P ASSWORD S ECURITY

I F SOMEONE HAS YOUR PASSWORD, EITHER FROM YOU GIVING IT OUT OR THEM FIGURING OUT, THEY COULD : 1.Send abusive or threatening from your account 2.Use your network storage to store illegal files that you may then be responsible for 3.Send SPAM to the Internet from your account 4.Gain access to confidential information stored on your network account 5.All of the above (and MORE!)

The point of this particular lesson is that your password is the key to access to all that you have access to. If you want to maintain the integrity and confidentiality of information that you account has access to and prevent the other situations as indicated above, you must protect your password at all times. This also means periodic changes as the longer you have a particular password the odds are increased that someone can obtain it. This is also emphasized in the UM system Human Resources Policy Manual HR-518 Computer Utilization.

L ONG, COMPLEX PASSWORDS ARE USED AT THE UM S YSTEM TO : 1.Annoy the users 2.Ensure that passwords cannot be easily guessed 3.Ensure that the Information Security personnel have something to do 4.Slow down your access to the system to avoid peak server loading

The reason that the UM System requires longer, complex passwords is multifold. Complex passwords are very hard to guess and they cannot be easily cracked through brute force attempts. Longer passwords using multiple character sets like upper and lower case, numbers and symbols take even longer to crack through brute force attempts. Thus long, complex passwords have become an industry best practice to protect against unauthorized account use.

W ORKSTATION P ROTECTION

K EEPING YOUR SYSTEM UP TO DATE ON PATCHES HELPS 1.Protect your system from being exploited through vulnerabilities 2.Keeps the licenses up to date 3.Ensures you have the latest drivers 4.Keeps the digital rights updated

Systems must be kept up to date on system and software patches to avoid being exploited. There are vulnerabilities that are discovered weekly which could lead to someone externally exploiting the vulnerability and taking over your system. By using auto update on your operating system, you can help reduce the chances of this occurring. There are also vulnerabilities that are found frequently in software applications like word processors and web browsers and thus applications need to be kept up to date as well. Many of the vulnerabilities found in applications are not remotely exploitable, although by visiting the wrong website or opening an attachment, your system can be exploited through these vulnerabilities.

W HAT SHOULD YOU DO WHEN YOU LEAVE A COMPUTER SYSTEM, EVEN IF JUST FOR A FEW MINUTES : 1.Turn off the computer 2.Log off the computer 3.Screen lock the computer 4.Any of the above

Unauthorized access to your system or account can occur rather quickly if you leave the system logged in and the screen unlocked. Once someone has access, they are many nefarious things the person could do. All of which will look like it came from you. The simple rule is to never leave your account logged in and unsecured can go a long way to protect your account, data, , etc.

I NTERNET S ECURITY /S OCIAL E NGINEERING

W HAT IS THE GOAL OF P HISHING ? 1.To verify if your is working 2.To trick users into disclosing personal information like SSN, credit card, accounts/password or other confidential information 3.To advertise a company’s products 4.To find out if you are going to be out of your home on vacation at any point

Phishing is a social engineering attack where the miscreants attempt to lure a person to a site which looks as authentic as possible in the attempt to get the person to give up some sort of information they would not normally reveal. By making a web site match a campus password changer, or a bank’s account portal, people are tricked into thinking they are actually at the official location for the proper entry, when in fact they are not. Any data entered can then be captured by the phishers and then used against you. Identifying these attempts can be difficult, but remember that legitimate sites like banks and the campuses in the UM System already have your userid/account information and there is no need to ask for it. So, if an appears touting some security issue has occurred and then they ask for your SSN, bank information or other personal information for verification, it is likely a scam. Remember that social engineering relies on trust. Please be careful in who you trust, especially if someone calls you on the phone asking for information.

W HAT IS THE BEST WAY TO REPORT A PROBLEM, ABUSIVE OR PHISHING ? 1.Delete the offending message and send a description to 2.Forward the abusive message to all your friends and family so they are aware of the issue. 3.Forward the abusive message to and wait for further instructions without deleting or moving the message from your 4.Reply to the abusive message and tell the sender to leave you alone.

Forwarding the entire message to will ensure that the proper staff members can analyze the and take appropriate action. If you modify or just send description of the , we cannot determine where the mail came from nor take the appropriate action in all cases. It is very important to forward, not reply, the to make sure we get all the information contained in the

W HEN IS PERSONAL ELECTRONIC INFORMATION ON THE U NIVERSITY NETWORK OR EQUIPMENT SUBJECT TO INSPECTION ? 1.It is necessary to maintain or improve the functioning of University computing resources. 2.There is a suspicion of misconduct under University policies, or suspicion of violation of Federal or State laws. 3.It is necessary to comply with or verify compliance with Federal or State law. 4.All of the above

Under the Collected Rules and Regulations Acceptable Use Policy, all of the three conditions above are clearly spelled out. This policy applies to users including faculty, staff, students and guest users connecting to the campus network resources.