July News from Information Security

Well, 2020 has been a trip so far, wouldn’t you agree?

“Trip” might be an understatement. It’s as if our lives are as jumbled and chaotic as this pile of puzzle pieces. Nothing seems to make sense, or have any clarity whatsoever. Between the corona-virus, murder hornets, protests (and riots), cancel culture, and for extra flavor, all during an election year, I know many of you are weary and yearn for some good news.

This post is not that…I’m sorry.

We’ve been bombarded by all kinds of phishing emails. Thanks, again, to everyone who reports these and to those who simply delete them and move on. There’s no relief in sight for these. We will continue to be sent fake personal assistant jobs, fake upgrade notifications, fake meeting notifications, fake emails about ‘favors” and “urgent requests”, fake shared document notifications, and more. Please be vigilant, informed, and conscientious in handling your email.

One particular type of phishing email that has popped up recently (again) is one where a phisher uses old emails from a compromised account to attempt to get users to click on a link leading to a “report” or “project update” or other some important document. From your perspective, you see a familiar subject line in an email, potentially coming from a valid and known address, but in the body of the message, there is a sentence about an updated report or some other document that has nothing to do with the original email. It usually has a convenient link provided to view it. Don’t click the link! If you have any thought that it might be valid, contact the sender to confirm they sent it.

The other type of phishing email that was popular for a couple of days was the fake shared document notification. The email purported to be from a colleague, but the actual From address was not a Berry address. Also, the document was shared on some other cloud storage system other than OneDrive. Documents related to college business and activities should never be put on any other cloud storage service other than OneDrive. Be very careful with shared document notifications…always verify with the purported sender.

Email is also the subject of my next warning. During the early days of the corona-virus meltdown, many companies bought up vast amounts of protective gear, especially masks, gloves, and other disposable personal protective equipment (PPE). Some of these companies are now holding large quantities of PPE in stock and realizing they need to get rid of at least a portion of it. We have already seen some spam emails offering PPE and we will probably see more. You can either simply delete these emails or you can flag them as spam using the tools in Outlook. While I don’t mind them being reported via the “Report Email as Phishing” button, many technically aren’t phishing as much as simple spam. With that said, don’t hesitate to report any that you feel are more than just unsolicited commercial emails.

How to flag an email as spam? In Outlook, with the spam email open, there is a button on the left-hand side of the menu bar that lets you block the sender. It looks like a person with the red “circle-with-a-backslash” symbol (officially the “general prohibition sign”). The first option is “Block Sender” which will block the sender and send the email to the Junk folder.

One last thing. I’ve typed “Report Email as Phishing” more times that I want to count, and all the “cool colleges” have a nifty acronym for their phishing reporting tool, so I’ve decided we should also have one. Therefore, from now on, the “Report Email as Phishing” button will be referred to as the “REaP” button (capitalization/non-capitalization is intentional), which I think is fitting, as it allows us to “reap” phishing emails from our system. Yes, I know “reaping” generally means harvesting or gathering useful or good things, not dangerous emails, but the base action is fundamentally the same. Right? I’m glad you agree. Whew, that will save me twenty characters of typing per instance moving forward!

Be on the lookout for an announcement concerning the official opening of the Berry Information Security Phishbowl, or simply, the Phishbowl. I WILL NOT be using an acronym for that, thanks to the Urban Dictionary.

Here goes the usual reminders…

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted (someday when the corona-virus crisis has passed…).

Photo Credit: Photo by Hans-Peter Gauster on Unsplash

Data Breach Notification: LiveJournal

In 2019, there was news of a possible breach of LiveJournal data. In May of 2020, the breach was confirmed by the release of the data on a hacking forum. There were 26 million records exposed from the site, which included email addresses, passwords, and usernames for the service.

There were 52 berry.edu or vikings.berry.edu email addresses included in the breach.

To find out if your information is included, you can go to Have I Been Pwned and enter your email address in the search form. While you are there, you can also sign up for breach notifications involving your Berry or other email addresses by clicking on “Notify Me” at the top of any page on the site.

