That could never happen to me! Think again. Microsoft reports the ransomware attack rate in Canada is 4x higher than any other country A recent Anti-Phishing Working Group study states there are more phishing attacks “than at any other time in history” with incidents rising by a massive 250% in 2016. In the media… February 2016 – University of Florida reported that as many as 63,000 records were exposed. March 2016 - Concordia University found hardware devices called keyloggers on some of its workstations. April 2016 - Anonymous attacks Dalhousie University website and others May 2016 – University of Calgary suffers a substantial cybersecurity breach June 2016 –University of Regina attacked September 2016 - Cyberattack cripples Appalaches school board, cancer support group; Data breaches on the scale of Yahoo are the security equivalent of ecological disasters; Four years after a data breach at cloud storage service Dropbox, details of more than 68 million user accounts have reportedly been leaked. http://www.pbs.org/wgbh/nova/labs/lab/cyber/1/1/

Cybersecurity ISAT Student Advisory Committee October 3, 2016 Today we will talk a bit about my first 100 days at Queen’s, cyberattacks and prevention, the new cybersecurity program and how each of you can help effect change. Denise Ernst, ISO Office of the CIO

Information Security Officer – Denise Ernst Champion the Information Security Program to reduce risk to Queen’s technology and digital information Promote a security aware culture through awareness campaigns, and community engagement, and process integration. Integrate security throughout Queen’s Events during my first 100 days: BOTS Vulnerabilities Ransomware Network attacks Phishing emails Copyright violations I hate passwords I’m from Ottawa where I worked primarily in the Finance sector most recently at the Bank of Canada on their cybersecurity program. 25 years experience in IT with 15 years in Information Security in the Public and Private sectors Certified instructor with Safe and Secure Online love sports and all animals, enjoy reading, hate passwords! Of interest, - ½ FTE ITS dedicated to copyright violations. When we receive formal notification of a violation, we will be required by law to inform the person of their violation. The answer…well I can do this will no longer fly. - We detect 800 compromised accounts annually. May not sound like a big number but it takes but 1 to compromise the network

Types of cyberattacks Definition Malicious software designed to block access to a computer system until a sum of money is paid. A network of computers commonly used to launch cyber attacks , including denial of service attacks or steal information. Tricking people into giving away account credentials usually through email, phone, or text. Attack type BOTNET RANSOMWARE PHISHING Primary ways the attacks infect a computer: Obtain account credentials through malicious e-mail (e.g. phishing) Drive-by download Exploitation of a system vulnerability Payload from another malware Messages look like they are coming from trusted businesses, like banks, government agencies or even from Queen's University. Your credentials may be used to gain access to your device and possibly to commit crimes.

Be the human shield – report oddities Don’t provide account information online unless absolutely necessary. Don’t click. ITS will never ask for your NetID password through email or text Use different passwords for each device, website, and application. Use 2-factor authentication Install reputable security software and apps from reputable sites. Turn on restrictions. Don’t ignore updates. Install them as soon as possible. Turn on features to remotely locate and wipe a mobile device. Encrypt your devices. ITS offers free encryption service. Never automatically connect to WiFi. Use only trusted, encrypted networks. If you don’t trust the network use a VPN or trusted hotspot How much time do you spend thinking about security? Probably not as much as you should. We are all vulnerable to attack. It’s a virtual wildwest The home computer used to be the main point of attack but smartphones and tablets are just as likely to be targeted. Humans are the weakest link in information security. We are vulnerable to social engineering. We can be scammed. Follow the security principle of trust and verify. Celebrity sites often contain viruses. Be wary of emails and links even though they may appear to come from a reputable business or trusted friend. Reputable companies will provide a contact number. Call and verify.

Enhancing cybersecurity @Queen’s Queen’s is making changes to the security of their networks and systems to reduce the risk of a cyberattack. Stage 1 - 2016/2017 Enhance technical capabilities to prevent and detect IT hijack Improve peoples’ ability to protect themselves against security threats Begin to foster a security-aware culture Stage 2 – 2017+ Transition overall cybersecurity practices from REACTIVE to PREVENTATIVE ITS is seeking your support and leadership by example This year’s program is designed to mitigated the top 3 global threats: 1. Exploitation of system vulnerabilities 2. Malware infection 3. Social engineering attack Focus areas: a. Enhance Network Security b. Improve Email Security c. End-point security d. Security awareness

Help champion change Promote security tips and tricks, events, course material on the ITS website: http://www.queensu.ca/its/security Follow ITS on Twitter: @ITQueensU Share and understand the Queen’s security policy and standards: http://queensu.ca/cio/information-security-office Attend and promote upcoming security information sessions Reach out, ask questions: http://www.queensu.ca/its/itsc Other ideas?? While championing change, try to think about the different student roles and types of sensitive information they are entrusted to protect for instance: Students = protection of their personal information, physical identity, digital identity, social identity Student employees = stewards of Queen’s business information and third party, student, information list services. Grad students = in addition to their personal information and identity, they may be stewards of student academic information such as grades. Entrusted with safeguarding the information