Safe Computing Protect your electronic profile means protecting You and Case Information Security Office, ITS Case Western Reserve University 2015 Information Security Office Information Technology Services Security.aware.case.edu

Please DoSeriously…….Don’t Use Google Apps for work you don’t want to lose ( ; docs; sheets, etc…) Click on links in s Use Google Apps for work you do as a a team Use portable media or rely on your computer drive to save everything and not be stolen Change your password often Share or reuse your password; OR inadvertently answer questions you’ve used in password security questions Practice clean screen/clean desk Leave your screen unlocked; walk away from your computer. Use different browsers for school work vs personal work Use the same password on non school related Apps Information Security Office Information Technology Services

Don’t Click on Links in s FBI Warning - Business Compromise An Emerging Global Threat 08/28/15 The accountant for a U.S. company recently received an from her chief executive, who was on vacation out of the country, requesting a transfer of funds on a time- sensitive acquisition that required completion by the end of the day. The CEO said a lawyer would contact the accountant to provide further details. “It was not unusual for me to receive s requesting a transfer of funds,” the accountant later wrote, and when she was contacted by the lawyer via , she noted the appropriate letter of authorization—including her CEO’s signature over the company’s seal—and followed the instructions to wire more than $737,000 to a bank in China. Don’t Click on Links

Don’t Click on Links in s – Phishing: appear real, but are fraudulent s intending to compromise credentials for financial or other gain – Real and significant threat to you and if you’re compromised, may present threat to university’s data – Most incidents or breaches are due to human error (inadvertent and/or intended) – When in doubt, forward to Don’t Click on Links

Don’t Click on Links in s Don’t Click on Links

Don’t Click on Links in s – Spear Phishing Looks real ! Targeted s with convincing messaging or from a known friend or entity Expresses urgency – Eg: your account is about to expire – Eg: important student aid document attached – Spelling/Grammar Has typos Awkward use of western English (eg: “kindly” or British spellings of words) Information Security Office Information Technology Services

Don’t Click on Links in s Looks real ? Hover over the URL in the ; it won’t match the supposed message or purpose ITS sends many s; ensure that they’re legitimate before you take action requested in – EG: your account is about to expire, change your password – EG: your has met its capacity, click here to increase storage or space capacity Information Security Office Information Technology Services

Other Critical Info: to protect yourself – Know PII, PHI, FERPA, AUP Personal Identifiable Info Personal Health Info Acceptable Use – (not ok to attack fellow students electronically or misuse the university systems) – Family Ed. Rights & Privacy Protects info in educational records Except where law or law enforcement requires access – What’s public & what’s not- care for your data Information Security Office Information Technology Services

Popular Password (easily breakable) Popular Passwords access Test Games Apache Password Fred Fax Redhat WWW Public Nokia Nobody Setup Upload Asterisk Chocolate Temp Patrick News F**** Backup User Student 1q2w3e Rootadmn Secret Don’t use same password everywhere Information Security Office Information Technology Services

Final Notes/Take Away/Don’t Forget/Please – Do NOT click on links in s – Danger to you and university – Know what data is restricted and what’s public (graduation date vs SSN) – DO NOT CLICK ON LINKS in s – If you do, contact as soon as Information Security Office Information Technology Services

From Case’s Chief Info Security Officer (CISO) Tom Siu – Primary account compromise is via phishing and malware – Do NOT click on links in s – Contact if you a suspicious Information Security Office Information Technology Services