October is Cybersecurity Awareness Month - CSA

It is CIS's responsibility to share some vital information about how to be safe while using the internet and managing yours and students' information.

Over the next few weeks, CIS will be releasing a weekly blog post that expands on four core topics for this year's CSA month: Phishing, Social Engineering (whaling), Passphrases for passwords, and Ransomware.

At the end of the month, there will be a quiz released to employees and students. Receiving 100% on the quiz will automatically enter the user into a raffle. The raffle will have two winners, one student and one employee, who will each receive a prize* from CIS!

Keep an eye out for the first blog post on October 9, and then every following Monday until the end of the month!

*Please note that prizes will be ordered once they are selected by the prize-winners. CIS will contact prize-winners when the prizes are ready to be picked up from the HelpDesk.

Security Awareness Week 1: Phishing emails

What is Phishing?

Often carried out over email -- although the scam has now spread beyond suspicious emails to phone calls (so-called "vishing"), social media, SMS messaging services (aka "smishing"), and apps -- a basic Phishing attack attempts to trick the target into doing what the scammer wants. 

Exactly what the scammer wants can vary wildly between attacks. It might be handing over passwords to make it easier to hack a company or person, or sending payments to fraudsters instead of the correct account. This information is often stolen by making requests that look entirely legitimate -- like an email from your boss, so you don't think twice about doing what is asked.

How would you identify a Phishing email?

Emails that contain the following should be approached with extreme caution, as these are common traits of phishing email:

• Urgent action demands.
• Multiple sources in the from email address line.
• Poor grammar and spelling errors.
• An unfamiliar greeting or salutation.
• Requests for login credentials, payment information, or sensitive data.
• Offers that are too good to be true.

Phishing is also a popular method for cyber attackers to deliver malware by encouraging victims to download a weaponized document or visit a malicious link that will secretly install the malicious payload on the person's computer. These kind of attacks mostly are trying to distribute a  trojan malware, ransomware . These cyber hackers are hoping you don't look to deep into the email, that you just gloss over the details and click on the link, or download the attachment. Below is a screenshot of a phishing email, and you can see just how tricky they can be.

Why is Phishing called Phishing?

The overall term for these scams -- Phishing -- is a modified version of the word 'fishing' except in this instance the one doing this fishing is a scammer and they're trying to catch you and reel you in with their sneaky email lure. In most cases, they will send out many of these lures.

FUN FACT! - Why is Phishing spelled with a "Ph"?

The “ph” spelling of phishing is influenced by an earlier word for an illicit act: phreaking, which involves fraudulently using an electronic device to avoid paying for telephone calls. The people who perpetrated phreaking were called “Phreaks,” and since phreaks and hackers were closely linked, the “ph” spelling was used to denote the phishing scams involving these underground groups. Pretty cool!

We hope by sharing these resources with you, that you will have the tools and information necessary to make informed decisions when using the Internet.

Security Awareness Week 2: Ransomware

The CISA defines Ransomware as a "form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption."

Ransomware can be planted into a network using many methods, like Phishing and Social Engineering. Once it is planted, hackers locate and secure access to important files and move those files to a secure network of their own.

Oftentimes, a hacker needs only access into a network, and can gain such access in a myriad of ways. For example:

• By sending phishing emails requesting login information or containing malicious code(as we have seen in last week's post) 
• Looking for weaknesses within your network's security
• Users are redirected to a suspicious website that infects their computer by browsing or prompts for them to download files off the internet.

Password Managing

If you are worried about keeping track of your passwords, use a password manager that will keep track and record all of your passwords and where they are used. It is also likely that your phone or Google account will have password tracking enabled.

For more information on SPU's Password Policies, please select here.

Cybersecurity Awareness Month Quizzes

Thank you for joining us for this year's Cybersecurity Awareness month as we covered Phishing, Ransomware, Social Engineering (Spear Phishing), Passphrases, and Canary Files. 

If you have questions or concerns about the topics covered, or would like to learn more, a student technician with the HelpDesk would be more than happy to assist! You can contact the HelpDesk by phone at 206.281.2982 or by email at help@spu.edu.

