IRIS Incident Response Procedure

This procedure provides guidance for responding to suspected or confirmed security incidents affecting IRIS services and infrastructure.

1. Suspected discovery

Upon discovery of a suspected security incident, the following organisations should be notified as appropriate:

1. Local Security Team
   If applicable, inform the local security team within 4 hours.
2. IRIS Security Team
   Inform the IRIS Security Team via
   security@iris.ac.uk
   within 4 hours.
3. EGI CSIRT Security Team
   For GridPP services only, inform the EGI CSIRT Security Team via
   abuse@egi.eu
   within 4 hours.

2. Containment

Actions should be taken to contain the incident as quickly as possible.

1. Affected Hosts
   Where feasible, isolate affected hosts within 1 working day.
2. Affected Virtual Machines
   Snapshot and/or suspend affected virtual machines within 4 hours.
3. Affected Appliances
   Disable affected appliances within 4 hours.

3. Confirmation

Confirm the incident in coordination with the relevant security teams.

4. Downtime announcement

Where service disruption is necessary, announce the downtime and provide the reason:

“Security operations in progress”

This announcement should be made within 1 working day.

5. Analysis

Following containment, the incident should be analysed.

1. Evidence collection
   Collect evidence as appropriate.
2. Incident analysis
   Perform analysis as appropriate.
3. Requests from security teams
   Respond to requests and follow-up actions within 4 hours.

6. Debriefing

Prepare and submit a post-mortem incident report within 1 month of the incident.

7. Normal service restoration

Restore normal service operations in accordance with the service provider’s procedures once incident handling has been completed.

Response times

For the purposes of this procedure:

• 1 day means 1 working day.
• 1 hour means 1 working hour.

Further information

Additional security guidance and procedures are available from the
IRIS Security pages.