Multi-Factor Authentication - World Password Day

Now that you've learn how to create a secure password. Let's learn about more security techniques available to us. 

Hypothetically, let’s say a malicious actor manages to crack your safe and secure password. Wow! Sounds like it's game over, right? 

In theory, the hacker will now have access to your ESU account, important files and emails. Along with your personal information and the the ability to edit your account. Moreover, if you had access to other people’s personal information (by way of your job functions), the attacker will also be able to access that information!

But, what happens if you have Multi-Factor Authentication (MFA) enabled? 

The hacker, who has your password, would now also need your second factor to actually log into your account. That just tipped the scales dramatically in your favor.  Even though your password is in the hand of the attacker, your second factor, usually a cell-phone application, is safe and sound. 

When the attackers try to log in, all they will get is a prompt for the 2nd factor, which they will not have. WIN for the Home Team!

So, while using MFA to log into your account adds an extra step, it is huge in keeping our information out of the wrong hands! It is why many companies are now moving to MFA, to secure accounts against fraud and identity theft.

ESU has begun deploying MFA to our campus staff and faculty and will continue to increase and improve our MFA options as the year progresses. As we do so, please remember that we are striving to keep your information out of the hands of all malicious actors that wish us harm.

Here are some things to remember regarding MFA options:

1. Always opt in for MFA for accounts where it is offered, especially those that contain personal or financial sensitive information.
   
   
2. When selecting an MFA option, we recommend using a smart-phone application (such as Microsoft Authenticator) as the most secure option.  These applications will typically allow you to enter a code or use a “push notification”. Both are secure, but the push notification is the most convenient as it asks you to verity that you just attempted to log in.
   
   Selecting the option 'yes' (or checkmark for some apps) and you are good to go.
   
   
3. If you use the text or call option instead, always remember to select a device or phone number that you will have access to when logging into your account.

Remember, a password without MFA is like a car without a seatbelt. Sure the car offers some protection, but if the worst happens, you will be glad you had that seatbelt on!

One Password, Slightly Used? - World Password Day

PASSWORD RE-USE:

Let’s say you have formulated the most perfect password that is possible to construct. It is easy to remember, a mile long, and has all the available character types. Now you’re set to use it for all of your accounts, right?

Not so fast. Even the most perfect password can be vulnerable to sophisticated attacks against the company that runs the servers that your account uses. In some recent high-profile cases, servers have been attacked and user account information siphoned out.  So even doing all the right things doesn’t mean a determined hacker can’t figure out what the password is (through no fault of your own).

Yikes! Now what? If this happens to you it could have serious consequences that you could not have avoided. But what if that perfect password that just got hacked is used for everything in your life?  All of a sudden, the attacker has access to EVERYTHING! Your social media accounts, your school accounts, even your bank account!

That is why we recommend you never “re-use” a password. If you have a separate password for each account, it won’t prevent a determined hacker from getting into one account, but it will prevent that same attacker from getting into everything.

But that’s a lot of passwords, right. “How am I going to remember all of those?!”

    1. As we covered in or last Daily Download, make your long passphrases something memorable. You can use that as a basis for a series of passphrases (a theme) and use significant variations on that theme (Remember, if they are too similar then it won’t be any better than using the same one for everything).

    2. Alternately, you can use a password manager. These are applications that can manage multiple account passwords for you. All you, then, have to remember is the one password for that application and it will do the rest. A Google search on “password manager” will give you a number of applications to choose from, each with their strengths, weaknesses, and prices (some are free). If you have questions, ask IT Security – we’ll be glad to help you decide on a suitable solution.

    3. Finally, avoid the temptation to allow your web-browser to remember your passwords. These are less secure than a password manager. Hackers may be able to “harvest” those passwords if you ever get malware on your computer (which is a whole topic for another time).  Besides being less secure, they only work when you are using that browser to access your accounts and they may forget all your passwords in certain circumstances.

Strength in Numbers (or Characters?!) - World Password Day

PASSWORD STRENGTH:

We all know the drill: enter a username and password to access your accounts. But are you aware that, in many cases, your password is the only thing standing between your important on-line accounts and a malicious actor trying to get in and steal your information, your identity, and your money?  That is why having an effective password is so important.

So, what constitutes an “effective” password?

Well, a password is “effective” if it keeps bad actors out. But to do that, you need to know what you are up against.  These bad actors have at their disposal many tools that try to defeat your password. One is a list of maybe the 10 million or so most common or previously hacked passwords, including popular variations of some of the more common. Adding a zero in place of the “o” in “password” will not be any more secure. They also use “dictionary” attack tools that look for actual words or variations of words (like the zero vs “o” above).  Finally, if those fail, they use tools to rapidly guess passwords one character at a time. So just using any a random collection of characters, if too short, will still allow the hacker to guess the password in a reasonable amount of time.