As a reminder, we are offering one quiz for Faculty and Staff and one quiz for Students to test their knowledge on the topics we covered this month. The quiz will remain open until November 15th, 2023.

A Few Rules to Follow: 

• One quiz attempt per individual. 
• A student may not take the employee quiz and employees may not take the student quiz.
• Only scores of 100% will be automatically entered into the raffle. 
• Prizes will only be given out to the winning individual(s) after they have made their *selection.
• One prize per winner. 

*Raffle winners will be contacted by CIS and choose their prize from the available options. Options include bluetooth speakers and/or gift cards. 

Guest WiFi

Guest WiFi is available for parents, friends, and campus guests. Connect to the network ID called  SPU-Guests , then launch a web browser and follow the guest registration instructions. Guests must provide a valid, non-SPU email address or a text-messaging cell phone number for registration. Guest WiFi is bandwidth-limited. SPU students should use the network named  SPU-Wireless  for high speed internet access.  Learn  more here .

Outdoor Wifi Locations

Outdoor WiFi locations are available in Tiffany Loop, Martin Square, and in front of the C-Store.

SPU Online Services 

All of your online services can be found by clicking on the  icon in the top right corner of of any SPU webpage and navigating to the  Students tab.

Microsoft Office 365 for Education

There are many Microsoft Office products available to you as an SPU student, including:

Printing and Copying

SPU provides a campus-wide printing/copying program for students. There are Multi-Function Printers (MFPs)  located across campus for your use. You can submit print jobs via the web from on or off campus and print them from any MFP once arriving on campus.   You can also print directly from your computer or a USB flash-drive, copy, and scan to email.  Document scanning on the MFPs is free and does not require print credit.  Detailed instructions are posted at each MFP and on the CIS website:  MFP Student Printing.

Print Credits

You receive print credits at the beginning of each quarter that accumulates through the academic school year as part of your Technology Fee.

• Students enrolled in 12 or more credits get $5.00 per quarter
• Students enrolled in 11 credits or less get $2.50 per quarter.
• When print credit has been used up, you can use Falcon Funds on your SPU ID Card for additional printing.

Watch Out for Scams!

While many illegitimate messages are filtered out of your inbox some may still get through. SPU will NEVER ask you to send or verify your login credentials or other personal/confidential information via email. Your account credentials should not be shared with anyone!

Job Scams     

You've probably already received several emails scam offering an employment opportunity from someone who appears to be associated with SPU. Please delete these messages and do not respond. All legitimate jobs at the university are posted on SPU's Handshake platform . Employers on Handshake are vetted to guarantee their trustworthiness.  Here is a blog post  with more information to help you identify and avoid employment scammers. If you have any questions about the legitimacy of an email message please forward it to   help@spu.edu. 

Phishing

Phishing scams often come in the form of email messages attempting to steal your username and password. PLEASE DO NOT reply to these messages or follow web links where you must confirm or enter your username and password.   If you have questions about the legitimacy of a message, please forward it to  help@spu.edu and we can assist. See this CyberSecurity Awareness Month blog post about phishing for additional information.

Peer-to-Peer File Sharing and Copyright Compliance

File sharing software that copies and distributes songs, movies, videos, games, and software applications without the permission of the owner is a Copyright Law violation that can subject you to criminal and civil liability. Content owners use technological means to track the file sharing of their intellectual property on the Internet. SPU is required by law to inform you if we are aware, you have violated copyright law and must provide your information to copyright owners for legal action if you do not cease illegal activity.  You are responsible for the activities of your computer when connected to the campus network. See Copyright Basics and  DMCA Copyright Compliance / Peer-to-Peer File Sharing for more information about copyright compliance.

Update Your Emergency Contacts and SPU Alert Info

It is important to be made aware of campus emergencies in real-time, as information is available.

• SPU-Alert is the emergency alert system used to notify you of campus emergencies via text, email, and voice calls. We need your current contact information so that we can send you alerts during a campus emergency.
• Emergency Contact Information includes the contact details SPU should use in the event that an emergency situation happens to you.

