RIT Information Security Alert: Your Password Will Expire Soon Phishing Attacks

RIT Information Security Alert: Your Password Will Expire Soon Phishing Attacks

If you've received a message with the Subject Line: Your password will expire soon or a similar email, please delete it. The message itself reads: Click here to proceed with your Email update.  

How do you know this is a phishing attempt?

  • ITS does not send out emails with links to update your password.
  • You'll note that the link included in the email does not link to an RIT address; it's on "altervista". (We've removed the link from this example.)
  • The phish uses a common technique of trying to impart a sense of urgency and trying to get you to supply the requested information quickly. 
  • For more information about Phishing, please visit the RIT Information Security Phishing page.

What RIT is doing

RIT is working to block the phishing/malware attacks from reaching RIT e-mail accounts.

  • myMail.rit.edu has not been compromised.
  • McAfee VirusScan (McAfee HIPS) with up-to-date virus definitions will protect against viruses and many other threats that may be associated with phishing emails. (Antivirus software is available free to RIT students, faculty, and staff for home use from http://www.rit.edu/its/services/security/).
  • MySpam will block many of these phishing e-mails. However, senders actively modify messages to avoid spam traps like Brightmail, and that allows a few to slip through.

What you can do

  • Delete the e-mail. If you clicked on the link, change your password NOW, scan your systems for viruses and spyware and report the situation to your Help Desk (SCOB, NTID, ITS).
  • Visit the RIT Information Security Phishing page at http://www.rit.edu/security/content/phishing for information on keeping yourself safe from phishing attempts.

REMEMBER: RIT will NEVER ask for your password through e-mail.

 

October is Cyber Security Awareness Month!  

Multi-Factor Authentication

Enabling multi-factor authentication is one of the best things you can do to make sure your account information is not compromised.  Passwords alone will not always protect you, but using two or more steps to verify you are the account holder will help keep your accounts secure.

Common actions that lead to your password being stolen are:

Protective Mobile Device Software

One in every five people in the world own a smartphone according to a 2013 report in Business Insider and with the significant growth of smartphone usage, the issues surrounding mobile security have also grown. 

Using LinkedIn’s New Two-Factor Authentication

The growing trend in sites adding two-factor authentication to their log in process has many feeling more secure in their social media and other online interactions.

With passwords being easy to compromise with phishing attacks, many users have been hoping for something more secure.  Two-factor authentication gives a double protection on your account, requiring you to know something (your password), and have something in your possession (a token).  The token can be any number of devices, cards or other physical items, often generating unique codes as proof you have the object.  Think of ATMs.  You need to have the ATM card (the token) and know your PIN in order to access your account and do any transactions at the ATM.  One without the other and you can’t get in.

LinkedIn is using a single-use code sent via SMS to whatever mobile number is listed on the account.  Your mobile device serves as your token.  This code is entered into the site after you enter your password to complete the two-factor authentication.  The idea behind this is if your password happens to be cracked or phished, as long as you don’t lose or compromise your phone, you are still safe from attackers logging into your account (though you should change your passwords and do a virus scan to be safe if your password gets compromised!).  

Want to enable this security feature for your own LinkedIn account? LinkedIn provides some instructions here:  http://www.slideshare.net/linkedin/two-step-verification-on-linked-in.  

Many other sites have similar security features so check out your account settings and give yourself an extra layer of protection.

SECURITY NOTES:

As with any security chain, there are ways this could possibly be compromised.  The easy way is if an attacker knows your password and stole your phone.  A more sophisticated way is if you get phished for both your password and the code just sent to you, and the attacker users both before the code expires.  How likely could these happen?  Well that’s up to your security prowess.  Read more on our website about creating secure passwords (https://www.rit.edu/security/content/password), avoiding phishing attempts (https://www.rit.edu/security/content/phishing) and best practices when it comes to mobile device security (https://www.rit.edu/security/content/mobile-devices). 

Data Privacy Month--Private Information Disposal

This article was also published in the Quaestor newsletter of RIT's Institute Audit, Compliance, and Advisement.

Did you know that January is Data Privacy Month? 

For the last two years, we’ve focused on remediation and disposal of Private Information resident on RIT computers and we’ve made great progress. Have you thought about disposing of Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) that’s not on your computer? We encourage you to review paper filed, disks, CD/DVDs, video tapes, and any other type of storage media containing Private Information and dispose of those containing unnecessary Private Information appropriately.  Don’t forget that retention of RIT information is also governed by the Records Management Policy (C22.0).

Paper files containing Private Information pose a risk both to RIT and to the individuals whose information if in the materials. For example, on April 14th, 2011, Central Ohio Technical College found that course information had been left in a filing cabinet at an off campus storage facility, compromising the Social Security Numbers of over 600 registered students. RIT used a similar system with Social Security numbers until June 2006, when University IDs became the main means of registration and identification on campus. DataLoss DB (http://datalossdb.org/statistics) indicates that almost 25% of breaches have been due to the inadvertent loss of private information, in both paper and digital formats. Disposing of unnecessary Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) will help ensure RIT complies with Private information laws, policies, and procedures. 

 New York State defines private information (PI) as:

any personal information concerning a natural person combined with one or more of the following data elements: Social Security number (SSN), driver's license number, account number, or credit or debit card number in combination with any required security code. These combinations of information are often used in identity theft.

The New York State Information Security Breach and Notification Act requires that RIT notify affected consumers if their Private information is compromised.

If you’re not sure of whether or not to dispose of Private Information on your computer,  check with your manager or consult the Private Information Decision Tree here https://www.rit.edu/security/content/private-information-decision-tree

For more information about the Private Information Management Initiative, check out our PIMI FAQ page https://www.rit.edu/security/content/private-information-management-initiative-pimi-faq and our Document Destruction page https://www.rit.edu/security/content/document-destruction

Data Privacy Month: Are You Smarter Than Your Phone?

Data Privacy Month: Are You Smarter Than Your Phone?

 

Did you know, “Smartphones can predict a user's gender with 71% accuracy, & can distinguish between ‘tall’ and ‘short’ people and ‘heavy’ and ‘light’ people, with about 80% accuracy?” Take a look at this recorded webinar from the January 9 EDUCAUSE Live! Data Privacy Month kickoff event with special guest, Rebecca Herold (the Privacy Professor) to find out just exactly how smart your Smartphone is.

Nearly everyone on a college campus today has a mobile phone, capable of accomplishing amazing tasks while on the go. But, how SHOULD you make use of your smartphone? You are smarter than your phone if you know that you need to make careful choices about using your geo-location feature. You might post a picture to Facebook while on your European trip if there are other people still living at your address back home. But, if your house is empty while you travel, you would be smarter to wait to post until you get home. Do you really want everyone to know you are out alone at midnight by "checking in" at your local donut shop? You are smarter than your phone if you use sound judgment about revealing your location. You’re smarter than your phone if you know you need to think critically about the sensitivity of the data you put on or access through your phone. Do you use your phone for banking, without password protecting the device? Your phone is happy to do it. But you are smarter than your phone if you protect it with a password. If you’re not thinking critically about what you do with your phone, we’ll help you think again!

The webinar covers fun facts as well as 16 ways to mitigate Smartphone security and privacy risks. Topics include tracking, info access, malware, breaches, loss, theft, ID theft, physical security, social media, and apps.

Webinar recording, slides, and chat transcript are available here http://www.educause.edu/library/resources/data-privacy-month-are-you-smarter-your-phone