If your information was included, be sure to change your password for the LiveJournal website. Also, check your posts and settings to make sure they have not been altered.

Be sure to NEVER reuse your Berry email password for any other website or service! Stay vigilant against phishing emails by learning what to look for. Check out the Phishing Quick Info page here on this site at a minimum.

As always, if you have questions about any of this, you can contact Information Security using the information on the right-hand side of any page on this site.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

May News from Information Security

Wait?

It’s May already?

Where did April go?

It passed by as we were stuck at home and no, you didn’t miss the the April newsletter, as it was lost in the work-from-home shuffle. There’s a hint of a light at the end of the coronavirus tunnel as some businesses are opening and some restrictions lifted, but that’s all I’m going to say about that…

While we may not have been as busy during this time, phishers, scammers, and other bad actors have gone into overdrive. Some sources have placed the increased fraudulent traffic as 300% higher this last quarter over the same quarter from 2019. The amount of emails attempting to leverage the coronavirus and associated fears has grown astronomically and the phishers have an edge in this environment – we’re already stressed and uncertain.

There are emails purporting to have a cure for the disease, others with great deals on PPE (who figured that acronym would ever become common?), some trying to steal CARES relief funds, and others trying to convince people they have come in contact with someone with the virus. That’s just a tiny sample. There are some new articles on this site covering social media surveys, Skype password phishing, and complaint scams. The COVID-19 article was updated multiple times with new information. If you haven’t read those yet, you should check them out after you’re done reading this.

Myriad opportunities abound to phish, scam, and deceive people who have severe cases of cabin fever, restlessness and real fears about jobs and finances. No stress point is neglected in the daily attacks from bad actors trying to compromise accounts, steal credentials, and wreak havoc in an already chaotic environment. Many people are learning new ways to work, communicate, shop, eat, and socialize. All of the “new” is irresistible to scammers and phishers. Here is what I consider the number one safety tip (with some examples) to safely navigate this new (hopefully temporary) normal.

  • Almost all email should be considered suspect at this point. Apply a much higher grade of scrutiny to any and all emails you receive.
    • Emails like the ones mentioned in the Skype phishing article will appear to come from a variety of services, all of them trying to get you to click on that link or button in the email to check your notifications. Don’t!!! Simply log in to the site or service like you normally would, and if you have notifications, they will be there.
    • Emails asking for banking information or other financial information should be VERY carefully scrutinized. Most will be fraudulent. If you or a family member need to supply banking information to receive CARES funds or are having to deal with unemployment, make sure you are going to the right resources. Numerous government sites are available including the Health and Human Services site  and the primary government site about coronavirus information. The Georgia Department of Labor site is where to get answers about the process of receiving unemployment benefits.
    • Phishers haven’t given up on old themes. We have received plenty of emails to campus inboxes purporting to be from college department heads, all the way to President Briggs, asking you to for a “favor” or with an “urgent request”. Don’t fall for these! Check the From address and look for the external email banner to determine the validity of emails like this. The fact that they should be EXTREMELY rare should immediately render them suspect.

On a somewhat different topic, check out the new voicemail notification Quick Tip here on the site. It explains how to tell if a voicemail notification received via email is valid or not.

Here’s hoping that things will get back to normal soon, even if normal is slightly different. As always, if you ever have a question about an email or other questions about information security, please don’t hesitate to contact me at infosec@berry.edu, extension 1750 or 706-236-1750. I’m still working at home, like many others.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted (whenever we get to the point we can do that).
Photo Credit: Photo by Jose Antonio Gallego Vázquez on Unsplash

Watch Out for Social Media “Surveys”

With everyone spending more time at home, traffic on social media sites has grown tremendously. One particular item to avoid during this time of boredom meltdown, even though they may be fun, are so-called “surveys” on social media sites. You know, the ones that ask about favorite colors, pet’s names, mother’s maiden name, what schools you attended, favorite songs, movies, cars, or whatever? Do these questions sound familiar?

