multi-agency involvement
      occurs.

      Finally, if legal action in the form of prosecution is involved,
      the POC may be able to speak for the site in court.  The
      alternative is to have multiple witnesses that will be hard to
      coordinate in a legal sense, and will weaken any case against the
      attackers.  A single POC may also be the single person in charge
      of evidence collected, which will keep the number of people
      accounting for evidence to a minimum.  As a rule of thumb, the
      more people that touch a potential piece of evidence, the greater
      the possibility that it will be inadmissible in court.  The
      section below (Legal/Investigative) will provide more details for
      consideration on this topic.

5.5  Legal/Investigative

   5.5.1  Establishing Contacts with Investigative Agencies

      It is important to establish contacts with personnel from
      investigative agencies such as the FBI and Secret Service as soon
      as possible, for several reasons.  Local law enforcement and local
      security offices or campus police organizations should also be
      informed when appropriate.  A primary reason is that once a major
      attack is in progress, there is little time to call various
      personnel in these agencies to determine exactly who the correct
      point of contact is.  Another reason is that it is important to



Site Security Policy Handbook Working Group                    [Page 73]


<< Prev. Page     Next Page >>