Computer Incident Response Policy CIRT

These guidelines are intended to protect the rights and privacy of Regional BBC Credit union/bank Systems Division clients as well as those of Regional BBC Credit union/bank Systems Division support staff. Any Corporate Headquarters guidelines or policies will take precedence over these guidelines. II.

Other Applicable Guidelines/Policies Members of the Regional BBC Credit union/bank Systems Division support staff are required to abide by all the Items outlined In the Acceptable use Statement of Regional BBC Credit nylon/bank Systems Dillon Computing Resources.In Dalton to being the guardians/supporters of the Regional BBC Credit union/bank resources, embers of the Regional BBC Credit union/bank support staff also serve as examples of professionalism for the rest of the Regional BBC Credit union/bank user community. Many members of the Regional BBC Credit union/bank Systems Division support staff have some level of special access. Special access is defined as having the password and privilege to use a special account (e. G. Root) on a Regional BBC Credit union/bank System Division computer or subsystem or to have privileges above and beyond those of normal users.

The first time a member of the Regional BBC Credit union/bank support staff requests special access, he/she is asked to read ND sign the Special Access Guidelines Agreement. This agreement presents general guidelines for using special access In a responsible and ethical manner. The agreement also specifies behaviors and practices that are prohibited.All members of the Regional BBC Credit union/bank support staff should reference the The Special Access Guidelines Agreement whenever they have a question regarding proper use of special access. The document may be accessed via Regional BBC Credit union/ bank info in the Miss_leno section, under the title SP.

Access. Policy . Highlights of the guidelines are provided below. Ill. Privacy of Clients Data/limitation There is one particular topic that is not covered in detail in either of the two documents discussed above.That topic is the privacy of clients files and information stored online Regional BBC Credit union/bank Systems Division computers and resources.

Sometimes during the normal course of their Job, a member of the Regional BBC Credit nylon/bank support staff will have a need to view a file belonging to another person. Some examples are: helping a client with a programming problem which requires access to the client's source program; helping a client resolve an electronic mail problem which requires viewing part of the client's mail message file. Consent of the client must be first obtained.In the case of resolving an electronic mail problem, in which the message has been returned to the postmaster account, consent is also implied.

However, in all cases the client must be advised that his/her file(s) must be viewed/accessed to assist them. When assisting Regional BBC Credit union/bank clients, members of the Regional BBC Credit union/bank Systems Division Support Staff should use the following guidelines: * Use and disclose the clients ATA/information only to the extent necessary to perform the work required to assist the client.Particular emphasis should be placed on restricting disclosure of the data/ information to those persons who have a definite need for the data in order to perform their work in assisting the client. * Do not reproduce the client's data/ information unless specifically permitted by the client.

* Refrain from disclosing a client's data/information to third parties unless written consent is provided by the client. * Return or deliver to the client, when requested, all data/information or copies there of to the client or someone the designate. V.Proprietary Information Due to the nature of Regional BBC Credit union/bank Systems Division, there is a large potential for having proprietary information stored online Regional BBC Credit union/bank computers and resources. Information that would be considered proprietary would be vendor source code, benchmark programs, benchmark results, scientific codes and data sets. Since members of the Regional BBC Credit union/bank support staff will have full access to the Regional BBC Credit union/bank systems and resources, they will potentially have access to proprietary information.

Members of he < Regional ABC Credit union/bank support staff are responsible for ensuring that all proprietary information is protected from disclosure or modification. When dealing with proprietary information, members of the Regional ABC Credit union/ bank support staff should use the following guidelines: * Ensure appropriate measures are in place for protecting proprietary information. * Do not attempt to access proprietary information for which you have not been given authorization. * Do not make copies of proprietary information unless specifically permitted by the owner of the information.Refrain from disclosing to third parties the types of proprietary information you can access.

V. Security Investigations If during the course of their regular duties, a member of the Regional BBC Credit union/bank support staff discovers evidence of a violation of the Acceptable Use Statement for Regional BBC Credit union/bank Systems Division Computing Resources, he or she must notify the Regional BBC Credit union/bank Data Processing Installation Computer Security Officer (DIP-CSS), the Regional BBC Credit union/bank Computer Security Analyst (CSS) or the Regional BBC Credit union/bank SystemsDivision Chief. If the DIP-CSS, CSS or the Regional BBC Credit union/bank Division Chief determines there is probable cause to believe a violation has occurred, additional investigation will be authorized. Any additional investigation will normally be performed by the Regional BBC Credit union/bank CSS or someone else designated by the DIP-CSS or the Regional BBC Credit union/bank Division Chief.Members of the Regional BBC Credit union/bank Systems Division support staff should not begin an investigation of a client without receiving authorization from the roper person. If you are requested to participate in an investigation of a client, or your Job duties, you must be careful not to disclose information about that client or the contents of the client's files to other people.