Skip to main content
more options.

Reporting Electronic Security Incidents: Procedures

User: If you suspect that an electronic security incident may have occurred or may be imminent, you are expected to contact your local support provider for that specific IT device. (Note: Students are their own local support providers.) If your local support provider is unavailable, disconnect the affected IT device from the network by disconnecting the Ethernet plug in the back of the machine and notify the Network Operations Center (NOC) at security@cornell.edu or (607) 255-9900.

Local support provider: If an electronic security incident occurs, local support providers must disconnect the IT device from the network, collect relevant information including date and time, relevant IP and MAC addresses of the affected device, function and distinguishing characteristics of the affected device, and a description of the incident.

Network Operations Center: If an electronic security incident occurs, the NOC will open a problem report, attempt to contact the user or local support provider, communicate what has to be done, why, and how it will be done. If the user or local support provider is unavailable or unwilling to correct the network security problem, the NOC will block the connection to the Cornell network and work with the local support provider to fix the computer.