CAM Week 3 – Phishing and Healthcare Devices

Welcome to week 3 of Cybersecurity Awareness Month!

I hope you are all advancing in the Virtual Scavenger Hunt (VSH), but if not, there are some clues later in the article to help you along. If you haven’t yet started, you still can, giving you a chance to win the Monster Isport Ear Buds Monster Clarity 102 AirLinks Wireless Ear Buds. If you’ve been paying attention, you’ll notice that our grand prize has changed. Unfortunately, everyone else thought the Isport Ear Buds were cool, too, and we ran into a supply problem, as in, we couldn’t get a pair. Fortunately, Monster makes several great sets of ear buds and we picked a comparable pair to replace the Isports. You can click the link above to check them out on the Monster website.  You can head over to the VSH start page using the link at the bottom of the article, but hang here for a little longer to read about the main topics.

Those main topics are phishing and what the Office of Information Technology (OIT) is doing to combat it, and securing Internet-connected devices in healthcare. While this second topic doesn’t seem appropriate, as Berry is a college, not a hospital, we will specifically talk about the many different healthcare devices that are available to consumers, from smart watches and athletic trackers to insulin pumps and smart asthma monitors.

Phishing And The Phish Alert Button

Before we talk about all those incredible Internet of Things (IoT) devices, let’s return to discussing phishing. If you read last week’s article, you’ll remember that there was a quick blurb at the end talking about the importance of detecting and reporting phishing emails you receive.

The first step, of course, is to detect a phishing attempt. How do you do that? What’s the secret to knowing that an email is a phishing attempt? Here’s some items to check in an email to make sure you don’t get hooked.

    1. Make sure the “From” address matches the purported sender.  For example, if an email claims to be from Amazon, but the “From” address is from some account at a Gmail address, it’s probably a phishing attempt
    2. If the greeting is generic, as in “Dear Customer” or “Dear Sir/Madam”, there’s a good chance it is a phishing attempt. Legitimate emails from companies you do business with will seldom start this way. They will either have no greeting, or the greeting will address you by name. Also beware of greetings (and subjects) that refer to you by your email username. These are most likely phishing emails as well
    3. Poor grammar and spelling. No legitimate company will send out email with poor grammar or spelling. It would reflect poorly on them.
    4. Urgency is another warning sign. Emails that require “immediate attention” or warn of dire consequences if you don’t act quickly are most likely phishing attempts.
    5. Links and attachments are both signs that an email is a phishing attempt. Even if you are expecting an attachment from someone, it can be a good idea to simply confirm with them via phone or other method that they sent it.
    6. Lotteries, donations, investment opportunities, get rick quick schemes, unsolicited job opportunities and inheritances from people you don’t know are almost always too good to be true.

If you would like to see real examples of phishing emails, you can visit the Berry College Phishbowl, located here on the InfoSec News and Alerts site.

If you receive a phishing email, even if you are not 100% sure, report it. If it is not a phishing email, you’ll get a reply explaining why it is not. To help OIT combat phishing, please report these phishing attempts using the “Report Email as Phishing” button, which is available in the mail.berry.edu webmail interface and on mobile versions of Outlook, as well as the traditional Outlook client on PCs and Macs. In Outlook, it should appear in the ribbon menu as an open envelope with an orange hook. On the web and mobile, you will find the button under the “three dots” menu in the top right corner of the window when you open an email.

It’s very important to report these emails using the button and not to simply forward them to Information Security or delete them, as this allows us to take action on these emails to protect the community. OIT has invested in a system to be able to mitigate phishing emails, but its effectiveness relies on you reporting phishing attempts. So report all the ones you receive to help us protect you.

IMPORTANT OPPORTUNITY ALERT!!!

If you want to learn more about how to spot phishing emails, there is a Virtual LunchITS scheduled for October 22nd at noon. It will be held over Zoom, will last under an hour and will give you a definite edge in spotting phishing emails. I encourage you to sign up to attend. You can do that right in the event. Just click on it in the Event calendar on the InfoSec News and Alerts site and fill out an RSVP. There is no cost, but to make the Zoom meeting secure, you must request access to the LunchITS so I can send you the course resources and the meeting link and password.

Securing Internet-Connected Devices in Healthcare

Everything can be connected these days, from smart watches, like the Apple Watch, to dedicated fitness trackers like FitBits, to shoes like Under Armour’s HOVR running shoes. Healthcare devices are prime candidates for connecting to the network, as they can produce historical data that can be used to make health decisions, or can be controlled remotely with a smartphone app. Once they are connected, they are targets, just as we mentioned last week about IoT devices on your home.

