August 2022: Phishing Attacks are Getting Trickier

Content courtesy of author Phil Hoffman of the SANS™ Institute OUCH! Newsletter

Phishing emails used to be easier to detect because they were generic messages sent out to millions of random people. Cyber attackers had no idea who would fall victim; they just knew the more emails they sent, the more people they could trick.

Today's cyber attackers are far more sophisticated. They now research their intended victims to create a more customized attack. Instead of sending out a phishing email to five million people, or appearing to be generic emails sent by corporations, they may send it to just five people and tailor the attack to appear to be sent from someone we know. Cyber attackers do this by:

• researching our LinkedIn profiles, what we post on social media, or by using information that is publicly available or found on the Dark Web.
  
  
• crafting messages that appear to come from management, coworkers, or vendors you know and work with.
  
  
• learning what your hobbies are and sending a message to you pretending to be someone who shares a mutual interest.
  
  
• determining you have been to a recent conference or just returned from a trip and then crafting an email referencing your travels. Cyber attackers are actively using other methods to send the same messages, such as texting you or even calling you directly by phone.

Because cyber attackers are taking their time and researching their intended victims, it can be more difficult to spot these attacks. The good news is you can still spot them if you know what you are looking for. Ask yourself the following questions before taking action on a suspicious message:

• Does the message create a heightened sense of urgency? Are you being pressured to bypass your organization’s security policies? Are you being rushed into making a mistake? The greater the pressure or sense of urgency, the more likely this is an attack.
  
  
• Does the email or message make sense? Would the CEO of your company urgently text you asking for help? Does your supervisor really need you to rush out and buy gift cards? Why would your bank or credit card company be asking for personal information they should already have about you? If the message seems odd or out of place, it may be an attack.
  
  
• Are you receiving a work-related email from a trusted coworker or perhaps your supervisor, but the email is using a personal email address such as @gmail.com?
  
  
• Did you receive an email or message from someone you know, but the wording, tone of voice or signature in the message is wrong and unusual?

If a message seems odd or suspicious, it may be an attack. If you want to confirm if an email or message is legitimate, one option is to call the individual or organization sending you the message with a trusted phone number.

June 2022: Ukraine Crisis Solicitation Scams

Beware of fraudulent schemes seeking donations or other financial assistance related to the crisis in Ukraine.

According to the FBI, Criminal actors are taking advantage of the crisis in Ukraine by posing as Ukrainian entities needing humanitarian aid or developing fundraising efforts, including monetary and cryptocurrency donations.

Scammers similarly have used past crises as opportunities to target members of the public with fraudulent donation schemes.

Tips on how to protect yourself:

• Be suspicious of online communications claiming to be individuals affected by the conflict in Ukraine and seeking immediate financial assistance.
  
  
• Although the Ukrainian government and other private organizations do maintain official donation mechanisms, be cautious and verify information about entities purporting to solicit aid for causes linked to the crisis in Ukraine. If an entity asks for donations to specific cryptocurrency addresses, be cautious, always carefully check if the addresses are legitimate, and compare the address alphanumeric characters to any known official addresses.
  
  
• Do not communicate with or open texts, emails, attachments, or links from unknown individuals posing as Ukrainian entities in need of humanitarian aid.
  
  
• Do not send payments to unknown individuals or organizations asking for financial assistance.
  
  
• Best practices to verify charities include, but are not limited to: researching the charity online to see if there are news, reviews, or posts linking the charity to fraud; checking to see if the charity is registered with your state's charity regulator, if available; and checking the Internal Revenue Service's website to see if the charity is registered.

Visit the Federal Bureau of Investigation public service announcement for more information on this issue.

February 2022: IRS Tax Season Scams

The Internal Revenue Service warns that the beginning of the new year is an opportune time for scammers to use e-mail, text messages and/or phone calls to defraud unsuspecting victims.

"With filing season underway, this is a prime period for identity thieves to hit people with realistic-looking emails and texts about their tax returns and refunds," said IRS Commissioner Chuck Rettig. "Watching out for these common scams can keep people from becoming victims of identity theft and protect their sensitive personal information that can be used to file tax returns and steal refunds."

