Controlled research data leaves a university lab
The prompt — read this to the room
A federal research sponsor's security office calls your university: data from a funded propulsion project has appeared on a foreign technical forum, including test results that were only ever stored on a lab's shared drive and one researcher's cloud storage account. Central IT has never managed that lab's servers. A postdoc's account shows logins from two countries within the same hour, repeatedly, over six months. The principal investigator says the lab follows every rule. Some of the data may be export-controlled, and the contract has a 72-hour cyber-incident reporting clause. When did that clock start?
Who to involve
Most important first.
- Incident response lead
- CISO / Head of security
- SOC analyst
- Cloud engineer
- IT operations
- Legal counsel
What it tests
- Scope the exfiltration across unmanaged lab systems and personal cloud accounts
- Determine whether the data is covered defense information or export-controlled, and which clocks apply
- Preserve evidence, including cloud-provider logs, before retention windows close
- Handle the researcher-account question (compromise or insider) fairly and lawfully
Outline of activities
- 1The sponsor's call
- 2Scoping a lab central IT does not manage
- 3Account forensics: compromise or insider
- 4Contract reporting and export-control questions
- 5Containment and the shadow-IT problem
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…