How can we make sure that these devices are securely connected? Here are some tips to help you make a secure connection with your “healthy” devices.

    1. Choose well-known, reputable brands that won’t disappear on you after you purchase the product.
    2. Make sure you follow the vendor-provided instructions for connecting it to the network.
    3. Once it is connected to the network, make sure you update the device to the latest version of the software or firmware running on it.
    4. Be sure to continue to update the device, or, if it is capable, set it to auto-update when updates are available.
    5. Keep track of your devices, particularly those that collect data about you and your activities, like smart watches and fitness trackers.

Those of you who have consumer medical devices like insulin pumps, continuous glucose monitors, pacemakers, asthma monitors or inhalers and other devices that can potentially disrupt your health should be extra careful in following the tips above. Most of these devices have online communities and vendor supplied resources that can help you stay aware of any potential issues with your particular device. If you’re not connected to any resources like this, use your favorite search engine and see what’s out there.

One more thing before we get to the VSH clues…you will soon be receiving, or may have already received, an email informing you of when multi-factor authentication (MFA) will be enabled on your account. Don’t delete these emails or report them as phishing! They are real. The emails will provide you with resources about how to set up MFA. If you want to have MFA enabled on your account before your appointed date, email computing@berry.edu and let them know you want MFA.

OK, it’s time to throw some hints to those of you who can’t seem to make your Week 2 Virtual Scavenger Hunt answers get you to week 3.

    • For the first question – The Events calendar for the InfoSec News and Alerts Site is right on the main menu. Once you go there, choose the monthly view, if it is not the current view. You’ll see the event in question as the only single day event in October.
    • For the second question – be sure you put a leading zero on your answer to come up with a four digit month and day answer
    • For the third question – Be sure to jump into the section on ransomware to find the answer.
    • For the fourth question – The largest breaches in the Have I Been Pwned database are listed on the left side of the main page.
    • For the fifth question – Follow this link to the security awareness poster that is in the residence halls and in Krannert.

IMPORTANT: You don’t have to resubmit your answers on the week 2 form, but these clues should help you get the correct URL for week 3 of the scavenger hunt.

If you haven’t started the scavenger hunt, here is the start page. Good luck and happy hunting!

Virtual Scavenger Hunt Start Page

 

Photo Credit: Photo by Solen Feyissa on Unsplash

CAM Week 2 – MFA and Securing Devices

Multi-Factor Authentication and Securing Devices at Home and Work (or School)

This week, as we did last week, we are covering two cybersecurity awareness topics. We’ll discuss securing devices at home and at work (or school) and we will cover multi-factor authentication and why you need it enabled on your account.

MFA

We’re talking about multi-factor authentication (MFA)!

We, as in the Office of Information Technology (OIT), have been talking about MFA quietly for about two years, but now we’re speaking up a little louder. You need to have MFA enabled on your account, now more than ever. Cybercriminals have increased the frequency and intensity of attacks, sending evermore sophisticated emails to try and convince you to click on a link or open an attachment.

If you click on a malicious link and enter your credentials on a fake login page, not having MFA enabled will allow the attackers to take control of your email account. This will also allow them to take control of other accounts and services you use, as your email username and password also grants you access to other resources associated with the college, like VikingWeb and Canvas. With MFA enabled, attackers won’t be able to log in to your account, even with your credentials.

It’s easy to get MFA setup. Simply email computing@berry.edu and request MFA be enabled on your account. You’ll get a response indicating it is active and you will be required to go through the setup process. There is a document available here that goes through the process or you can view a video that explains the process at this Microsoft Stream link. You’ll have to log in with your Berry email username and password to view the video.  The gist of the instructions is that you will need to install an app on your smartphone to be able to respond to MFA requests, then complete the setup process to link the app to your account.

The web page linked above also has a document explaining in more detail why we are doing this and answers some frequent questions, like “should I do this for all my accounts?”. SPOILER: You should! There is a link on this same page to the website Lock Down Your Login which has more information on how to secure your home, device and popular web accounts.

More information about MFA is coming soon. Keep an eye on your emails and the BerryOIT social media accounts on Facebook (@BerryColleOIT), Twitter (@berryoit), and Instagram (@berrycollegeoit).