Text Message Scams

Last year, there was an uptick in text messages that impersonated the IRS. These scams are sent to taxpayers' smartphones and have referenced COVID-19 and/or "stimulus payments." These messages often contain bogus links claiming to be IRS websites or other online tools. Other than IRS secure access, the IRS does not use text messages to discuss personal tax issues, such as those involving bills or refunds. The IRS also will not send taxpayers messages via social media platforms.

Unemployment Fraud

As a new tax season begins, the IRS reminds workers to watch out for claims of unemployment or other benefit payments for which they never applied. States have experienced a surge in fraudulent unemployment claims filed by organized crime rings using stolen identities. Criminals are using these stolen identities to fraudulently collect benefits. You may have been the victim of identity theft if you have received mail or an IRS Form 1099-G regarding benefits you were not expecting.

Email Phishing Scams

The IRS does not initiate contact with taxpayers by email to request personal or financial information. The IRS initiates most contacts through regular mail delivered by the United States Postal Service.

Phone Scams

The IRS does not leave pre-recorded, urgent or threatening messages. In many variations of the phone scam, victims are told if they do not call back, a warrant will be issued for their arrest. Other verbal threats include law-enforcement agency intervention, deportation or revocation of licenses.

For more information on common IRS-related scams, and how to protect yourself, see https://www.irs.gov/newsroom/irs-warning-scammers-work-year-round-stay-vigilant

October 2021: Business Email Compromise Scam

October has been designated as Cybersecurity Awareness Month. Now in its eighteenth year, Cybersecurity Awareness Month is a government and private sector partnership that raises awareness about cybersecurity and stresses the collective effort required to stop cybercrimes, online thefts and scams.

One of these scams has been dubbed the business email compromise (BEC) scam. This scam has been attempted several times at Citrus College. In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate request, like in these examples:

• A vendor your company regularly deals with sends an invoice with an updated mailing address.
  
  
• A company CEO asks her assistant to purchase dozens of gift cards to send out as employee rewards. She asks for the serial numbers so she can email them out right away.
  
  
• A homebuyer receives a message from his title company with instructions on how to wire his down payment.
  
  
• Versions of these scenarios happened to real victims. All the messages were fake. In each case, thousands or even hundreds of thousands of dollars were sent to criminals instead.

How to Protect Yourself

• Be careful with what information you share online or on social media. By openly sharing things like pet names, schools you attended, links to family members, and your birthday, you can give a scammer all the information they need to guess your password or answer your security questions.
  
  
• Don't click on anything in an unsolicited email or text message asking you to update or verify account information. Look up the company's phone number on your own (don't use the one a potential scammer is providing), and call the company to ask if the request is legitimate.
  
  
• Carefully examine the email address, URL, and spelling used in any correspondence. Scammers use slight differences to trick your eye and gain your trust.
  
  
• Be careful what you download. Never open an email attachment from someone you don't know, and be wary of email attachments forwarded to you.
  
  
• Set up two-factor (or multi-factor) authentication on any account that allows it, and never disable it.
  
  
• Verify payment and purchase requests in person if possible or by calling the person to make sure it is legitimate. You should verify any change in account number or payment procedures with the person making the request.
  
  
• Be especially wary if the requestor is pressing you to act quickly.

For more information, view the FBI.gov Business Email Compromise website.

April 2021: How to Recognize and Avoid Phishing Scams

(Content courtesy of https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)

Scammers use email or text messages to trick you into giving them your personal information. They may try to steal your passwords, account numbers, or Social Security numbers. If they get that information, they could gain access to your email, bank, or other accounts. Scammers launch thousands of phishing attacks like these every day — and they are often successful. The FBI's Internet Crime Complaint Center reported that people lost $57 million to phishing schemes in one year.

Scammers often update their tactics, but there are some signs that will help you recognize a phishing email or text message.

Phishing emails and text messages may look like they are from a company you know or trust. They may look like they are from a bank, a credit card company, a social networking site, an online payment website or app, or an online store.

Phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment. They may

• say they've noticed some suspicious activity or log-in attempts.
• claim there's a problem with your account or your payment information.
• say you must confirm some personal information.
• include a fake invoice.
• want you to click on a link to make a payment.
• say you're eligible to register for a government refund.
• offer a coupon for free stuff.

