Snowfall and a stolen laptop. Issue 2 (November 2015)

• Record Type: Journal Article
• Authors: McLaughlin, Mark-David J; Hansen, Sean; Cram, W Alec; Gogan, Janis L
• Is Part Of: Journal of information technology teaching cases. Volume 5:Issue 2(2015)
• Page Start: 102
• Page End: 112
• Publication Date: 2015-11
• Subjects: information security -- incident response -- risk management -- IT governance; Information technology -- Study and teaching -- Periodicals; Information resources management -- Study and teaching -- Periodicals; Information resources management -- Study and teaching; Information technology -- Study and teaching; Periodicals; Electronic journals; E-journal; 371.33405
• DOI: 10.1057/jittc.2015.12
• Languages: English
• ISSNs: 2043-8869

Abstract

The E. Phillip Saunders College of Business (COB) Dean at Rochester Institute of Technology (RIT) discovers that his RIT-issued laptop has been stolen from his home. He notifies Dave Ballard, a member of the College of Business IT staff. Ballard, still acutely aware of two recent incidents in which laptops containing thousands of Social Security numbers were stolen from the RIT campus, hopes the Dean's laptop does not contain personally identifiable information. If so, the incident would need to be reported to the New York Attorney General's Office, and RIT would be required to pay for a credit monitoring service for individuals whose identity may have been compromised. The case provides an opportunity for students to examine processes that should be triggered when an information security incident occurs. The case describes incident response processes that were triggered at RIT and technologies that were used or could have been used by COB IT staff to track the laptop and protect its contents. In discussing the case, students can consider how the theft of a computing device exposes an organization to risks of inadvertent disclosure of information in different categories (such as private, confidential, internal, or public), and students can derive useful guidelines for effective information security incident response.