Visitors Updates

Should you use a different password for every site? Absolutely! Should you use your browser to store all of those distinct passwords? Probably not..

https://isc.sans.edu/forums/diary/Use+Your+Browser+Internal+Password+Vault+or+Not/28658/

I have recently attended several briefings on the cybersecurity fallout from the current Russia-Ukraine conflict in eastern Europe. That event has resulted in a lot of FUD (Fear, Uncertainty, Doubt) about the online safety of people worldwide. It is certainly true that cyberattacks have played a role in the conflict, but cyberattacks are present every day. There are three general areas that you can concentrate on to protect yourself and your cyber assets.

1. Phishing - Be aware and be skeptical of email you receive, particularly from unknown senders. The bad actors will try to fool you by using well-known personal names on the accounts they are using. They may also copy signature blocks, UNI logos, and other details to make their message appear official. Check the actual email address of the sender. Hover over links with your mouse to see where they are going. If it's not uni.edu or another well-known site, think again and don't click the link.
2. Passwords - Passwords are hard and not really sufficient on their own today. They should be unique from one site to another and should be more than a simple word or two. Length trumps complexity. Even though "thequickbrownfoxjumpedoverthelazydog" has several issues and shouldn't be used, it is far better than "R3(s4*#1" for a password. Consider a password manager to help. It can generate lengthy unique random passwords per site and remember them for you.
3. Patching - For UNI-managed devices, IT tries to take care of this for you but the process does take your cooperation and time to allow the patches to be deployed and made active. For your personal devices, patching is on you. Allow the operating system and applications to apply updates automatically. And when Windows or Adobe or Office tells you their are patches available, let those updates happen. If you can't do that immediately, okay, but do it soon, within a day or two.

US Police Warn of Parking Meters with Phishing QR Codes

Always think twice when you're tempted to scan a QR code!

 https://www.bitdefender.com/blog/hotforsecurity/us-police-parking-meters-phishing-qr-codes/

I wrote about ransomware about a year ago. The only things that have changed since then are that the result of becoming infected have gotten far more severe and the number of victims has increased exponentially. Today's variants not only encrypt your data and demand payment to decrypt it, they also steal your data and threaten to expose it to the world if payment is not made. Under that scheme, even if you have proper and sufficient backups to restore your data, making the encryption moot, there is the threat that your data will be published for all to see.

We are not immune from these attacks here in the midwest. Last fall, the University of Nebraska Medical Center and Nebraska Medicine were breached. Associated costs are many tens of millions of dollars. More recently, and even closer to home, DMACC suffered a ransomware attack early last month that shut their network and classes down for almost two weeks.

Phishing provided the initial foothold for the bad actors behind these and many other similar incidents. Vigilance and skepticism when reading email remains key. Don't fall for the emotions that all phishing actors try to evoke -

• Fear - something bad will happen if you don't click on the link in the message
• Greed - something good will happen if you do click on the link in the message
• Urgency - hurry up and click on the link in the message right now
• Concern/Empathy -
  • I’m stranded in an unfamiliar city
  • I’m falsely accused, in jail, and need bail money
  • I’ve been mugged and am in the hospital

Don't click on links in email messages unless you're certain they are legitimate. Don't open attachments in email messages unless you're certain of the sender's identity and the content of the message makes sense to you. If you have any questions about the message, err on the side of safety and seek help by contacting security@uni.edu.