Here's a real-world example of a phishing email.

While, at a glance, this email might look real, it's not. The scammers who send emails like this one do not have anything to do with the companies they pretend to be. Phishing emails can have real consequences for people who give scammers their information.

Learn more about how to protect yourself from e-mail phishing scams at https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams

January 2021: Pandemic-Related Security Scams

Unfortunately, unethical criminals on the Internet are using the COVID-19 pandemic to trick people into giving up personal details, bank account and credit card information. The Federal Trade Commission (FTC) has helpful consumer advice at https://www.ftc.gov/coronavirus/scams-consumer-advice listing methods scammers use to take advantage of virus fears for financial gain.

• Learn how to tell the difference between a real contact tracer and a scammer. Legitimate tracers need health information, not money or personal financial information.
  
  
• Don't respond to texts, emails or calls about checks from the government.
  
  
• Ignore offers for vaccinations and miracle treatments or cures. Scammers are selling products to treat or prevent COVID-19 without proof that they work.
  
  
• Be wary of ads for test kits. Many test kits being advertised have not been approved by the FDA, and aren't necessarily accurate. Almost all authorized home tests don’t provide rapid results and require you to send a test sample to a lab for analysis.
  
  
• Hang up on robocalls. Scammers are using illegal robocalls to pitch everything from low-priced health insurance to work-at-home schemes.
  
  
• Watch for emails claiming to be from the CDC or WHO. Use sites like www.coronavirus.gov and usa.gov/coronavirus to get the latest information. And don't click on links from sources you don't know.
  
  
• Do your homework when it comes to donations. Never donate in cash, by gift card, or by wiring money.

The rollout of the COVID-19 vaccines has presented yet another opportunity for fraud. While vaccination details are getting worked out, here's what you can be sure of:

• You can't pay to put your name on a list to get the vaccine.
  
  
• You can't pay to get early access to the vaccine.
  
  
• Nobody legit will call about the vaccine and ask for your social security, bank account of credit card number.

You can download an infographic with this information and advice on other coronavirus scams at https://www.ftc.gov/coronavirus/scams-consumer-advice

October 2020: Cybersecurity Overview and Basics

There has been a dramatic increase in the number of cybersecurity incidents reported since the start of the pandemic. On June 6, the University of California, San Francisco (UCSF) paid a ransom of $1.14 million to hackers to recover data from its School of Medicine that had been encrypted in a cyberattack. Similar attacks were carried out against Michigan State University and Columbia College, Chicago. In August, the University of Utah reported a payment of $457,000 to cybercriminals who held employee and student data for ransom.

Cybercriminals often take advantage of poor security practices by employees in order to conduct their activities. Keenan and Associates has provided Citrus College with a series of online training courses that can improve your security awareness. Help keep the IT resources and sensitive data at the college safe by taking one (or all) of the following courses, available on the training calendar:

Cybersecurity Overview: This introductory course provides an overview of cybercrime and cybersecurity, including the basics of cybersecurity along with the effects of cybercrime, the types of cyber threats and how users are susceptible.

Browser Security Basics: This course provides all staff members with an overview of browser security and ways to browse the web safely. Topics include: the types of browser threats, the basics of browser security and safe browsing practices.

Password Security Basics: This course provides an overview of password security and management, including the basic principles of password security, the elements of a strong password, and strategies of how to create and maintain passwords.

Email and Messaging Safety: This course provides an overview of cybercrime via email, and how to employ safe email and messaging practices to avoid and help prevent cyber threats, attempts at fraud and identity theft.

Protection Against Malware: This course provides staff members with an overview of basic protection against malware. Topics include: the types of malware, how malware works and protective strategies.

Copyright Infringement: This course covers basic knowledge about copyright laws, print and audio materials, visual and multimedia materials, and the internet and digital media.

Click this link to launch a curriculum containing all six of these courses.

July 2020: Social Engineering Scams

Cybercriminals have learned that a successful way to take advantage of a victim is through social engineering. We've seen this recently at Citrus College. Social engineering begins with research, whereby an attacker reaches out to a target to gain information and resources.