If you have ever set up backup “security questions” for a web site, you’ll notice the surveys ask for many of the same bits of information. A fair percentage of these surveys are simply intended to grab your username for the social network, then slyly ask you to hand over potential security question answers.

Don’t fill out these surveys. Yeah, they can be fun, maybe, but if the information you willingly hand over may allow someone to reset your password by knowing the answers to your security questions, then they are a really bad idea!

With that in mind, whenever you fill out these backup security questions, you should never put real information in as your answers. Make up answers for these questions, then record those answers somewhere safe, like in a password manager, along with your unique password for the site! This way, you can provide the answers to these questions, but no one else will be able to discover than information from the far reaches of the Internet, or from your answers to a social media site “survey”.

If you would like more information on password managers, check out the short password manager article here on this site.

 

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

 

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit: Photo by William Iven on Unsplash

February News from Information Security

Welcome to the much delayed February newsletter! I apologize for the tardiness of this edition.

There is a fair amount of news to share, some of it WAY overdue, so I’ll start there.

First, if you are using multi-factor authentication (MFA), you experienced a change in your password settings this week. I apologize for the unannounced change, that was not the way it was planned. The change includes two very important modifications to your password requirements – first, and most importantly, your password does not expire for 365 days! That’s a whole year to not have to worry about changing passwords. Second, and still very important – your minimum password length has changed from 8 characters to 14 characters. Yes, that is a big change, but it shouldn’t be an issue, as you have a whole year to come up with another password! The change was important due to the increased maximum password age. A 14 character password is exponentially harder to crack than an 8 character password. Your basic password security is still important. If you have issues creating a 14 character password, please take a look at the good password guidelines Quick Info guide here on the site. It is a good quick resource for creating strong passwords.

Second, please check the recent post on this site about a data breach on the Adult Friend Finder website. There were 22 Berry email addresses included in that breach.

The third item on our list refers back to the first one. If you are not using MFA, you should be! In addition to only having to change your password once a year, you get the added security of multi-factor authentication. All faculty, staff and students are eligible and encouraged to use MFA, not only for Berry accounts, but for all of your accounts that support it. Multi-factor authentication and creating secure passwords are two life skills many of us never thought we would have to learn, but here we are!

Fourth, there is a LunchITS planned for Thursday, February 13th from noon until 1PM in Krannert 109. Bring your sack lunch or grab something in Krannert and come learn how to quickly spot phishing attempts and get a clearer understanding of the tactics, techniques, and procedures used by phishers as they attempt to sink a hook into our organization.

Finally, in lieu of a topic of discussion here in the newsletter, take a look at this great SANS OUCH! newsletter for February about Social Media Privacy. It goes right along with information from our recent Data Privacy Day back on January 28.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit – Photo by Yura Fresh on Unsplash

January News from Information Security

Welcome to this special “mid-January” monthly edition of news from Information Security!

With the students not returning to class until the 13th of the month, this edition was delayed to roughly coincide with their arrival. Also delayed are the security awareness posters, for those who get them and post them in their offices. If you would like to have security awareness posters to put on a departmental or office bulletin board or at “the watering hole” for your area, please email infosec@berry.edu and mention you would like to receive these on a monthly basis (and how many). They will normally be distributed at the first of the month, but again, for January, 2020, they will be distributed the week of the 13th.

I’ve already sent a couple of emails to faculty and staff this year, one about the new idle workstation lock policy that went into effect on the 6th of January, and another pointing to a post here urging everyone to be particularly vigilant in the next few weeks, and beyond, as tensions with Iran continue to build. It is assumed that part of Iran’s counterattack will be conducted in the digital realm. You can read the warning by clicking here.

On the topic of returning things, there will be a LunchITS scheduled toward the end of January. The topic will be account security, including information about usernames, passwords, password managers, and multi-factor authentication. If any of that sounds unfamiliar, then this LunchITS is for you. I will send out an email when the schedule is confirmed and you can always check the event calendar right here on the InfoSec News & Alerts site for future events. February will see the return of the phishing LunchITS and a brand new LunchITS geared toward a broader overview of security awareness.