The beginning of the school year is a great time to review and update your information. Log into the  Banner Information System , go to the  Personal Menu , update your information on the   Emergency Alert System  and  Emergency Contact Information pages.

Guest WiFi

Guest WiFi is available for parents, friends, and campus guests. Connect to the network ID called SPU-Guests , then launch a web browser and follow the guest registration instructions. Guests must provide a valid, non-SPU email address or a text-messaging cell phone number for registration. Guest WiFi is bandwidth-limited. SPU students should use the network named SPU-Wireless for high speed internet access. Learn more here .

Campus Printing and Personal Printers

There are Multi-Function Printers (MFPs) available to you in many locations on campus. Each quarter you will receive credits to use towards printing and copying. We encourage all students to use these MFPs rather than bring a personal printer on campus. If you do need a personal printer on campus, please know that your wireless printers will not work on the campus wireless network. Disable the wireless networking on your printer and use a USB cable (available at the SPU Bookstore or other stores) to connect to your computer.

For Information about on-campus printing and copying see: Student Printing

Multifactor Authentication Everywhere

Whether it's as a part of your SPU account or your bank account, Multi-factor Authentication (MFA) is here to stay. While it's not a silver bullet against all cybersecurity threats (and we still need to be on the watch for "phishy" behavior), it's a simple measure that should be enabled anywhere it is available.

Multi-factor Authentication is a process by which you use a second "factor" to login to an online account, in addition to the username and password you already know. This second factor is most often "something you have", and can be a device with a registered application, a phone number to receive calls or texts, or a dedicated security token that generates an authentication code.

SPU is finishing up its migration of all "@spu.edu" accounts to MFA this Fall using Azure MFA (if you haven't enrolled already, do so now!). This means that all logins used to access SPU systems will be afforded this protection and our accounts and systems will be more secure. Importantly, this will also help prevent bad actors from using a compromised account to bombard campus inboxes with phishing or scamming attempts.

Do your part and set up MFA both here at SPU and anywhere else you have the option of doing so!

Getting set up with a Password Manager

Last week we talked about the importance of using Multi-factor Authentication Everywhere and how it can help protect you against cybersecurity threats.  This week we’re focused on your password and how you can protect yourself by setting up a Password Manager!

Most people tend to use easy to remember passwords, but those are also easily guessed and are thus weak to cyber-attacks.  If you use the same password for your email, bank, social media, and healthcare accounts, an identity thief who found your login info on the dark web would be able to access all kinds of sensitive information with a single username and password.

What are the Benefits of a Password Manager?

Individuals and businesses may find password managers useful in several circumstances:

• They can generate secure passwords for you.
  Many password managers will prompt you with an automatically generated secure password whenever you create a new account through an app or website. These passwords tend to be long blends of letters, numbers, and special characters. If you opt to use a suggested password, the manager will automatically store it for you.
• They can save time. While keeping all your login information safe is certainly a plus, a password manager can also store and auto-fill information like your address, phone number, and credit card. Online shopping just got a lot easier!
• They protect your identity. If a criminal can guess one of your passwords, they’ll try to access more of your accounts by trying that same password in other commonly used websites. But if you’re using unique passwords, they may not be able to gain access to your other accounts. While a password manager isn’t foolproof, it does provide an extra layer of security.
• They can let you know about phishing sites. Phishing and spear phishing websites are scams that spoof legitimate websites. While they may look like the real deal, their goal is to steal your login information and commit fraud. A password manager can offer protection from phishing sites because each username and password is tied to a specific URL. Even if you visit a phishing site, your login information won’t autofill because the URL doesn’t match the one saved in the password manager. This might give you pause before you enter your personal information and keep a criminal from stealing your personal information.

Apart from using a service or app to manage your login information, other steps that you can take to keep your information safe include not reusing passwords and creating strong, unique passwords for each website or application you log into.

What password manager should I adopt?

