<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Good Afternoon,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Most of the day has been focused on data collection from various logs on and off the server, including networking equipment, cloud monitoring software etc, as well as transferring several snapshot images of our server to UITS' security
team. Through this process, my team has found more evidence that the issue under investigation involved a singular WordPress site.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">That said, UITS is casting a wide net in their security scan and has mandated we keep dozens of sites offline until more forensics can be done. Their team is in the beginning phase of their analysis and has relayed it is too soon to give
us an estimated completion time. We will continue to engage UITS as they work through this process, but at this moment, we are on the sidelines, as they have everything they need from us.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">UITS has not yet scheduled a follow-up meeting, but I will provide an update tomorrow at 10am in case any news comes in overnight.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you again for your patience.<o:p></o:p></p>
<p class="MsoNormal"><br>
Matt<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="mso-ligatures:none"><img width="120" height="96" style="width:1.25in;height:1.0in" id="Picture_x0020_3" src="cid:image002.png@01D9DC2B.F5741430" alt="The University of Arizona block 'A' logo."><o:p></o:p></span></p>
</td>
<td width="500" valign="top" style="width:375.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:14.0pt;color:#0C234B;mso-ligatures:none">Matt Rahr</span></b><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><br>
Director, Cyber & Information Technologies<br>
Division of Agriculture, Life & Veterinary Sciences and Cooperative Extension<br>
THE UNIVERSITY OF ARIZONA<br>
<br>
Forbes Building, 230<br>
1140 E South Campus Dr | Tucson, AZ 85721<br>
Office: 520-621-1212 <br>
</span><a href="mailto:rahr@ag.arizona.edu"><span style="font-size:10.0pt;color:#495057;mso-ligatures:none">rahr@ag.arizona.edu</span></a><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><br>
<br>
Communications & Cyber Technologies Unit<br>
Landmark Stories | CCT Data Science Team<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="https://cct.arizona.edu/"><b><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">cct.arizona.edu</span></b></a><b><u><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">
<br>
</span></u></b><a href="https://landmarkstories.arizona.edu/"><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">landmarkstories.arizona.edu</span></a><u><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none"><br>
</span></u><a href="https://datascience.cct.arizona.edu/"><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">datascience.cct.arizona.edu</span></a><span style="mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><br>
</span><a href="https://www.facebook.com/LandmarkStories/"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">facebook</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none"> |
</span><a href="https://twitter.com/StoriesLandmark"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">twitter</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none"> |
</span><a href="https://www.instagram.com/landmarkstories/"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">instagram</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none"> |
</span><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="120" style="width:1.25in;padding:0in 0in 0in 0in"></td>
<td width="500" style="width:375.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><a href="https://brand.arizona.edu/signature"><span style="color:blue;mso-ligatures:none;text-decoration:none"><img border="0" width="400" height="96" style="width:4.1666in;height:1.0in" id="Picture_x0020_2" src="cid:image003.png@01D9DC2B.F5741430" alt="Integrity, Compassion, Exploration, Adaptation, Inclusion, Determination"></span></a><span style="mso-ligatures:none"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="mso-ligatures:none">From:</span></b><span style="mso-ligatures:none"> ALVSCE_Bulletin <alvsce_bulletin-bounces@list.cals.arizona.edu>
<b>On Behalf Of </b>Agriculture, Life and Veterinary Sciences, and Cooperative Extension Weekly Bulletin<br>
<b>Sent:</b> Thursday, August 31, 2023 10:02 AM<br>
<b>To:</b> alvsce_bulletin@list.cals.arizona.edu<br>
<b>Subject:</b> ALVSCE Web Server IT Security Incident<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Good Morning Division,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">UITS is investigating a security incident that occurred on our web server yesterday afternoon. The offending website, a WordPress site, was detected and quickly brought down by our in-house CCT staff. While evidence shows that the incident
was isolated to that specific Wordpress site, UITS is remaining cautious and wants to perform a deeper dive analysis. To do this, my team will need to bring down several AES, Extension, and CALES websites during their investigation. I know the business impact
this has on our Division, and I deeply apologize for this inconvenience. UITS’ security team will provide an update in six hours, and I will relay more information then.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<br>
Matt<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="mso-ligatures:none"><img border="0" width="120" height="96" style="width:1.25in;height:1.0in" id="Picture_x0020_1" src="cid:image004.png@01D9DC2B.F5741430" alt="The University of Arizona block 'A' logo."></span><span style="mso-ligatures:none"><o:p></o:p></span></p>
</td>
<td width="500" valign="top" style="width:375.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:14.0pt;color:#0C234B;mso-ligatures:none">Matt Rahr</span></b><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><br>
Director, Cyber & Information Technologies<br>
Division of Agriculture, Life & Veterinary Sciences and Cooperative Extension<br>
THE UNIVERSITY OF ARIZONA<br>
<br>
Forbes Building, 230<br>
1140 E South Campus Dr | Tucson, AZ 85721<br>
Office: 520-621-1212 <br>
</span><a href="mailto:rahr@ag.arizona.edu"><span style="font-size:10.0pt;color:#495057;mso-ligatures:none">rahr@ag.arizona.edu</span></a><span style="font-size:10.0pt;color:#495057;mso-ligatures:none"><br>
<br>
Communications & Cyber Technologies Unit</span><span style="mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;color:#495057;mso-ligatures:none">Landmark Stories | CCT Data Science Team</span><span style="mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><a href="https://cct.cals.arizona.edu/"><b><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">cct.arizona.edu</span></b></a><b><u><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">
<br>
</span></u></b><a href="https://landmarkstories.arizona.edu/"><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">landmarkstories.arizona.edu</span></a><u><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none"><br>
</span></u><a href="https://datascience.cals.arizona.edu/"><span style="font-size:10.0pt;color:#8B0015;mso-ligatures:none">datascience.cals.arizona.edu</span></a><span style="mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><a href="https://www.facebook.com/LandmarkStories/"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">facebook</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none"> |
</span><a href="https://twitter.com/StoriesLandmark"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">twitter</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none"> |
</span><a href="https://www.instagram.com/landmarkstories/"><span style="font-size:9.0pt;color:#8B0015;mso-ligatures:none">instagram</span></a><span style="font-size:9.0pt;color:#767676;mso-ligatures:none">
</span><span style="mso-ligatures:none"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="mso-ligatures:none"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> </span><o:p></o:p></p>
</div>
</body>
</html>