Wait, what’s a LunchITS, you ask? LunchITS, which is short for “Lunch+Information Technology Security” are one hour training sessions, held during the lunch hour (12:00 noon – 1:00 PM) in Krannert, where you can come, with your lunch, and learn more about information security. You can pick up lunch at Krannert, or brown bag it. Just be prepared to learn while you eat. You’ll get information to take back with you, with all of the main points of the session included on the provided literature, for those of us who can’t eat and take notes at the same time.

Also coming up in January is Data Privacy Day, celebrated on the 28th of the month, which just happens to be a Tuesday, and Information Security will have a table in Krannert from 11:30AM until 1:00PM where you can drop by and ask questions, pick up information, and grab some gratuitously bad edible items. This event will also be on the event calendar on this site and an email will go out the day before to remind you.

Finally, coming soon to a computer or phone screen near you (probably on your desk or in your hand) is the next in-house written, filmed, and produced security awareness video. The intrepid Director of Information Security will help yet another would-be victim with their security awareness. As soon as it is ready, an announcement will go out over email and on social media.

On that topic, if you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the previously mentioned events calendar.

That’s it! Welcome back to a new year, everyone, whether you just got here or have been here for two weeks this year already.

.

Photo Credit – Photo by Glen Carrie on Unsplash

 

 

NCSAM Week 1 – Social Media, Passwords, Cyber Hygiene

Welcome to National Cyber Security Awareness Month, also known as NCSAM!

Every week this month we will explore topics around the theme of “Own IT, Secure IT, Protect IT”. That’s not three typos in a row, that’s “IT” as in information technology. We are surrounded by it, in our homes, at work, in stores, and just about anywhere we go. We depend on it, just like we depend on our cars or bikes. That means, just like cars and bikes, we have to take care of it with regular maintenance, and make sure to lock it so it won’t get stolen.

Each week we will briefly explore an idea around each of these aspects of owning, securing and protecting. This week, in relation to “owning” our IT, we want to remind everyone to be careful what they post on social media. Once something is posted, nothing short of an EMP or nuclear war will remove it from the Internet (not that there would be an Internet left after either of these occurrences, but you get the point). These days, employers routinely explore prospective employee’s social media posts to get a better idea of the person they are considering hiring. Own your social media by being careful about what you post and also by asking your friends to not include you in potentially derogatory posts.

In the realm of “securing” our IT, please make sure you are using strong, unique passwords for your online accounts. Strong passwords should be long, at least 12, if not more, characters. Don’t be concerned so much with complexity, because longer passwords are generally better. Don’t use your name, your pet’s name, your phone number, or any other information that might be available online. Don’t reuse passwords between accounts, particularly passwords for financial, or other sensitive accounts. If you have a lot of accounts (and honestly, who doesn’t?) consider using a password manager to help you create and “remember” all those strong unique passwords. You can get more information on strong passwords and password managers at the table in Krannert on Thursday

Finally, concerning “protecting” our IT, follow good cyber hygiene practices. Just like you have to clean up trash, brush your teeth, and wash your clothes (at least occasionally), you should close out online accounts you don’t use, change your passwords periodically, and delete files you no longer need. You should also always lock your computer if you are stepping away from it (not recommended if it is a laptop. keep it with you!), and always use either a pin, or a bio-metric lock mechanism (finger scan, face recognition) for your mobile devices, especially your phone. Your phone is the key to so many of your online accounts. Make sure it is secured!

Check the table in Krannert on Thursday for info and goodies and a chance to put your name in the pot for a prize to be awarded on Halloween. Also, please take a moment to read each future week’s article.

Here is this week’s video, an oldie, but goodie about password security. You will have to log in using your email credentials to view the video

Students: https://web.microsoftstream.com/video/2dc735da-b797-4725-a8bc-8f36dee9197a

Faculty/Staff: https://web.microsoftstream.com/video/f9c0bbb0-05ff-46ca-ad67-d6cae6a23b6e