Report an IT security incident

An IT security incident can have serious consequences if it is not detected and addressed promptly. Examples include suspicious system activity, unauthorized access, or phishing attacks. Early reporting helps minimize damage, analyze attacks, and quickly implement countermeasures. Please do not hesitate – it is better to report an incident once too often than too little. Your report will be treated confidentially.

Information required for a swift response:

• Date and time of the incident (including time zone)
• Source and destination IP addresses as well as ports and protocols used (if known)
• Description of the incident and relevant details
• Log files or suspicious emails (as attachments, including header data)

If you wish to report a vulnerability, please follow the principles of Responsible Disclosure:

• Do not intentionally exploit the vulnerability.
• Submit sensitive information only through secure channels.
• Do not share vulnerability details with uninvolved third parties until it has been resolved.

Please note that we do not offer rewards or bounties for reported vulnerabilities, but we are happy to issue a Letter of Appreciation.

Procedure for a Security Incident

Procedure for a Security Incident

A quick and coordinated response is essential to limit damage and determine the cause of a security incident. Please follow these steps:

Immediate Actions:

• Immediately disconnect the affected system from the network, but do not power it off.

• Report the incident to your supervisor and the responsible IT support.

  • Employees with IT support should contact their designated IT contacts.

  • Employees without direct IT support and students must take appropriate measures themselves.

• Notify the RUB-Cert / ITSB team about the incident.

Analysis and Damage Mitigation:

• Determine the cause of the incident and identify any other potentially affected systems.

• Immediately change all affected passwords, especially if accounts have been compromised.

• If a computer is infected: reinstall the system, as a complete cleanup is often not reliable.

• Restore data from backups if necessary.

Follow-up and Prevention:

• Evaluate the incident and identify potential security vulnerabilities.

• If needed, conduct a debriefing to define measures for future prevention.

• Adjust security policies or protective measures to prevent similar incidents in the future.

Further information can be found on the website of the Information Security Office.