There are many password managers to choose from, how do I pick a good one? Checking reviews from reputable sources, like Wired or CNET will help you identify a password manager that will meet your needs.  Some commonly used Password Managers are: 1Password, Bitwarden, LastPass, and many others.

Additional Resources

Looking for more information about how password managers work?  Check out the following resources.

Colby, C., Hodge, R., Tomascheck, A., October 2022. Best password manager to use for 2022. https://www.cnet.com/tech/services-and-software/best-password-manager/. Retrieved October, 2022.

Gilbertson, S. August 2022.  The best password managers to secure your digital life. Wired. https://www.wired.com/story/best-password-managers/. Retrieved on October, 2022.

National Cybersecurity Alliance. May 2022. Online safety + Privacy basics: Passwords. https://staysafeonline.org/online-safety-privacy-basics/passwords-securing-accounts/. Retrieved October 2022.

National Cybersecurity Alliance. September 2022. Online safety + Privacy basics: Password managers. https://staysafeonline.org/online-safety-privacy-basics/password-managers/. Retrieved October 2022.

Identifying Malicious Emails

If you’ve been following along with our weekly Cybersecurity Awareness posts, by now you have MFA enabled on your accounts and a password manager set up to store all your passwords. Those tools help to secure your account, but malicious actors have other ways to steal data or defraud users.

Since the start of October, Microsoft has flagged 125,766 emails sent to SPU addresses as either phishing attempts, fraud, or malware. Can you distinguish between the different types?

• Phishing emails attempt to steal your account credentials.
• Fraud emails attempt to steal money from you. These can be emails such as:
  • Requests gift cards that will be “paid back right away”
  • Help wanted postings that require you to send money before they can hire you
• Malware emails contain attachments that install malicious programs on your system when opened.

The large majority of attempts like those mentioned above are automatically blocked by safeguards CIS has implemented in SPU’s systems. But for those that make it through, here are some steps you can take to protect yourself:

1. Take a few seconds to reread and review the email (answering yes to any of the following questions increases the chances the email is a phishing attempt).
   1. Is the offer too good to be true?
   2. Is the sender asking you to send them personal information and/or money?
   3. Is the language urgent or threatening permanent loss of access?
   4. Is the greeting generic or ambiguous?
   5. Is the request in the email a strange business request, especially from that particular sender?
2. Confirm the sender of the email.
   1. Hover over the display name of the email to review the address from which it was sent. Does the address match the supposed sender of the email?
   2. Beware of email addresses that are very similar looking to valid addresses such as: pavpal.com vs paypal.com or anazon.com vs amazon.com
3. Never click links in suspicious emails.
   1. Never use a link in the email to contact the sender. Call them using contact information on their website instead, to confirm whether or not the emailed request is valid.
4. Don’t open attachments from non-trusted senders.
   1. Opening attachments risks installing malware on your computer. Once installed, the malware can quickly propagate out to other areas of our network and infect the entire system.
5. Contact CIS if you still have questions.
   1. If you receive an email that passes all of the above checks but still seems suspect to you, contact CIS (help@spu.edu) and ask us to review it. We have additional tools and resources we can use to attempt to confirm its validity.

Managing your Software

In our last installment for Cybersecurity Awareness, we’re focusing on software updates.  Often, when we think about software updates, we think about our computer and our phone, but there’s more to updates than just those devices. 

The key things to remember about software updates are:

• Update often
  New patches come out on a regular basis and there will be new vulnerabilities. The longer you wait, the more vulnerable you and your data are to bad actors.
• Automate it whenever possible
  With the number of devices and applications out there that we each use, it can be hard to keep track of updates. This is where automation comes into play.  Sometimes, your devices and applications can keep themselves updated, taking some of the burden off you to remember to do this.
• Replace or upgrade unsupported software and hardware
  Hardware and/or software that is no longer supported and receiving updates can be problematic because there won’t be patches to protect the system and your information from new attacks and vulnerabilities. Where possible, upgrade or stop connecting the older devices to the internet to keep yourself and your data safe.
• Every device that connects to the internet should be updated.
  This includes your home router, smart devices used at home like security cameras and doorbells, Bluetooth deadbolt setups, car software, TV’s and more! If your system is online, we recommend keeping up with the updates!