When someone you don't know contacts you and asks you open-ended questions, this may be the first step of a social-engineering attack. After the attacker reaches out to you, they will then attempt to establish trust with you and get you to provide them with the information or access that they need. Often, the attacker does this by creating a sense of urgency.

One common social-engineering scam is the gift-card scam. The attacker poses as a supervisor or manager (the impersonator). The impersonator will email the victim and begin a brief email exchange. The impersonator will tell the victim that they need to purchase one or more gift cards for other employees but that they are unavailable to do so, and will ask the victim to buy several gift cards and keep one for themselves. As the victim is worried about pleasing the impersonator, the victim goes through with the purchase, spending hundreds or thousands of dollars.

How do you avoid becoming a victim of these types of attacks? Ask yourself if the request makes sense. Check the email address of the sender. Does the sender's email address come from Citrus College? Is there a warning that the e-mail came from outside of the Citrus College e-mail system?

Whenever you receive an "urgent" email communication, the first thing you should do is contact the sender using another mode, such as phone or text message, and confirm that the email is legitimate. If something seems off to you, it probably is.

January 2020: Data Privacy

The Internet is full of data about you. Whenever you play a game, shop, browse websites, or use any of numerous apps, your activity and some of your personal information may be collected and shared.

Similarly, the business of higher education requires us to collect, process, and store the digital information of others. Whenever we handle such information, we need to think about how we want our own information treated and treat other people's data with the same care and respect.

Protect yourself by following these tips:

• Know what you are sharing.
  Check the privacy settings on all of your social media accounts; some even include a wizard to walk you through the settings. Always be cautious about what you post publicly.
  
  
• Guard your date of birth and telephone number.
  These are key pieces of information used for identity and account verification, and you should not share them publicly. If an online service or site asks you to share this critical information, consider whether it is important enough to warrant it.
  
  
• Keep your work and personal presences separate.
  Administrative Procedure (AP) 3723 recognizes that authorized Citrus College officials may review or access the contents of e-mail for purposes related to the college business. Use an outside service for private emails. This also helps you ensure uninterrupted access to your private email and other services if you switch employers.

Protect the information, identity, and privacy of others by following these tips:

• Know what resources are available at Citrus College.
  Citrus College IT Security Analyst Ryan Tang can answer questions about information security best practices and the technologies available to protect online identity and the personal data. The training calendar also provides online self-guided tutorials on information security and privacy.
  
  
• Know what policies are in place at your institution.
  A privacy policy governs how the institution collects, processes, stores, and deletes the personal data of constituents; a data classification policy governs how the institution organizes the data it interacts with and what rules are in place for processing it; and an information security policy articulates how the institution governs and prioritizes information security activities.
  At Citrus College, these policies can be found online in the 3000 series of board policies and administrative procedures.
  
  
• Keep student and staff personal information confidential and limit access to the data.
  
  
• Only use data for its intended purpose.
  If you need to use data for another reason, always check relevant resources and policies first for guidance.
  
  
• Destroy or de-identify private information when you no longer need it.

November 2019: Data Breaches

In 2017, nearly eight million records in the education industry were breached in 35 events. More than half of the breaches in the education sector were caused by activities directly attributable to human error, including lost devices, physical loss, and unintended disclosure. These breaches were arguably preventable through basic information security protection safeguards.

All Citrus College staff and faculty have a responsibility to know basic information security protections to safeguard data and prevent those data from being mishandled.

Here are some things you can do every day to protect our student data.

• Update your computing devices: Ensure updates to your operating system, web browser, and applications are being performed on all personal and institution-issued devices. If prompted to update your device, don't hesitate - do it immediately.
• Enable two-factor authentication: Whether for personal use or work, two-factor authentication can prevent unauthorized access even if your login credentials are stolen or lost.
• Create really strong and unique passwords: Create unique passwords for all personal and work accounts. In today's environment, one of the best ways to create a really strong password is to use a password manager for all of your accounts. A password manager will alleviate the burden of having to memorize all the different complex passwords you've created by managing them all in one "vault" and locking that vault with a single master password.
• Protect your devices: Using biometrics or six-digit passcodes on smartphones and tablets is critical to keeping curious minds from accessing personal information, work email, or retail/banking applications. It also helps protect your device if it is lost or misplaced.
• Understand where, how, and to whom you are sending data: Many breaches occur when we accidently post sensitive information publicly, mishandle or send to the wrong party via publishing online, or send sensitive information in an email to the wrong person. Take care to know how you are transmitting or posting data.