How do I have a strong password?

1.      Make it long – 14 or more characters. This dramatically slows down the character-at-a-time guessing technique. 

2.       Use a “pass-phrase” instead of a “password”.  String words and characters together in a way that is meaningful to you (and therefore easier to remember) but impossible to guess (hint: don’t use information about yourself that may be available on the internet).

3.       Include as many types of characters as you can. For examples, use lower and uppercase alphabetic characters, numbers, and special characters as allowed by the application or account. Some include minimum requirements to include, for example, 3 of the 4 types mentioned here.

Finally, if you discover that a password you currently use is on the weak side, change it!  Most sites and accounts will let you change your password whenever you like.

If you want to test your password to see if it has been used in a data breach, try haveibeenpwned.com. Their database consists of over 600,000,000 passwords that have been obtained from data breaches.  To test your password strength to see how long it would take a hacker to guess it, go on over to security.org.

Designing the Perfect Password - World Password Day

Are YOU still using that same password you created way back in day?

Pets Name? Kids’ names? Birthdates? Anniversaries? The word 'password'?     

Today those tactics no longer work. With data breaches at an all time high, we need to protect ourselves more than ever! Just a few small things can drastically help protect all your important online accounts. Here is a few you can try!

Create Robust Passwords: Make it difficult for Hackers to guess. Make your passwords contain at least 10 characters, have BOTH a capital and lower-case letter, and one or more symbols/numbers. (i.e., !@#$%^&*() 123456789). Use a “pass-phrase” instead of a password to make it longer and more memorable to you but even harder to guess.

Use Different Passwords: Make sure to use a different password for every account you have. If you use the same password for your personal e-mail, work e-mail, Facebook, Twitter, bank account, etc., and just one of those sites were to be compromised, the attacker would then have the “Golden Key” to all of your accounts. Do not make it that easy for them!

Always opt for Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA):  It is very important to make our data as secure as we can.  Having a second layer of security in place to protect us is never a bad thing! That way, even if your password is obtained by a bad actor, they still won’t have access to those accounts protected by a 2^nd factor.  Most companies now offer MFA or 2FA when you sign up for their services. When available always OPT IN! If you already have an account that is not protected by these, check back every so often. More and more companies are enabling these features.

Change your password every few weeks: The reason for changing your password on a regular basis is to protect you and your data from ongoing password attacks. With today’s hacking tools, guessing a simple password (a name, word, or common pattern) trivially easy. But even a good password can be guessed eventually, but it does take time.  Also, when hackers compromise an account, they may not always act right then and there, some continue to silently watch for as long as the password remains the same. When you change your password regularly it does not allow the hackers much time to act.

Do NOT Tell Anyone Your Password:  Your Passwords are Personal and Non-transferable. Do not give anyone the “Golden Key” to your information. Protect it like you would a safety deposit key!

May 6 is World Password day. We will post information and helpful tips all week, so watch for more information!

Data Privacy Day

First, some sobering facts:  At least half of all adults in the USA have had their personal information exposed through hacking and data breaches. Most folks feel they have lost control over how personal information is collected and used by companies. Many have just given up trying to control this situation, but most want to do more to secure their personal information online. 

So, for those that want to know more about how to protect their privacy online, here are a few tips: 

Think before you act.  Phishing scams depend upon you reactive impulsively to threats or emergencies. Any email requiring you to log into an account or click a link because of imminent danger should be re-read with a skeptical eye. 

Be careful what you post.  What you post on-line will live somewhere on the internet even if you ‘delete’ it. Many areas of society used social media posts as a form of character reference. 

Be careful who you trust.  Anyone on the internet can say anything. Don’t automatically assume that someone is who they say they are or that they can be trusted.  This is especially true for social media and children. Predators love to use social media to become ‘friends’ with children and then prey on them. 

Do a ‘security settings’ checkup.  Every application we use online has a set of security and privacy settings. It will pay big dividends to learn about those settings and how to prevent unwanted sharing of information. 

Get two steps ahead.  2-step verification or multi=factor authentication is absolutely the best defense against online account compromise.  It uses something in addition to passwords to log into your account.  If an online service provides the option to use 2-step verification, use it.  It is usually easy to set up and gives you options that provide the best convenience for your situation. 

The internet has revolutionized our lives in many ways, but it has also introduced many serious risks. Be smart about your on-line life and the internet will work for you instead of against you. Learn more at staysafeonline.org. 

  

Your Information Security Team 

Holiday Season, Holiday Scams

The holiday shopping season is here once more and that means the online scammers are out in full force threatening to be the coal in your proverbial stocking.  Here are a few things to look out for:

• We’ve been alerted that users are being targeted by phone calls—allegedly from companies like Apple or Amazon.  The automated caller may tell you there is a problem with a package or your account.  They will then direct you to either "press 1" or call another phone number to "resolve the problem".  This is a scam to get personal information from you.  Do not "press 1" or return the phone call.  If you suspect there may be a problem with Apple account or an Amazon purchase contact those service providers from their company web pages.

