Welcome to the start of the 2021-2022 fiscal year! You’ve probably been scrambling over the past few days to get all those “end of the year” things completed. I know I have. Just because the “new year” is starting doesn’t mean that we aren’t already in full swing with many summer initiatives, including the Governor’s Honors Program, preparing for the fall semester, hosting camps, and just getting those things that must be done outside of the two main semesters done. This being the start of July, the Independence Day holiday approaches as I write this newsletter, but by the time most of you read it, the day will have passed, so I hope you all had a fun, safe, and meaningful time celebrating.Continue reading “July News from Information Security”
Please check the end of this article for a very late breaking notice about Amazon devices!
With the arrival of June, summer is in full swing. Welcome to the time when everyone else thinks we as a college community have it easy, when we all know that is NEVER the case. Summer is always busy, busy, busy on all fronts, but I’m preaching to the choir here. Between projects, recruitment, alumni events, college-hosted events and yes, even classes, everyone has their hands full, which makes us all prime targets of phishers and scammers.
“You say that every month!” you say. Yes, I admit I do, but I always have a new or forcibly recycled reason for why we are prime targets. I have both this time.Continue reading “June News from Information Security”
May has arrived and if you are like me you are gearing up for summer while trying to finish up the semester. This frantic time of finals, final papers, showcases, productions, graduation, and all other manner of “showing your work” is in full swing. Good luck to everyone, whether you are taking tests, giving tests, grading tests, or something else. I know everyone is ready for a change. A change of season brings a change in many other things, including information technology and security. I have a couple of changes to pass along to the community, along with the normal warnings and reminders. Let’s get to it!Continue reading “May News from Information Security”
Welcome to April and all that it means to this community! April is the month before the end of the semester in May. April means it is getting warmer and it’s time, if you haven’t already, to cycle in a new wardrobe of clothes for the fast-moving weeks at the end of the school year. I want to apologize for the tardiness of this newsletter. I was unavoidably out of work for a week due to problems caused by the massive amount rain we received back on March 25th. I know so many of you wait with bated breath for the first day of the month just to read my newsletter, so I apologize for the delay. </sarcasm>Continue reading “April News from Information Security”
Whew! We made it to March!
While there won’t be some of the typical shenanigans we are used to experiencing in March, like Spring Break (sorry, I had to mention it), there are plenty of things to be aware of. This newsletter may run a little longer than most, as we are “enjoying” the result of a confluence of tax season, potential economic stimulus payments, Zoom meetings, COVID vaccines, plus all the regular stuff. As Maverick from Top Gun would say, this is a “target-rich environment”, except not for potential dates, but for phishing emails.Continue reading “March News from Information Security”
One of the first things you will notice about these fake “anti virus” protection emails is the odd font in the subject line. A small font, sized at half the height of normal fonts, it looks…odd. This is red flag #1. If you bother to open the email and hover on any of the links, you will notice they do NOT go to either a Norton site or a Symantec (the owner of Norton) site. This is red flag #2. Closely related to this is red flag #3…the email did not come from an address of either company.
The email does contain an image, shown below, which purports that this email came from an “affiliate” of Norton, but does provide a name. All links in the email go to the same domain, flagged as a phishing domain by security company Kaspersky – red flag #4.
You should just delete these emails. If you have opened one and clicked on a link, please let me know so we can discuss the potential impact of this action and what steps you may need to take next. You can email me at email@example.com.
Welcome to the intentionally delayed August Information Security newsletter. I wanted to release this in conjunction with everyone returning to campus. First I want to welcome all our new faculty, staff and students as we begin this most interesting journey into the fall semester. I also want to welcome all the returning faculty, staff, and students who have been in various ways
preparing feverishly (uh, maybe that’s not a good metaphor) striving earnestly for the start of classes.
You all have been inundated with safety information in relation to the coronavirus, COVID-19, or whatever name you want to use (I will simply use “virus” in this newsletter) to describe the virus that has upended our lives in such a profound way. I hate to be one to pile on, but in addition to the virus itself, all kinds of bad actors are afoot attempting to fool you into clicking on malicious links, submitting sensitive information, even giving up your passwords, many of them preying on the chaos caused by the virus. Please be extremely vigilant with any unexpected emails, and treat all email, at this point, with caution.
Internet criminals have no qualms about using any leverage they can to trick you. One of the latest ploys involved criminals spoofing the Small Business Administration loan relief website to try and steal information from you. Fake websites with false information about cures for the virus and government relief programs are rampant. Be very careful surfin’ the net out there.
I have some news concerning the InfoSec News and Information site (this site you are reading this article on). For the new folks (and even for returning folks who have never visited the site before), this site has a brand new look and feel. The style has moved from looking like a website from the early 2000s to now looking at least “2017ish”. I hope you like the new format and the easier navigation.
A downside to all this progress is that the transition has left the site without an events calendar, at least temporarily. I am looking for a new one and hope to get that squared away soon. Events will necessarily look a lot different for a while, but I hope to conduct some LunchITS training sessions this semester, via Zoom, of course, and I will continue to create and share new security awareness training videos. Keep checking back to see when the new events calendar shows up.
Also coming soon to the site is a “phishbowl” where you will be able to view examples of phishing emails so you can know what to look out for and also see just how desperate some people are to try and scam you. This should debut in the next week or so and will be accessible from the main page of the site.
I will, of course, continue to post warnings about phishing emails and notices about other information security topics. It will all be accessible here on the site, so bookmark it and check it regularly.
Here are some reminders (or “new information” for some of you)…
If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing firstname.lastname@example.org to tell them you want MFA!
If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and (eventually) the events calendar will return, where events like LunchITS training sessions and other opportunities can be found.