Content for Security Matters is courtesy of the EDUCAUSE Cybersecurity Program.

September 2019: Understanding the Basics of Online Safety and Security

Shopping, surfing, banking, gaming, and connecting Internet of Things devices such as toasters and refrigerators are some of the many actions performed each minute in cyberspace. These common everyday activities carry the cyber threats of social engineering to gain unauthorized access to data, identity theft, bullying, location tracking, and phishing, to name just a few. How can we decrease our risk from these cyber threats without abandoning our online activities altogether? Here are some basic online tips everyone can follow to help stay secure while online.

• Set up alerts. Consider setting up alerts on your financial accounts. Many credit card companies and banks allow you to set up alerts on your accounts via their websites. These alerts range from sending you an email or text each time a transaction happens on your account to alerts when transactions meet or exceed a designated spending limit that you set. These alerts keep you in control of your accounts' activities. These types of alerts are useful because they make you aware of what's going on with your account quicker than waiting for monthly statements. When you receive an alert about a transaction that you did not authorize, you can reach out to the credit card company or bank immediately. Log into your credit card company and banking websites to set up alerts on your accounts.
• Keep devices and apps up to date. This familiar tip is useful even if you are just casually surfing the internet. Keeping your devices up to date (including apps and operating systems) ensures you have the latest security fixes.
• Don't use public Wi-Fi. In addition to an updated device, the network the device is connected to is also important. Did you have to enter a password to connect to a Wi-Fi network? If you did, that network is more secure than an open one that any device within range can connect to. Whenever possible, use a secure network, especially when banking or shopping online.
• Consider using a VPN. VPN stands for virtual private network, and its main purpose is to provide a tunnel for encrypted internet traffic. If you are connected to the internet without using a VPN, your traffic is passed through the internet service provider's servers. The location of your device is known, and if you must connect to a public Wi-Fi network, there is a risk of snooping by other devices on the same network. Connecting to a VPN redirects your internet traffic to a remote server, encrypting the traffic, reducing the snooping risk. There are many options for VPN software today for consumers and businesses. Do your research and decide which one makes sense for your online needs.
• Create unique passwords. Here's another familiar tip. Using the same password for many sites is not a best practice. Suppose that one of your accounts suffered a data breach and your password was exposed. If you reused this password on other accounts, it's likely that someone would be able to access those accounts as well (especially if your user name is an email address). Consider using a password manager to manage all your passwords. Not only do these tools manage all your passwords, they can also create strong passwords and can even autofill your username and password as you go to websites on different browsers.
• Be vigilant. Be aware, there are fake websites out there waiting to collect your valuable information. Make sure you are on a legitimate site by double-checking the URL website address to make sure it is spelled correctly. Also make sure you see a padlock and https:// in the URL.

Remember that you are in control of your online activities. Following these security tips will give you peace of mind while online.

Monthly content for Security Matters is courtesy of the EDUCAUSE Cybersecurity Program​.​

July 2019 : Keeping Tabs on Mobile Devices

With an increasing amount of sensitive data being stored on personal devices, the value and mobility of smartphones, tablets, and laptops make them appealing and easy targets. These simple tips will help you be prepared in case your mobile device is stolen or misplaced.

• Encrypt sensitive information. Add a layer of protection to your files by using the built-in encryption tools included on your computer's operating system.
• Secure those devices and backup data! Make sure that you can remotely lock or wipe each mobile device. That also means backing up data on each device in case you need to use the remote wipe function. Backups are advantageous on multiple levels. Not only will you be able to restore the information, but you'll be able to identify and report exactly what information is at risk.
• Never leave your devices unattended in a public place or office. If you must leave your device in your car, place it in the truck, out of sight, before you get to your destination, and be aware that the summer heat of a parked car could damage your device.
• Password-protect your devices. Give yourself more time to protect your data and remotely wipe your device if it is lost or stolen by enabling passwords, PINs, fingerprint scans, or other forms of authentication. Do not choose options that allow your computer to remember your passwords.
• Put that shredder to work! Make sure to shred documents with any personal, medical, financial, or other sensitive data before throwing them away.
• Be smart about recycling or disposing of old computers and mobile devices. Properly destroy your computer's hard drive. Use the factory reset option on your mobile devices and erase or remove SIM and SD cards.
• Verify app permissions. Don't forget to review an app's specifications and privacy permissions before installing it!
• Be cautious of public Wi-Fi hot spots. Avoid financial or other sensitive transactions while connected to public Wi-Fi hot spots.
• Keep software up to date. If the vendor releases updates for the software operating your device, install them as soon as possible. Installing them will prevent attackers from being able to take advantage of known problems or vulnerabilities.

