October is Cybersecurity Awareness Month, a global effort to help everyone stay safe and protected when using technology whenever and however you connect. The theme for the month is, ‘Do Your Part. #BeCyberSmart.’ and Chapman University is proud to be a champion and support this online safety and education initiative this October.
The cybersecurity and digital privacy of our employees and customers is important to Chapman University. Throughout the month of October, Chapman will be sending out weekly emails from our Use Awareness and Training platform, KnowBe4. This year, the Cybersecurity Awareness Month’s will highlight the following topics:
Week 1 (October 1-9) – Be Cyber Smart
Week 2 (October 10-16) – Fight the Phish
Week 3 (October 17-23) – Cyber Security Careers: Explore, Experience, Share
Week 4 (October 24-31) – Cybersecurity First
We want to help you, your family, friends, and our community stay safe all year long, too. We encourage you to visit the National Cybersecurity Alliance1 website to learn more about this initiative. It includes additional information and how you can promote simple online safety habits and steps you can take to #BeCyberSmart.
Cybersecurity Awareness Month is co-led by the National Cyber Security Alliance and the Cybersecurity and Infrastructure Agency (CISA) of the U.S. Department of Homeland Security. For more information about ways to keep you and your family safe online visit National Cybersecurity Alliance2 and Cybersecurity & Infrastructure Security Agency3 webpages for additional details.
*Please note these emails will show with an external email banner but are legitimate communications.
Cyber Security Awareness Month
OCTOBER 1 – 9 (WEEK 1)
BE CYBER SMART
As our lives have become increasingly dependent on technology, virtually all personal and business data is kept on internet-connected platforms, which can become a gold mine for bad actors. The first full week of Cybersecurity Awareness Month will highlight best security practices and focus on general cyber hygiene to keep your information safe. Own your role in cybersecurity by starting with the basics. Creating strong passwords and using multifactor authentication, backing up your data, and updating your software are great places to start. This is a great way to Do Your Part #BeCyberSmart!
| FACTS AND FIGURES
- 61% of data breaches used compromised credentials. (Verizon Data Breach Investigations Report)
- 56% of IT leaders believe their employees have picked up bad cybersecurity behaviors since working from home. (Tessian)
- More than 99.9% of Microsoft enterprise accounts that get invaded by attackers didn’t use multi-factor authentication. (ZDNet)
| TIPS ON HOW TO BE CYBER SMART
Multi-factor authentication (MFA) adds that necessary second check to verify your identity when logging in to one of your accounts. By requiring multiple methods of authentication, your account is further protected from being compromised, even if a bad actor hijacks your password. In this way, MFAs make it more difficult for password cracking tools to enable attackers to break into accounts.
Use Strong Passphrases/Password Manager
This may seem obvious, but all too often securing strong passphrases/password managers is overlooked. People spending more time online during the pandemic has certainly contributed to more bad actors prowling for accounts to attack. Using long, complex, and unique passwords is a good way to stop your account from being hacked, and an easy way of keeping track and remembering your passwords is by using a password manager.
Perform Software Updates
When a device prompts that it’s time to update the software, it may be tempting to simply click postpone, and ignore the message. However, having the latest security software, web browser, and operating system on devices is one of the best defenses against online threats. So, don’t wait – update.
Do Your Research
Common sense is a crucial part of maintaining good online hygiene, and an intuitive step to stay safe online is to do some research before downloading anything new you are downloading to your device, such as apps. Before downloading any new learning app on your device, make sure that it’s a by checking who created the app, what the user reviews say, and if there are any articles published online about the app’s privacy and security features.
Check Your Settings
Be diligent to double check your privacy and security settings, and be aware who can access your documents. This extends from Google docs, to Zoom calls, and beyond. For meetings on Zoom, for example, create passwords so only those invited to the session can attend, and restrict who can share their screen or files with the rest of the attendees.
Cyber Security Awareness Month
OCTOBER 10 – 16 (WEEK 2)
Fight The Phish!
Phishing attacks and scams have thrived since the COVID pandemic began in 2020. Today, phishing attacks account for more than 80 percent of reported security incidents. Week 2 of Cybersecurity Awareness Month stresses the importance of being wary of emails, text messages or chat boxes that come from a stranger or someone you were not expecting. Think before you click on any suspicious emails, links or attachments and make sure to report any suspicious emails you can to firstname.lastname@example.org!
| FACTS AND FIGURES
- Malware increased by 385% in 2020. (Help Net Security)
- According to the FBI, phishing was the most common type of cybercrime in 2020, with the bureau receiving 241,342 complaints in 2020. (FBI)
- Phishing attacks account for more than 80 percent of reported security incidents. (Verizon Data Breach Investigations Report)
| TIPS ON HOW TO SPOT THE PHISHERMEN
Know the Red Flags
Phishes are masters of making their content and interactions appealing. From content design to language, it can be difficult to discern whether content is genuine or a potential threat, which is why it is so important to know the red flags. Awkward and unusual formatting, overly explicit call outs to click a hyperlink or open an attachment, and subject lines that create a sense of urgency are all hallmarks that the content you received could be potentially from phish and indicate that it should be handled with caution. Avoid unknown documents asking to enable macros and emails containing strange attachments.
Verify the Source
Phishing content comes in a variety of ways, however, many phishes will try to impersonate someone you may already know — such as a colleague, service provider or friend, or supervisor — as a way to trick you into believing their malicious content is actually trustworthy. Don’t fall for it. If you sense any red flags that something may be out of place or unusual, reach out directly to the individual to confirm whether the content is authentic and safe via other methods like phone or Microsoft Teams. If not, break-off communication immediately and flag the incident through the proper channels.
Be Aware of Vishing and Other Phishing Offshoots
As more digital natives have come online and greater awareness has been spread about phishing, bad actors have begun to diversify their phishing efforts beyond traditional email. For example, voice phishing — or vishing — has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization — such as a healthcare provider, FBI, Social Security Administration, or insurer — and asking for sensitive information. Simply put, it is imperative that individuals be wary of any sort of communication that asks for personal information whether it be via email, phone, or chat — especially if the communication is unexpected. If anything seems suspicious, again, break-off the interaction immediately and contact the company directly to confirm the veracity of the communications.
What to do With Questionable Emails
- Avoid following direct links in suspicious emails and be cautious when entering in user credentials. If possible, visit the site directly and verify phone/contact information directly from legitimate websites.
- Widespread phishing and scam emails are updated frequently at www.chapman.edu/security. Please check there to view currently trending malicious emails.
- Chapman provides examples of type of scam & phishing attacks at www.chapman.edu/scams.
- Infosec is always available to review questionable emails. Please report any emails to email@example.com with a request to review the email.