* Guidelines for CIRT hotlines
In this continuing series of articles on Computer Incident Response Teams (CIRT) I am reviewing principles and practical pointers for effective response to security breaches and other operational difficulties in information technology management. Today I propose simple guidelines for telephone hotline staff.
The Defense Information Systems Agency (DISA) CD-ROM training course I recommended back at the start of this series last year has an excellent set of suggestions on policies for handling calls to the CIRT hotline. When I checked the Web site as I was preparing this article, I found and ordered some more recent titles that I had not seen before. I urge readers to take a look at the range of training materials available from this government organization. Ordinary (non-military, non-government) organizations can order them using the special instructions provided on the Web site at: https://iase.disa.mil/eta/contractors-instr.html
The DISA course makes the following points (I am paraphrasing what I don’t quote explicitly; personal additions are in square brackets):
* Make everyone aware of your operating hours. (For example, publish the hotline hours in your regular information technology newsletter and put it in the phone directory, on the organization’s intranet and in the answering-system message.)
* Ask for a callback number from the caller, check it for authenticity within your organization, and call it back. [Be aware that call-forwarding can defeat such simple validation, but it’s worth using anyway.]
* If you use answering systems for after-hours response, be sure to set expectations in the answering message (e.g., “This call will be answered as soon as possible after we resume normal operations at 0800 on Monday. For an life-threatening emergency, call the security office at x2345.”)
* Hotline operators should not speak to the press. “Your hotline procedures should address calls from the media – they can be tricky. Sometimes reporters call more than once, asking for a different person each time; at other times they will say they are returning a call or following up with a person; some reporters have been know to masquerade as system administrators.” (Transfer calls from the press to a supervisor, who can forward it to the public relations officer if appropriate.)
* Hotline operators should have specific instructions on handling abusive callers and pranksters. “Your procedures should let team members and answering services know that it’s OK to hang up on such callers. This may seem obvious, but answering services may not feel comfortable hanging up unless they have permission. Depending on your local telephone service provider, you may have optional services available to do a call trace. The results of a successful trace will be provided to the police or other authorities upon your authorization.”
In the next installment of this series, I’ll discuss the “Forbidden Comments” that I teach phone responders never to use when speaking to callers.
