October is Cybersecurity Awareness Month - CSA

It is CIS's responsibility to share some vital information about how to be safe while using the internet and managing yours and students' information.

Over the next few weeks, CIS will be releasing a weekly blog post that expands on four core topics for this year's CSA month: Phishing, Social Engineering (whaling), Passphrases for passwords, and Ransomware.

At the end of the month, there will be a quiz released to employees and students. Receiving 100% on the quiz will automatically enter the user into a raffle. The raffle will have two winners, one student and one employee, who will each receive a prize* from CIS!

Keep an eye out for the first blog post on October 9, and then every following Monday until the end of the month!

*Please note that prizes will be ordered once they are selected by the prize-winners. CIS will contact prize-winners when the prizes are ready to be picked up from the HelpDesk.

Security Awareness Week 1: Phishing emails

What is Phishing?

Often carried out over email -- although the scam has now spread beyond suspicious emails to phone calls (so-called "vishing"), social media, SMS messaging services (aka "smishing"), and apps -- a basic Phishing attack attempts to trick the target into doing what the scammer wants. 

Exactly what the scammer wants can vary wildly between attacks. It might be handing over passwords to make it easier to hack a company or person, or sending payments to fraudsters instead of the correct account. This information is often stolen by making requests that look entirely legitimate -- like an email from your boss, so you don't think twice about doing what is asked.

How would you identify a Phishing email?

Emails that contain the following should be approached with extreme caution, as these are common traits of phishing email:

• Urgent action demands.
• Multiple sources in the from email address line.
• Poor grammar and spelling errors.
• An unfamiliar greeting or salutation.
• Requests for login credentials, payment information, or sensitive data.
• Offers that are too good to be true.

Phishing is also a popular method for cyber attackers to deliver malware by encouraging victims to download a weaponized document or visit a malicious link that will secretly install the malicious payload on the person's computer. These kind of attacks mostly are trying to distribute a  trojan malware, ransomware . These cyber hackers are hoping you don't look to deep into the email, that you just gloss over the details and click on the link, or download the attachment. Below is a screenshot of a phishing email, and you can see just how tricky they can be.

Why is Phishing called Phishing?

The overall term for these scams -- Phishing -- is a modified version of the word 'fishing' except in this instance the one doing this fishing is a scammer and they're trying to catch you and reel you in with their sneaky email lure. In most cases, they will send out many of these lures.

FUN FACT! - Why is Phishing spelled with a "Ph"?

The “ph” spelling of phishing is influenced by an earlier word for an illicit act: phreaking, which involves fraudulently using an electronic device to avoid paying for telephone calls. The people who perpetrated phreaking were called “Phreaks,” and since phreaks and hackers were closely linked, the “ph” spelling was used to denote the phishing scams involving these underground groups. Pretty cool!

We hope by sharing these resources with you, that you will have the tools and information necessary to make informed decisions when using the Internet.

Security Awareness Week 2: Ransomware

The CISA defines Ransomware as a "form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption."

Ransomware can be planted into a network using many methods, like Phishing and Social Engineering. Once it is planted, hackers locate and secure access to important files and move those files to a secure network of their own.

Oftentimes, a hacker needs only access into a network, and can gain such access in a myriad of ways. For example:

• By sending phishing emails requesting login information or containing malicious code(as we have seen in last week's post) 
• Looking for weaknesses within your network's security
• Users are redirected to a suspicious website that infects their computer by browsing or prompts for them to download files off the internet.

Password Managing

If you are worried about keeping track of your passwords, use a password manager that will keep track and record all of your passwords and where they are used. It is also likely that your phone or Google account will have password tracking enabled.

For more information on SPU's Password Policies, please select here.

Cybersecurity Awareness Month Quizzes

Thank you for joining us for this year's Cybersecurity Awareness month as we covered Phishing, Ransomware, Social Engineering (Spear Phishing), Passphrases, and Canary Files. 

If you have questions or concerns about the topics covered, or would like to learn more, a student technician with the HelpDesk would be more than happy to assist! You can contact the HelpDesk by phone at 206.281.2982 or by email at help@spu.edu.

As a reminder, we are offering one quiz for Faculty and Staff and one quiz for Students to test their knowledge on the topics we covered this month. The quiz will remain open until November 15th, 2023.

A Few Rules to Follow: 

• One quiz attempt per individual. 
• A student may not take the employee quiz and employees may not take the student quiz.
• Only scores of 100% will be automatically entered into the raffle. 
• Prizes will only be given out to the winning individual(s) after they have made their *selection.
• One prize per winner. 

*Raffle winners will be contacted by CIS and choose their prize from the available options. Options include bluetooth speakers and/or gift cards.