• Watch out for holiday shopping deals that are sent via email or text.  Never click on links in email unless you recognize the sender.  If you're shopping online, stick to places that you've purchased from previously or are reputable.

• Never, ever give out your social security number to retailers.  If you're asked for personal information in order to complete a purchase--walk away.

• Buy with credit cards--or better yet use services like PayPal and Apple Pay.  These provide an extra layer of protection when shopping online.  Avoid using debit cards, if possible.  Credit cards tend to have better fraud protection.

• Start the holiday season by making sure your computer, tablet, smartphone and any other Internet-connected devices are up to date with the latest software and that you're using strong passwords with all of your accounts.

• If you donate to charitable organizations, use extra caution this year.  Scammers are taking advantage of COVID-19 to send out fake charitable requests, often by email or text.  These can be indistinguishable from legitimate organizations--even using the appropriate charity's logo.  Unfortunately, these scammers don't just take your money, they also steal your identity, banking info, and SSN.  If you want to donate, visit the charity's website yourself--don't click on an email or text message.

Brian Osbourn
Director

Web and Digital Strategies

Never Click and Tell #CyberSecurity

Limiting the information you online could protect you and your privacy.

Phishing, cybercriminals, location services, and more are elements to be concerned with when it comes to cybersecurity.  What are you doing to protect yourself?

 

Many people do not realize that random details, numbers, or even symbols are the only things cybercriminals need to know to target you for an attack. If you become the target of a malicious actor, it may not be totally online as many digital attacks also manifest against you or your family in the physical world. Today, we are going to go over a few of the warning signs you should be looking for and possible precautions you could take to keep yourself safe. 

 

 

Location Services

    Having your location is an easy way for cybercriminals to use that information against you. This can manifest as tagging your home on Facebook, having your location turned on within an application like Snapchat or dating apps, or applications geotagging your posts without your permission. Turning your location services off on your devices or switching to "Allow Only While Using" is the smart and safest option to limit what is disclosed about your location.

 

Passwords

    Awareness about what you post and the discretion used in posting could save you quite the headache if your account gets compromised. Seemingly innocent social media posts about the first dog you had when you were 12 or the street name you lived on as a child—and all common answers to security challenge questions--are an often overlooked pitfall that would allow a hacker to gain access to your password. Make sure your password includes capital letters, numbers, and at least 2 symbols. Most services will require specific elements when you set your password, but if not, it’s up to you to be cybersmart when choosing your password.

 

 

Careful What You Click

    Receiving emails or messages online that you don’t immediately recognize as coming from a trusted and expected source that request you divulge information are usually attempts at maliciously acquiring your personal data. These messages could compromise your online integrity or download viruses to your device to obtain your information in more automated ways. Avoid clicking a link or navigating to a website if it is coming from an individual you do not know or an email address you have not sent or received from previously. 

 

 

Protection in the Real World

    Not “clicking and telling” should be used in the same reference as in-person interactions. Protecting your passwords or security question answers in person is just as important in the real word as it is online.  Avoid verbally sharing personal information or account credentials to protect you both in person and online. 

 

There are many ways hackers or cybercriminals can obtain your information through your internet presence. Creating an environment to protect yourself could save you a lot of time and a lot of worries. And your actions could not only impact you, but your friends, family, and employer as well.

 

As always if there are any questions, comments, or concerns please feel free to reach out to the IT Help Desk or Information Security.

 

Stay healthy Hornets!

 

Dakota Taylor
Social Media Student Assistant
Web & Digital Strategies

Checking for Updates in Zoom

We’ve come to rely on Zoom as our primary means of communication as we learn, work and teach from home.  It’s important, however, to make sure your Zoom software is updated.  As Zoom has become immensely popular, it has also been targeted for vulnerabilities and exploits.  Zoom is continually updating and patching their software, but it is up to YOU to install those patches.  Here's how.

Zoom will typically alert you when a new update is available.  It will appear across the top of the Zoom application.

If you don't see it, you can always check for updates manually.  To do so, open Zoom.  Click your initials or avatar graphic in the upper right corner.  Choose “Check for Updates.”

If there are any updates, you’ll be shown an “Update Available” screen.  Click the “Update” button.

After a few seconds, you’ll now have the option to click the “Install” button.  Click it and Zoom will close to complete the update.

Follow any on-screen prompts for your operating system to install the update.  Zoom should then restart automatically, and you’re all set to go.

The Takeaway:  Update Zoom on your computer.  Check for updates at least once a week and install any that are available.

