Information Security Updates

Physical objects as security threats are in the news at the moment. The oft-touched upon tale of rogue USB sticks is a common one. Being wary of random devices found on the floor, or handed out at events is a smart move. and now they're showing up in the mail. You simply don’t know what’s lurking, and it’s hard to find out safely without the right tools available. Even then, something can slip by and cause no end of trouble on your desktop or network. Read more at https://blog.malwarebytes.com/cybercrime/2022/01/attackers-are-mailing-usb-sticks-to-drop-ransomware-on-victims-computers/

Targets aren't just the upper management of a company; the truth is, anybody can be a victim. Even random targeting can allow phishers to gather sensitive information about anyone online, such as their contact details and financial data, which they will use to their advantage. Read more at https://fraudwatch.com/who-are-the-most-common-targets-of-phishing-scams/
 

Email is still one of the primary ways we communicate, both in our personal and professional lives. However, quite often we can be our own worst enemy when using email. Here are the most common mistakes people make with email and how to avoid them. https://www.sans.org/newsletters/ouch/avoid-the-most-common-email-mistakes/

I wrote about ransomware about a year ago. The only things that have changed since then are that the result of becoming infected have gotten far more severe and the number of victims has increased exponentially. Today's variants not only encrypt your data and demand payment to decrypt it, they also steal your data and threaten to expose it to the world if payment is not made. Under that scheme, even if you have proper and sufficient backups to restore your data, making the encryption moot, there is the threat that your data will be published for all to see.

We are not immune from these attacks here in the midwest. Last fall, the University of Nebraska Medical Center and Nebraska Medicine were breached. Associated costs are many tens of millions of dollars. More recently, and even closer to home, DMACC suffered a ransomware attack early last month that shut their network and classes down for almost two weeks.

Phishing provided the initial foothold for the bad actors behind these and many other similar incidents. Vigilance and skepticism when reading email remains key. Don't fall for the emotions that all phishing actors try to evoke -

• Fear - something bad will happen if you don't click on the link in the message
• Greed - something good will happen if you do click on the link in the message
• Urgency - hurry up and click on the link in the message right now
• Concern/Empathy -
  • I’m stranded in an unfamiliar city
  • I’m falsely accused, in jail, and need bail money
  • I’ve been mugged and am in the hospital

Don't click on links in email messages unless you're certain they are legitimate. Don't open attachments in email messages unless you're certain of the sender's identity and the content of the message makes sense to you. If you have any questions about the message, err on the side of safety and seek help by contacting security@uni.edu.