- If you think that a workstation or server has been compromised do not perform any further actions on the system in question, such as turning the system off or removing it from the network. This could result in the contamination or deletion of forensic evidence.
- Contact the IT Security Operations Group through the IT Services Help Desk at 303-724-HELP and report the incident. If the incident occurs outside of operational hours please have the on-call Help Desk technician paged. This can also be done by calling the IT Services Help Desk at 303-724-HELP.
- Inform your supervisor of the situation, and document what you observed, when, and under what circumstances. This information will be helpful to the IT Security Operations Group during their investigation.
Operational Hours are defined as Monday through Friday 7:30 AM through 5:00 PM.