Securing Devices at Home and Work

2020 saw a major disruption in the way many work, learn, and socialize online. Our homes are more connected than ever. Our businesses are more connected than ever. With more people now working and or attending class from home, these two internet-connected environments are colliding on a scale we’ve never seen before, introducing a whole new set of potential vulnerabilities that users must be conscious of. Here are some steps users can take to protect internet connected devices for both personal and professional use.

    • Make sure, as mentioned last week, your devices are all up to date.
    • If you are using a personal machine, not managed by the college, make sure you have up-to-date virus and malware protection installed.
    • Don’t bypass security features of the device…for phones and tablets, this primarily means assigning a passcode to secure them, and for laptops and desktops, this means having a password on all accounts on the systems.
    • If you are using a VPN, be sure it is up to date.
    • Don’t mix your personal files with your school or work files, and don’t make copies of sensitive college data and leave them your personal machine.
    • Following up on that, make sure that you are the only one who can access college data on your personal machine, if it is used by other household members. This may require you to create multiple accounts on the device.
    • Follow all college policies regarding use of OIT resources. If you feel any policy is hampering your ability to work or learn, bring it to the attention of OIT. Violating policy can expose you and the college to risk.

If you are still having difficulty with your Week 1 Virtual Scavenger Hunt answers and can’t get to the second week page, here are a couple more clues.

    • For question one, the types of factors are 1. Something you know 2. Something you have 3. Something you are
    • For question two, the answer is the result of 2 to the 6th power.
    • For question three, LastPass and 1Password are examples of this…
    • For question four, the first word of the example password is a four-legged animal
    • For question five, see the security awareness poster at this link or alternatively the answer is the square root of the answer for question two.

IMPORTANT: You don’t have to resubmit your answers on the week 1 form, but these clues should help you get the correct URL for week 2 of the scavenger hunt.

Finally, even though this post is not about “phishing” emails, per se, I want to remind everyone to please be very careful with unexpected emails, and report any phishing emails using the “Report Email as Phishing” button, available in the mail.berry.edu webmail interface and on mobile versions of Outlook, as well as the traditional Outlook client on PCs and Macs. It’s very important to report these emails using the button and not to simply forward them to Information Security, as this allows us to take action on these emails to protect the community.

 

Photo Credit: Photo by Brina Blum on Unsplash

October News from Information Security

October is here! Did you know there are 190 official and unofficial “days” in October? I know, there are only 31 actual days, but many days are workhorses, serving as “the day” for multiple celebrations, from National Pumpkin Day to World Animal Day to the International Day of Non-violence. More immediately on many of our minds here at Berry, Mountain Day is around the corner, along with long-sleeve weather. October is also the height of “pumpkin spice everything”, and…Cybersecurity Awareness Month!

Yes, it’s Cybersecurity Awareness Month! Let’s just call it CAM. It used to be called National Cyber Security Awareness Month or NCSAM, but it is observed internationally now. You can find out about our planned topics on the CAM 2020 page. There will be weekly articles as well as a month-long virtual scavenger hunt…and prizes…and candy…and learning! Head over to the CAM 2020 page to check it out after you finish reading this article. Come on, stay focused here! There will be another link at the bottom of the page.

As already mentioned, look for weekly articles on various security awareness topics posted right here each Monday of October. They, along with the security awareness posters on all the residence hall bulletin boards and in Krannert, will be essential to completing the scavenger hunt. You might be asking yourself, why burn 5-10 minutes of time each week in October tracking down scavenger hunt items? Because everyone who completes the scavenger hunt will be eligible for a drawing for the grand prize of a pair of Monster Isport Ear Buds Monster Clarity 102 AirLinks Wireless Ear Buds

As a part of CAM, the Office of Information Technology (OIT) is strongly urging everyone to sign up for Multi-Factor Authentication (MFA) for their Berry account (and all other accounts you have, but we are particularly concerned with your Berry account). MFA brings another level of security to your account and can protect you if the password for your Berry account is exposed. The setup is easy, and you’ll be able to keep your Berry account password for an entire year, assuming it does not get exposed. Email computing@berry.edu and let them know you want MFA. MFA will be required for all current students, faculty, and staff soon, so you should beat the rush and get signed up now!

In addition to encouraging everyone to sign up for MFA, OIT is also encouraging everyone to sign up for security awareness training. OIT is implementing a brand new security training platform and we want as many as possible to experience the new system. While we will continue to focus on specific training for now, we are looking to expand the system to accommodate everyone as soon as we can. More details will be provided, either in one of the CAM 2020 weekly emails or the November monthly newsletter.

