July News from Information Security

Happy July! I hope everyone enjoys their half-day Fridays! That’s about all the good news I have, unfortunately. Times of national (and international) upheaval, like the COVID pandemic, war in Europe, and the like are, similar to death and taxes – inevitable. What is also inevitable is that some people will use these times to prey on the fear, uncertainty and doubt in the minds of everyone else to try and take your money. “They” need your money RIGHT NOW to solve a problem, invest in the future, or fight back against a threat. They will email you, call you, even text you to solicit your money. The flood will be relentless…

…and that’s just the politicians.

Cyber-criminals will also take advantage of this time of uncertainty and fear to try and trick you into contributing to fake charities, false political movements, and other types of fraudulent activity to get your money. It happened during COVID, it happened when Russia invaded Ukraine, and it will happen now with these landmark rulings by the Supreme Court. While I don’t yet have examples of phishing emails attempting to leverage the heightened emotions of US citizens, I have no doubt they are out there and will be here soon. Be very careful and skeptical of any emails, texts, or phone calls that attempt to raise funds or ask for personal information to help contribute to a cause, regardless of your personal feelings on the subject. As always, look for the red flags of phishing emails and social engineering:

• Urgency – already heightened emotions are easier to manipulate
• Generic greetings
• Unknown senders
• Requests for personal or sensitive information
• Poor grammar and spelling
• Links and unsolicited attachments

Stay sharp and focused to avoid being phished.

I’ve mentioned in past newsletters about the need (not the requirement) to keep personal and work data separate. I now wish to focus on a more concrete aspect of that idea. During in-person training sessions, I’ve mentioned in passing that the Office of Information Technology is notified whenever a mail handling rule is created by a user. These are the rules you use to send those annoying spam emails directly to the Deleted Items folder so you never have to see them. These rules, of course, can be abused by both normal users and by a cyber-criminal that has taken control of a user’s mailbox. We don’t get notified because we’re interested in the junk email you get. We get notified so that we can intervene if a rule is abused to take over or hide a conversation from the proper owner of the account.

With that long-winded explanation out of the way, the point I am slowly arriving at is that you shouldn’t forward Berry emails to personal accounts. We experienced an incident recently where it appeared that a user had forwarded ALL email coming into their Berry email account to their personal account. This practice, while not expressly forbidden (yet), creates a dangerous risk to the college, particularly when emails containing protected or sensitive data are forwarded out of the Berry email system. Please don’t do this, because again, it exposes the college to risk and could expose you to potential consequences if that email is mishandled or lost. If you receive emails of a personal nature, unrelated to Berry work, into your Berry email account, you are welcome to create rules to forward these to a personal account. As mentioned before, there are some services that are personal in nature that require you to have a .edu email address to use or qualify for. It is still fine to leverage your berry.edu account for these purposes.

That’s all for now. I’m sure that as soon as this newsletter publishes, there will be more things to pass along, but it’s July and I’m going to keep it short. It’s hard to read important emails with the sun beating down on your phone while you recline on the beach…but I’d sure like to try.

You all have MFA enabled on your Berry account, you should use it in the most secure way via the Microsoft Authenticator app on your smart phone. But don’t stop there! Use the Microsoft Authenticator as your second factor on any site that supports Google Authenticator. Turn MFA/2FA on everywhere you can. Yes, it will take you another few seconds to log in, but your data and account will be safer.

If I’m not covering a topic of cybersecurity you are interested in or concerned about, please let me know. I want to be your first and best resource on cybersecurity information, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. If you are not into social media, you can also subscribe to get updates via email. Just use the link available in the right-hand sidebar on the current posts page.

You can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the events calendar where events will be posted.

Food For Thought

Featured Image: Photo by weston m on Unsplash