What can you do if your laptop or mobile device is lost or stolen?
Report the loss or theft to the appropriate authorities. These parties may include representatives from law-enforcement agencies, as well as hotel or conference staff. If your device contained sensitive institutional or student information, immediately report the loss or theft to Technology and Computer Services so that we can respond quickly to the incident.

Monthly content for Security Matters is courtesy of the EDUCAUSE Cybersecurity Program​.​

​May 2019: Social Engineering

Social engineering - manipulating people into doing what they want - is the most common way for cybercriminals to steal information and money. According to an article on Wired.com, between November 2017 and February 2019, six hundred and sixty (660) education-related institutions were targeted with a scam in which employees were tricked into purchasing gift cards and sending the codes to someone they wrongly assumed was a trusted authority.

Social engineering is at the heart of all types of phishing attacks - those conducted via email, SMS, and phone calls. Technology makes these sorts of attacks easy and very low risk for the attacker. Make sure you're on the lookout for these variants on the traditional, mass emailed phishing attack:

• Spear phishing: This kind of attack involves often very well-crafted messages that come from what looks like a trusted "very important person" (VIP) source. These messages will ask recipients to rush and bypass normal processes. Targets are those who can conduct financial transactions on behalf of the organization (sometimes called "whaling").

• SMiShing: Literally, phishing attacks via short message service (SMS) or text messaging. These scams attempt to trick users into supplying content or clicking on links in SMS messages on their mobile devices. Flaws in how caller ID and phone number verification work make this an increasingly popular attack that is hard to stop.

• Vishing: Voice phishing are calls from attackers claiming to be government agencies such as the IRS, software vendors like Microsoft, or services offering to help with benefits or credit card rates. Attackers will often appear to be calling from a local number close to yours. As with SMiShing, flaws in how caller ID and phone number verification work make this a dangerous attack vector.

No matter the medium, follow these techniques to help prevent getting tricked by these social engineering attacks:

• Don't react to scare tactics: All of these attacks depend on scaring the recipient. Examples include notice that you are being sued; that your computer is full of viruses; or that you might miss out on a chance at a great interest rate. Don't fall for it!

• Verify contacts independently: Financial transactions should always follow a defined set of procedures, which includes a way to verify legitimacy outside email or an inbound phone call. Legitimate companies and service providers will give you a real business address and a way for you to contact them back, which you can independently verify on a company website or support line. Don't trust people who contact you out of the blue claiming to represent your bank or an agency.

• Know the signs: Does the message or phone call start with a vague information, a generic company name like "card services," an urgent request, and/or an offer that seems impossibly good? Hang up or click that delete button!

To help you more readily identify suspicious e-mails, our mail server will automatically add a "caution" or warning footer (in a yellow box) at the bottom of any e-mail that is sent from an external source. Take time to reach out to senders via phone or a new e-mail to confirm any unusual action requested of you.

Monthly content for Security Matters is courtesy of the EDUCAUSE Cybersecurity Program​.​

December 2018: Set your Personal Greeting on your Office Phone

As you prepare to leave for the winter break, be sure to update your voicemail greeting on your ShoreTel office phone. Follow these steps to update your greeting, change your availability state, change your password, and record your name.

Press – Voicemail key (to the right of the number keys)
You will be asked to enter your password followed by #
For first time access only:

• Your temporary password is 1234. Press 1234#.
• You will be asked to record your greeting and then press #.
• You will be given the options:
  • Press # to Accept
  • Press 1 to Review
  • Press 2 to Re-record
  • Press * to Cancel recording