We’re at the end of Cybersecurity Awareness month, but we hope by sharing these resources with you, that you will have the tools and information necessary to make informed decisions when using the Internet.

Guest WiFi

Guest WiFi is available for parents, friends, and campus guests. Connect to the network ID called  SPU-Guests , then launch a web browser and follow the guest registration instructions. Guests must provide a valid, non-SPU email address or a text-messaging cell phone number for registration. Guest WiFi is bandwidth-limited. SPU students should use the network named  SPU-Wireless  for high speed internet access.  Learn  more here .

Outdoor Wifi Locations

Outdoor WiFi locations are available in Tiffany Loop, Martin Square, and in front of the C-Store.

SPU Online Services 

All of your online services can be found by clicking on the   icon in the top right corner of of any SPU webpage and navigating to the  Students tab.

Microsoft Office 365 for Education

There are many Microsoft Office products available to you as an SPU student, including:

Printing and Copying

SPU provides a campus-wide printing/copying program for students. There are Multi-Function Printers (MFPs)  located across campus for your use. You can submit print jobs via the web from on or off campus and print them from any MFP once arriving on campus.   You can also print directly from your computer or a USB flash-drive, copy, and scan to email.  Document scanning on the MFPs is free and does not require print credit.  Detailed instructions are posted at each MFP and on the CIS website:  MFP Student Printing.

Print Credits

You receive print credits at the beginning of each quarter that accumulates through the academic school year as part of your Technology Fee.

• Students enrolled in 12 or more credits get $5.00 per quarter
• Students enrolled in 11 credits or less get $2.50 per quarter.
• When print credit has been used up, you can use Falcon Funds on your SPU ID Card for additional printing.

Watch Out for Scams!

While many illegitimate messages are filtered out of your inbox some may still get through. SPU will NEVER ask you to send or verify your login credentials or other personal/confidential information via email. Your account credentials should not be shared with anyone!

Job Scams

You've probably already received several emails scam offering an employment opportunity from someone who appears to be associated with SPU. Please delete these messages and do not respond. All legitimate jobs at the university are posted on SPU's Handshake platform . Employers on Handshake are vetted to guarantee their trustworthiness.  Here is a blog post  with more information to help you identify and avoid employment scammers. If you have any questions about the legitimacy of an email message please forward it to   help@spu.edu. 

Phishing

Phishing scams often come in the form of email messages attempting to steal your username and password. PLEASE DO NOT reply to these messages or follow web links where you must confirm or enter your username and password.   If you have questions about the legitimacy of a message, please forward it to  help@spu.edu and we can assist. See this CyberSecurity Awareness Month blog post about phishing for additional information.

Peer-to-Peer File Sharing and Copyright Compliance

File sharing software that copies and distributes songs, movies, videos, games, and software applications without the permission of the owner is a Copyright Law violation that can subject you to criminal and civil liability. Content owners use technological means to track the file sharing of their intellectual property on the Internet. SPU is required by law to inform you if we are aware, you have violated copyright law and must provide your information to copyright owners for legal action if you do not cease illegal activity.  You are responsible for the activities of your computer when connected to the campus network. See Copyright Basics and  DMCA Copyright Compliance / Peer-to-Peer File Sharing for more information about copyright compliance.

Update Your Emergency Contacts and SPU Alert Info

It is important to be made aware of campus emergencies in real-time, as information is available.

• SPU-Alert is the emergency alert system used to notify you of campus emergencies via text, email, and voice calls. We need your current contact information so that we can send you alerts during a campus emergency.
• Emergency Contact Information includes the contact details SPU should use in the event that an emergency situation happens to you.

The beginning of the school year is a great time to review and update your information. Log into the  Banner Information System , go to the  Personal Menu , update your information on the   Emergency Alert System  and  Emergency Contact Information pages.