There are other ways to participate in training. You can attend a one hour, Zoom-based, focused training on phishing emails or passwords and password managers, or request one-on-one training on a particular topic. Since the theme for CAM is “Do Your Part – #BeCyberSmart” we encourage you to develop your cybersecurity “smarts” in whatever way fits your schedule and goals.

If, after reading the CAM2020 page and looking over the rest of the website, you think I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the calendar where events will be posted and you can register for these events.

The Berry CAM2020 page

Go directly to the scavenger hunt page!   This link will not be active until Monday October 5th,  2020, at 8:00AM

Upcoming Events

 

 

 

 

Featured Image: Photo by Joanna Kosinska on Unsplash

“2020 Anti Virus Protection” Emails are Fake

One of the first things you will notice about these fake “anti virus” protection emails is the odd font in the subject line. A small font, sized at half the height of normal fonts, it looks…odd. This is red flag #1. If you bother to open the email and hover on any of the links, you will notice they do NOT go to either a Norton site or a Symantec (the owner of Norton) site. This is red flag #2. Closely related to this is red flag #3…the email did not come from an address of either company.

The email does contain an image, shown below, which purports that this email came from an “affiliate” of Norton, but does provide a name. All links in the email go to the same domain, flagged as a phishing domain by security company Kaspersky – red flag #4.

You should just delete these emails. If you have opened one and clicked on a link, please let me know so we can discuss the potential impact of this action and what steps you may need to take next. You can email me at infosec@berry.edu.

 

 

Featured Image credit: Photo by stephen momot on Unsplash

August News from Information Security

Welcome to the intentionally delayed August Information Security newsletter. I wanted to release this in conjunction with everyone returning to campus. First I want to welcome all our new faculty, staff and students as we begin this most interesting journey into the fall semester. I also want to welcome all the returning faculty, staff, and students who have been in various ways preparing feverishly (uh, maybe that’s not a good metaphor) striving earnestly for the start of classes.

You all have been inundated with safety information in relation to the coronavirus, COVID-19, or whatever name you want to use (I will simply use “virus” in this newsletter) to describe the virus that has upended our lives in such a profound way. I hate to be one to pile on, but in addition to the virus itself, all kinds of bad actors are afoot attempting to fool you into clicking on malicious links, submitting sensitive information, even giving up your passwords, many of them preying on the chaos caused by the virus. Please be extremely vigilant with any unexpected emails, and treat all email, at this point, with caution.

Internet criminals have no qualms about using any leverage they can to trick you. One of the latest ploys involved criminals spoofing the Small Business Administration loan relief website to try and steal information from you. Fake websites with false information about cures for the virus and government relief programs are rampant. Be very careful surfin’ the net out there.

I have some news concerning the InfoSec News and Information site (this site you are reading this article on). For the new folks (and even for returning folks who have never visited the site before), this site has a brand new look and feel. The style has moved from looking like a website from the early 2000s to now looking at least “2017ish”. I hope you like the new format and the easier navigation.

A downside to all this progress is that the transition has left the site without an events calendar, at least temporarily. I am looking for a new one and hope to get that squared away soon. Events will necessarily look a lot different for a while, but I hope to conduct some LunchITS training sessions this semester, via Zoom, of course, and I will continue to create and share new security awareness training videos. Keep checking back to see when the new events calendar shows up.

Also coming soon to the site is a “phishbowl” where you will be able to view examples of phishing emails so you can know what to look out for and also see just how desperate some people are to try and scam you. This should debut in the next week or so and will be accessible from the main page of the site.

I will, of course, continue to post warnings about phishing emails and notices about other information security topics. It will all be accessible here on the site, so bookmark it and check it regularly.

Here are some reminders (or “new information” for some of you)…

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and (eventually) the events calendar will return, where events like LunchITS training sessions and other opportunities can be found.

 

 

 

July News from Information Security

Well, 2020 has been a trip so far, wouldn’t you agree?

“Trip” might be an understatement. It’s as if our lives are as jumbled and chaotic as this pile of puzzle pieces. Nothing seems to make sense, or have any clarity whatsoever. Between the corona-virus, murder hornets, protests (and riots), cancel culture, and for extra flavor, all during an election year, I know many of you are weary and yearn for some good news.

This post is not that…I’m sorry.

