Incident Investigation: How to Support and Document Security Investigations at UofL

Before You Begin

Ensure you have a valid UofL user account and login credentials.
Review UofL Information Security policies and procedures for incident investigation requirements.
Prepare to provide relevant information and documentation.

Objective or Task

Learn how to support and document security incident investigations in compliance with university policies.

Instructions

Cooperate with Investigators

  • Respond promptly to requests from ITS, Enterprise Security or the Information Security Office.
  • Provide access to affected systems, logs and relevant documentation.

Preserve Evidence

  • Do not alter, delete or destroy data related to the incident.
  • Secure affected devices and accounts as instructed.

Document Actions and Findings

  • Record all actions taken before and during the investigation.
  • Maintain a timeline of events and communications.

Support Remediation and Reporting

  • Assist ITS with remediation steps and follow-up actions.
  • Participate in post-incident reviews and implement recommended changes.

Outcome

After completing these steps, you will help ensure thorough and effective investigation of security incidents, supporting university compliance and risk mitigation.

Further Readings

  • UofL Security Information

Need Additional Help

• Contact the ITS HelpDesk: Call 502-852-7997 during business hours:

o Monday through Thursday: 6:00am – 10:00pm
o Friday: 6:00am – 5:00pm
o Saturday: 7:00am – 5:00pm
o Sunday: 10:00am – 10:00pm
o University Holidays: 7:00am – 5:00pm
o Closed on Thanksgiving, the day after Thanksgiving, and Christmas.
o If you have an emergency during off hours, call the HelpDesk to be transferred to an on-call technician, or leave your request on voicemail. Your call will be returned the next day starting at 7am unless you specify a time.

• Live Chat: Chat with the ITS HelpDesk at https://apps.louisville.edu/it/livechat/phplive.php during business hours.

• Submit a Ticket: Use the self-service portal at http://service.louisville.edu to log requests or check the status of existing tickets.

• In-Person Support: Visit the iTechConnect 1:1 help located on the lower level of the Miller Information Technology Center, Belknap Campus, during business hours.

Print Article