1. Safe Computing Practices

2. What is behind a cyber attack? 1

3. 2

4. Phishing Example 1 - Red Flags 3

5. Phishing Example 2 – Spoofed Senders 4 Emails sent from a compromised @middlebury.edu email account!

6. Phishing Example 3 – Context and Links 5

7. Phishing Example 4 - Malicious Attachment 6

8. Scams – Common Attacks to Watch For Credit Card or Bank Scams: Often mimic common banks and card companies trying to entice a potential card folder to expose their user credentials or account information. PayPal Scams: Have become increasingly prevalent from fake offers of PayPal benefits to scams around account information. The goal of these is always to elicit account credentials. C-Level Scams: Attackers have increased their efforts targeting C-Level or management level individuals. These attacks often are singular in their target (spear phishing) and extremely well crafted. Managers should practice extra caution when exposing their credentials Vacation/Travel or Sales Scams: Traditionally done a spoofs of major travel or retail outlet firms but can be designed to look like any online store or company. These scams have the sole intent of taking the attacker to a fake web site for the harvesting of sensitive information such as credit card information. Tax/IRS Scams: Most common around the New Year and tax season, these scams come in many forms to entice the victim to expose sensitive data such as social security numbers. Phishing: Usually in the form of email, a scam defrauding an online user of account, financial, or other sensitive information by posing as a legitimate source. Pharming: The act of redirecting traffic from a web site to a fake site for the purpose of defrauding the site users. 7

9. Malicious Downloads 8 -- http://www.howtogeek.com/168691/how-to-avoid-installing-junk-programs- when-downloading-free-software/

10. Malicious Add-Ons and Plugins 9 -- http://www.howtogeek.com/168691/how-to-avoid-installing-junk-programs- when-downloading-free-software/

11. Please Don’t Share Passwords 10

12. There’s no such thing as a free lunch USB storage key 2011: Ponemon Institute and Kingston Digital release a report showing 70% of businesses lost data due to USB sticks and 55% of those were due to malware infections. 2012: Two US Power Plants infected with malware from USB Drives 2014: Nohl & Lell identify a critical flaw in the design behind USB technology that allows for the introduction of malware. 11

13. Data Classification – What to Collect and How 12 ●http://go.middlebury.edu/sensitivedata ●http://go.miis.edu/sensitivedata

14. Resources on Information Security Policies: Privacy Policy =Confidentiality of Data http://go.middlebury.edu/privacy Network Monitoring Policy = Protection of College Technology Resources http://go.middlebury.edu/netmon Technical Incident Response Policy = Response to Information Security Events http://go.middlebury.edu/tirp Data Classification Policy = Defines Data Types http://go.Middlebury.edu/dcp Red Flags Policy = Identity Theft Protection Not presently in hand book PCI Policy = Payment Card Data Handling http://go.middlebury.edu/pcipolicy Web Sites: Middlebury’s Information Security http://go.middlebury.edu/infosec Phishing Information http://go.middlebury.edu/phish http://www.phishing.org/ Protect Yourself On-line http://www.onguardonline.gov/ Parents Resource for Kids On-line http://getnetwise.org/ Best Practices for Home and Work http://www.nsa.gov/ia/_files/factsheets/ Best_Practices_Datasheets.pdf

15. Discussion and Links Please share your thoughts! Information Security Resources: http://go.middlebury.edu/infosec http://go.miis.edu/infosec http://go.middlebury.edu/infosecfeedback Report Information Security Events To: infosec@middlebury.edu