We’ve been bombarded by all kinds of phishing emails. Thanks, again, to everyone who reports these and to those who simply delete them and move on. There’s no relief in sight for these. We will continue to be sent fake personal assistant jobs, fake upgrade notifications, fake meeting notifications, fake emails about ‘favors” and “urgent requests”, fake shared document notifications, and more. Please be vigilant, informed, and conscientious in handling your email.

One particular type of phishing email that has popped up recently (again) is one where a phisher uses old emails from a compromised account to attempt to get users to click on a link leading to a “report” or “project update” or other some important document. From your perspective, you see a familiar subject line in an email, potentially coming from a valid and known address, but in the body of the message, there is a sentence about an updated report or some other document that has nothing to do with the original email. It usually has a convenient link provided to view it. Don’t click the link! If you have any thought that it might be valid, contact the sender to confirm they sent it.

The other type of phishing email that was popular for a couple of days was the fake shared document notification. The email purported to be from a colleague, but the actual From address was not a Berry address. Also, the document was shared on some other cloud storage system other than OneDrive. Documents related to college business and activities should never be put on any other cloud storage service other than OneDrive. Be very careful with shared document notifications…always verify with the purported sender.

Email is also the subject of my next warning. During the early days of the corona-virus meltdown, many companies bought up vast amounts of protective gear, especially masks, gloves, and other disposable personal protective equipment (PPE). Some of these companies are now holding large quantities of PPE in stock and realizing they need to get rid of at least a portion of it. We have already seen some spam emails offering PPE and we will probably see more. You can either simply delete these emails or you can flag them as spam using the tools in Outlook. While I don’t mind them being reported via the “Report Email as Phishing” button, many technically aren’t phishing as much as simple spam. With that said, don’t hesitate to report any that you feel are more than just unsolicited commercial emails.

How to flag an email as spam? In Outlook, with the spam email open, there is a button on the left-hand side of the menu bar that lets you block the sender. It looks like a person with the red “circle-with-a-backslash” symbol (officially the “general prohibition sign”). The first option is “Block Sender” which will block the sender and send the email to the Junk folder.

One last thing. I’ve typed “Report Email as Phishing” more times that I want to count, and all the “cool colleges” have a nifty acronym for their phishing reporting tool, so I’ve decided we should also have one. Therefore, from now on, the “Report Email as Phishing” button will be referred to as the “REaP” button (capitalization/non-capitalization is intentional), which I think is fitting, as it allows us to “reap” phishing emails from our system. Yes, I know “reaping” generally means harvesting or gathering useful or good things, not dangerous emails, but the base action is fundamentally the same. Right? I’m glad you agree. Whew, that will save me twenty characters of typing per instance moving forward!

Be on the lookout for an announcement concerning the official opening of the Berry Information Security Phishbowl, or simply, the Phishbowl. I WILL NOT be using an acronym for that, thanks to the Urban Dictionary.

Here goes the usual reminders…

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted (someday when the corona-virus crisis has passed…).

Photo Credit: Photo by Hans-Peter Gauster on Unsplash

Emails offering a personal assistant job opportunity are fraudulent

UPDATE: A new version of this fraud was sent from a compromised Berry account recently. The subject of the email was “P.A Job Offer”. It was offering $500 a week to be a personal assistant. As mentioned below, do not reply to this email, as it is an attempt to steal money from you.

An email has been sent to the majority of the Berry College students claiming to offer a work-from-home assistant job. This offer is fraudulent and is not a valid job offering. Do not send information to the address in the email or give out any personal information. The full text of the email is shown below for reference. The most obvious indicator of fraud is the fact that the sender in the “From” line ( not shown, but is in fact Jane.Lee@vikings.berry.edu) does not match the closing signature line (Jane Hickman). This type of email may show up again, slightly modified, with different names, wages or responsibilities, so be very careful with offers like this.

Hello and Good day,
Dr. Alex is currently looking out for an assistant who is self motivated, reliable, articulate and eager to learn with minimal supervision required to work-from-home part time as his Personal Assistant.

Job Scope:

> Manage diary and schedule meetings and appointments??
> Screen and direct phone calls and distribute correspondence
> Produce reports, presentations and briefs
> Make travel arrangements

Hours:  An Average of 12hrs weekly
Wages: $200.00 weekly

If interested, Submit your resume/cover letter directly to Dr. Alex via: alexwaton27@gmail.com

Sincerely,
Jane Hickman

Originally posted June 18, 2019. Updated June 22, 2020.