Resolute Security and Availability Incident Reporting
What is this?
Resolute Building Intelligence considers security and availability a differentiator in our core product offering. To achieve this, we pride ourselves on having a culture of security and reliability.
Security and availability go beyond computer firewalls and antivirus software, which are examples of prevention, to also include detection and response. Identifying security or availability incidents are critical aspects of detection. That is where you come in. It is up to everyone to report potential incidents so that the Security Incident Response Team (SIRT) can promptly initiate prioritization, research, and response. The full details of responding to incidents are documented in the Security Incident Response Plan (available for review upon request).
How do I fit in?
As an internal or external user of Resolute Building Intelligence, it is your responsibility to report potential incidents as soon as reasonably possible.
What do I report?
Since our organizational stance is to take security and availability seriously, the general rule is: If you think something might be a security or availability incident, report it as soon as possible.
How do I report?
You can call Resolute direct at 248.686.0900 or email security@resolutebi.com.
When submitting a report, please try to include the following information. Do not delay on sending the report if you are not able to get the information quickly.
- The nature of the incident and a full description of observations. In other words, describe what made you think it could be a security or availability incident. Be sure to include screenshots, logs, and a copy of the email.
- List any actions already taken. For example, persons contacts (clients, law enforcement, stakeholders), running virus or network scans, removing computer from the network, etc. Include details about the results of these actions. (Do not reboot or wipe a computer that you think might be impacted by an incident!)
- Other relevant facts (e.g., was the hard drive encrypted?)
- Opinions and impressions of the reporter are welcome but should be clearly separated in the report from the evidence and facts.
Relaying Reports from Customers
It is especially critical that any security or availability concerns from customers are reported.
Whether you are monitoring an official support channel and receive an incident, or you get an informal communication from a client that may be an incident, please report immediately.
Examples of Incidents
- A strange process is running and accumulating a lot of CPU time
- Office break-in
- An intruder has logged into any Resolute BI
- A virus, Trojan Horse, or other unsolicited program has been discovered or suspected
- Someone from a remote site has been discovered trying to penetrate the system
- A suspicious email has been received that has been a direct target to the recipient or organization
- A phone call or communication has been received asking to release private or sensitive information or to access a resource from an unverified person (aka "social engineering" attempt), or a person misrepresenting who they are
- A laptop, portable drive, or any device containing sensitive company data is lost or stolen
- Any evidence of unauthorized access to any account
ONE LAST THING
Security is strongest when viewed as community responsibility, and we seek to improve not just the security or availability of our own systems, but those of our customers and vendors with whom we work. If you notice what may be a security or availability incident involving equipment or networks with which we interface - even if we do not directly own or manage them - report this as an incident. Our SIRT will communicate the concern with the customer or vendor through appropriate channels.