Topics
Information security topics are discussed below.
Phishing
Email is one of the primary ways we communicate. We not only use it every day for school and work, but to stay in touch with our friends and family. In addition, email is now how most companies provide online services, such as confirmation of your online purchase or availability of your bank statements. Since so many people around the world depend on email, it has become one of the primary attack methods used by cyber criminals. Please familiarize yourself with phishing explanation, a common email attack method, and the steps you can take to use email safely.
Phishing is a cunning attempt by hackers to solicit, steal and mishandle users’ personal information (e.g. username and password, credit/debit card information, home address, social security number, date of birth, etc.) for criminal activities. Typically, phishing is achieved through emails disguised as legitimate messages from people you’re familiar with, reputable banks/financial institutions and well-established companies with official-looking logos. Links are included in these bogus types of emails that direct users to a webpage to enter personal data. After users willingly supply the requested data, hackers gain access to their accounts and then engage in malicious and criminal activities.
IT Staff and legitimate organizations will never ask users to supply a password or any other personal information via an email message. Whenever you’re in doubt about the legitimacy of an email message, contact IT Services for assistance at ITServices@gc.cuny.edu.
General Guidance
Read the CUNY Phishing Advisory as well as related resources posted on the CUNY CIS website at security.cuny.edu. In addition, we suggest you complete the 30-minute information security awareness program also located at security.cuny.edu on the home page. Click on the padlock.
Adhere to the following security practices when using the Internet:
- Never reply to any email that asks you for your personal information regardless of how official it appears. CUNY will not and should not be asking for personal information via email. If you disclosed your user ID and password then you must change your password immediately on any and all systems where the password issued.
- Avoid clicking on any web links from within an email. These embedded links may direct your Internet browser session to illegitimate web sites asking for personal information and could also download malicious code, such as viruses or spy ware, onto your machine. Instead, start a new Internet browser session and enter the legitimate web site address into the address bar of the browser.
- The content of many phishing e-mails can be very threatening (e.g., account closure, account verification, account updates, account is limited) and can be convincing to entice the user to follow through with the provided instructions. By far, most institutions will use non-Internet methods, such as the U.S. Postal Service, to send these types of notices and then will only send them to your official address of record. If in doubt about the legitimacy of these threatening e-mails, call the institution using the phone number on your last statement or on the back of your credit card.
- Similarly, financial institutions generally require some form of an initial setup to be completed prior to allowing electronic banking services. An online relationship is usually not established automatically or only through an exchange of e-mails. Become familiar with your financial institution's online registration process and how the electronic relationship may change from time to time. If in doubt, call the institution using the phone number on your last statement or on the back of your credit card.
- Update your computer's operating and Internet browser software on a regular basis. These updates routinely include security enhancements.
- Maintain anti-virus programs to the current level of protection.
- Select and maintain passwords that are difficult to guess and change them regularly.
Ransomware
Ransomware is malicious software (malware) that seeks to elicit a ransom payment from a victim. When ransomware infects a system it commonly encrypts all of the document files on the hard drive as well as accessible network folders. Documents so encrypted are unusable unless decrypted with a unique decryption key held by the attackers.
This video from the Federal Trade Commission explains how ransomware attacks happen and what you can do to help protect you.
- Be wary and skeptical of unsolicited email that demands immediate action even from well-known and reputable companies or government agencies, including well-designed but counterfeit invoices and failed courier delivery notices or claims of illegal activity.
- Don't click on links or attachments in email from unfamiliar sources or that seem suspicious—call the source to confirm authenticity.
- Maintain up-to-date security (anti-virus) software.
- Practice safe online behavior.
All important documents and files must be backed up on a regular, ongoing basis. Should ransomware render documents unusable in an unfortunate circumstance, the documents can then be recovered from a pre-infection backup copy. If your system is supported by a CUNY campus/central IT department, you should ascertain to what extent your system’s documents are backed up for you. If your system is self-supported, you need to perform backups yourself. It is additionally important to abide by the following backup practices:
- Backup media must be kept offline—a ransomware-encrypted backup copy on an always-connected portable drive is useless.
- The backup process must be monitored to ensure backups complete successfully.
- Periodically verify that files can be successfully restored from the backup.
- Keep multiple backup sets.
Ransomware infections typically occur by opening malicious attachments and links in spam/phishing emails and by browsing to a website that’s been compromised to infect visitors. Systems infected with other forms of malware can also be commanded by attackers to retrieve and install ransomware.
Yes. Ransomware is becoming contagious. A recent ransomware version additionally attempts to infect other computers and transform affected document files into infectious ransomware programs. An uninfected system can become infected when such a document is opened. In this way, ransomware infections can spread across systems that access a common shared folder, for example.
Anti-virus software detects and prevents infection from known ransomware variants, but there can be a period between the release of a new ransomware variant and effective anti-virus protection. Running up-to-date anti-virus software (as required by CUNY policy) is important but protection is not absolute. Security software that includes an intrusion prevention feature can also help to prevent ransomware from spreading between systems.
Document recovery has been achieved in limited circumstances with earlier ransomware versions. Unfortunately, more recent ransomware can’t be circumvented as “flaws” in the underlying encryption techniques have been eliminated.
Turn off your computer and contact itservices@gc.cuny.edu immediately for assistance.
Identity Theft
Identity theft is the crime that happens when a cyber-criminal gains access to your personal information to use it for financial gain using your name, address, phone numbers, Social Security Number (SSN), savings and checking account numbers, income. Your personal information can be later used to open a new line of credit, access a bank account, open a mobile phone or utility account. Identity thieves commit crimes impersonating you and have been knowing to apply for jobs, healthcare insurance, and collect tax refunds. It is essential to recognize signs of identity theft and what to do when it happens to you. Educate yourself by having access to prevention and recovery programs available to you by CUNY.
Protect Your Computer
The Graduate Center managed computers provide a variety of security defenses which defend staff, faculty and students from numerous online threats. Many of us, however, work from home and use our own personal computer.
Check out this video on Computer Security Tips from the Federal Trade Commission for more information.
Below are a few tips and video to increase the security of your home computer.
- Configure a strong password and change is it promptly.
- Turn on updates for software and applications.
- Install Antivirus software, make sure to run updates and scan computer regularly.
- Lock your display screen to protect your information privacy and identity.
- Watch where you click.
Anti-Virus Software
It is important to have a good working anti-virus program on your computer, whether it is running Windows or Mac. An anti-virus will provide valuable protection for your computer by detecting and removing malware. It can also block malicious webpages to help prevent malware from being downloaded.
- McAfee and Maple are now available via the Technology Services pages or through the new Software Download page. Both methods require authentication using CUNY Login (CUNYfirst) credentials.
- Faculty, staff and students no longer have access to the Microsoft product suite on the eMall. They can access the Microsoft Office 365 for Education Suite via the Technology Services pages, again authenticating with their CUNY Login credentials. Please note that the Office 365 for Education Suite does not include Windows 10.
