January News from Information Security

Happy, happy new year! (Yes, I put “happy” in twice, on purpose, both for effect and positive emoting)

I hope everyone had a great holiday time, were able to relax as they saw fit, and are ready for the new year and a new semester. We have challenges this semester, but we’re moving forward, looking ahead, and have so much headed our way.

One of the most ominous things headed our way is the latest phishing scams. Phishers are now attempting to convince potential victims that they have been in contact with a COVID infected person. The emails will have a subject of “COVID-19 testing result” or something similar, and will ask the recipient to open an Excel document and enable macros. This results in the computer becoming infected with a piece of malware, the most common one designed to steal your banking information. This is just one of the possible scenarios. Other possibilities include sending the recipient to a fake login page to steal their username and password. Be very careful with any emails about COVID and related topics – the idea is to scare you into making a bad decision. Don’t be a cyber victim of COVID.

We’re actively working on rolling out cybersecurity awareness training to everyone this semester. There will be plenty of notice given before you receive emails inviting you to complete this training. Thank you to everyone who responded to the survey back in December about how often to conduct cybersecurity awareness training. We will take your suggestions and attempt to find an interval that works for the majority of people.

Data Privacy Day Week is coming! January 24th through the 28th is Data Privacy Week. What was once just a day of helping people understand the importance of data privacy, both from a data gatherer perspective (Berry College is a data gatherer) and from an individual “customer” perspective is now a whole week! There will be a couple of articles published that week covering data privacy topics that I hope you will find useful. The first will come out on that Monday, the 24th.

This paragraph will make some of you angry. A tiny few of you will heartily agree with me and others will be unsure (that’s just how these things work). Due to new threats “in the wild” now, I implore you to not store your credentials using just your browser, regardless of whether it is Chrome, Firefox, Safari, Edge or whatever. New malicious code can extract your passwords from the browser in encrypted form, leaving only a few seconds, minutes, or hours of decryption/cracking time between cyber-criminals and your passwords. Use a password manager, which is designed specifically to protect passwords. Even a password manager that has a browser plug-in is safer than just using your browser to store passwords. There, I’ve put it into ones and zeros for everyone to read. I’m sorry to those I have angered, but it had to be done.

Back to those pesky phishing emails. If you haven’t noticed, the Report Email as Phishing button has some new features. You can now add a comment to a phish report. You can also classify the email as a phish, spam, or leave it as “unknown” and let me sort it out as you always did before. This is what the new feature looks like in Outlook and on the mail.berry.edu web interface.

If you click on the “Show Sender’s Details” link, it will show you the full email address the suspect email was sent from. This may be helpful to you in determining whether the email is a phish or just spam. It might not. Again, if you are unsure, just leave the classification on the default of “unknown”. I hope these new features are useful to you as you spot those nefarious phishing and aggravating spam emails in your Inbox.

You should all have MFA enabled on your account and you should use it in the most secure way via the Microsoft Authenticator app on your smart phone. But don’t stop there! Use the Microsoft Authenticator as your second factor on any site that supports Google Authenticator. Turn MFA/2FA on everywhere you can. Yes, it will take you another few seconds to log in, but your data and account will be safer.

If I’m not covering a topic of cybersecurity you are interested in or concerned about, please let me know. I want to be your first and best resource on cybersecurity information, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. If you are not into social media, you can also subscribe to get updates via email. Just use the link available in the right-hand sidebar on the current posts page.

You can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the events calendar where events will be posted, including training opportunities and upcoming days of interest.

Food For Thought

Back to the cold, hard truth from XKCD

Featured Image: Photo by Moritz Knöringer on Unsplash