Security Awareness Training Update

The Security Awareness Training contest ended nearly 2 weeks ago, and the winner was announced last week. The annual online security training is required for all ESU employees, and this year we gave one lucky winner (selected from those that completed the training by the end of the day on March 30) the choice between an Kindle E-Reader and an ESU parking pass.

1/3 of all ESU employees completed the training by the deadline and were entered into the contest. 

If you or someone you know hasn't completed the training, the deadline is June 1st. 

The winner of this year's contest was Debbie Redeker! Debbie's prize of choice was the Kindle E-Reader.

(An in-person presentation of the prize will happen once we're back on campus)

Congratulations Debbie, and a huge thank you to all who completed the security awareness training for this year.

We also want to invite everybody to tune into our now weekly video series, IT Only Takes a Minute, as well as our new segment in the Hornet Announcements, the Daily Download - technology news and tips.

Tyler Parker
Social Media & Marketing Student Assistant

Web & Digital Strategies

Email Encryption - New Service at ESU

This week, we announced the availability of email encryption from Outlook for ESU employees.    Our Information Security team has developed the following "how-to" guide with frequently asked questions to help users get started.

·       When would I use the encryption option?

o   If you send and receive information that's considered PII, Non-directory FERPA, HIPAA, Intellectual Property or any personally important information, you should use encryption.

·       Why would I use the encryption option?

o   Encryption scrambles the information in your message so that it can only be read by a recipient with the correct key. Encryption ensures that your information remains safe and confidential while it's passing through the internet. 

·       What do I have to do to use encryption?

o   It’s already available natively for some Outlook 2016 users (If you see a “permission” button where the “encryption” button should be then you need to upgrade your Office suite to enjoy seamless interaction with encrypted mail. All Outlook 2019 desktop and webmail users are able to use encryption without any additional setup.

o   If you have tried sending encrypted mail with Outlook in the past you may recall how tedious the process was to setup certificates and how often the mail recipient could not open the mail you sent them. The new encryption process is much, much easier to use and, most importantly, can be used to communicate with people using Gmail, Yahoo or virtually any other email client. 

·       What are these options I see under the encryption button? 

o   There are 4 types of email classification options available to Outlook desktop users and 2 available to Outlook web users. Desktop only options are noted with an *:

§  Encrypt-Only – This is the recommended setting for sending encrypted mail. We recommend this setting over the others because it is compatible with nearly every email recipient (Gmail, Yahoo, AOL….lets just say we haven’t found an email provider that it doesn’t work with yet)

§  Do Not Forward – This option gives you a little more control over the content you email. Using this option the recipient will not be able to forward the email message to another account or individual. This would be best used when sending sensitive information that only the recipient and the recipient alone should have access to.

§  Emporia.edu – confidential* – This option, along with the next one are not recommended for use unless you’re given specific guidance to do so. No, it won’t cause harm to use this or the next setting, but it will prevent any recipient outside of the organization from viewing your email.

§  Emporia.edu – confidential View Only* – As with above, this setting is really meant for highly confidential communication within the ESU organization. If you haven’t been given instructions to use this option then you don’t need to.

·       What types of attachments can I send?

o   Attachments are fully supported for all Office file types, PDF and several image file types.

·       I need to send email to multiple recipients; can I do that?

o   Encrypted mail can be sent to multiple recipients using the “Encrypt-Only” and “Do Not Forward” options.

·       I am ready to send encrypted mail; how does my recipient open the mail?

o   If the recipient is using another email client, such as Gmail or Yahoo, they'll see a link that lets them either sign in to read the email message or request a one-time passcode to view the message in a web browser. The message will be read and replied to in an Outlook web interface.

Knowledge Base Links:

·       How do I open a protected message?

o   https://support.office.com/en-us/article/how-do-i-open-a-protected-message-1157a286-8ecc-4b1e-ac43-2a608fbf3098?ui=en-US&rs=en-US&ad=US

·       View encrypted messages on your Android device

o   https://support.office.com/en-us/article/view-protected-messages-on-your-android-device-83d60f17-2305-407a-a762-7d518401fdeb?ui=en-US&rs=en-US&ad=US

·       View protected messages on your iPhone or iPad

o   https://support.microsoft.com/en-us/office/view-protected-messages-on-your-iphone-or-ipad-4d631321-0d26-4bcc-a483-d294dd0b1caf?ui=en-us&rs=en-us&ad=us

·       Encrypt email messages

o   https://support.office.com/en-us/article/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc

Applies to: Outlook for Office 365, Outlook 2019, Outlook 2016, Outlook 2013, Outlook 2010, & Outlook 2007

·       File types supported by the Azure Information Protection client (Encrypted Mail)

o   https://docs.microsoft.com/en-us/azure/information-protection/rms-client/client-admin-guide-file-types