October is National Cybersecurity Awareness Month (NCSAM) , is an annual initiative to raise awareness around cybersecurity issues and to empower everyone to protect your personal data in our highly digitized world.
- Week 1: Passwords and Multi-Factor Authentication
- Week 2: Data Privacy and Protection
- Week 3: Phishing and Scams
- Week 4: Software Updating
Week 1 – Passwords and Multi-Factor Authentication
Did you know over 80% of breaches involve weak or reused passwords?
The Importance of a Strong Password
Passwords are the first line of defense against unauthorized access to your personal and work accounts. Weak or reused passwords are an open invitation for hackers to gain access to sensitive information.
Why Are Weak Passwords Dangerous?
Hackers use a variety of methods—such as brute force attacks, phishing, and credential stuffing (using passwords from previous data breaches)—to break into accounts. If your password is weak or reused across multiple platforms, it’s only a matter of time before your accounts become vulnerable.
What Makes a Strong Password?
- Password Length: Aim for at least 12-16 characters (https://www.hivesystems.com/password). Longer passwords are much harder to crack and they don’t require you to remember a password that is overly complex.
- Avoid Common Words: Don’t use easy-to-guess words, phrases, or personal information like names, birthdays, or simple sequences (e.g., “12345” or “password”).
- Here is a list of the most common passwords. Do you see your password here? https://www.weforum.org/agenda/2024/07/popular-passwords-cybercrime-digital-safety/
- Use Passphrases for: Consider creating a passphrase by combining random words (e.g., “Blue!Tree*Apple23”).
- Unique Passwords for Each Account: Never reuse passwords. Each account should have its own strong, unique password. Use a reputable password manager to assist you in storing all your passwords.
What is a Password Manager?
A password manager securely stores all your passwords. It can generate strong, unique passwords for each of your accounts. For more information, visit (https://www.hawaii.edu/infosec/resources-tips/password-manager)
What is Multi-Factor Authentication (MFA)?
MFA adds an extra layer of security to your accounts by requiring you to verify your identity in two or more ways before granting access. Typically, this includes something you know (your password) and something you have (a phone or authentication app).
- MFA Resources:
How Does MFA Protect Your Account?
Even if a hacker gets hold of your password, they won’t be able to access your account unless they also have access to the second factor of authentication. This significantly reduces the risk of unauthorized access and helps safeguard sensitive information.
MFA significantly enhances your security by adding another hurdle for attackers. Accounts with MFA are over 99% less likely to be compromised compared to those without it. Don’t wait—take a few minutes today to enable MFA on your most important accounts!
If you receive a multi-factor authentication request and you are NOT logging into the service immediately DENY the request and change your password! The cyber criminal ALREADY has your password and is attempting to break into your account.
Week 2 – Data Privacy and Protection
Defending Your Digital Future with Data Privacy and Protection
Data privacy and protection are the cornerstones of safeguarding both personal and organizational information. Data privacy refers to how personal and sensitive data is collected, stored, and shared, while data protection focuses on securing that information from unauthorized access, breaches, or misuse.
What is Data Privacy?
Privacy is about the rights and consent, and how and why data is collected, used, and shared in a lawful and transparent manner.
What Kind of Data is Included with Data Privacy?
Data privacy is mainly to safeguard Personally Identifiable Information (PII). PII includes such data elements like name, address, Social Security Number (SSN), and date of birth. Other PII include financial information, like bank account numbers and credit card information and health records, like medical histroy and insurance details.
Examples of Data Privacy Regulations
- General Data Protection Regulation (GDPR) – European Union’s regulation on protecting the privacy of personal data.
- HIPAA: The Health Insurance Portability and Accountability Act, which protects sensitive patient health information.
- FERPA: The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of students’ educational records.
For more information about external regulations that apply to the University of Hawai’i, https://www.hawaii.edu/infosec/policies/
Tips for Data Privacy
- Educate Yourself and Others:
- Stay informed about data privacy regulations (e.g., FERPA, GDPR).
- Conduct regular training sessions for staff and students on data privacy best practices.
- Use Strong, Unique Passwords:
- Create complex passwords and avoid reusing them across different accounts.
- Consider using a password manager to store and generate secure passwords.
- Enable Multi-Factor Authentication (MFA):
- Add an extra layer of security by requiring a second form of verification for accessing sensitive accounts.
- Limit Data Collection:
- Only collect personal information that is necessary for specific purposes.
- Review and minimize the data collected in forms and applications.
- Control Access to Personal Data:
- Implement role-based access controls to ensure only authorized individuals can access sensitive information.
- Regularly audit permissions and access rights.
- Be Cautious with Sharing Information:
- Think carefully before sharing personal data, especially on social media.
- Limit the amount of personal information shared publicly.
- Secure Communication Channels:
- Use encrypted messaging and email services when sharing sensitive information.
- Avoid discussing private matters in public or unsecured environments.
- Review Privacy Policies:
- Familiarize yourself with the privacy policies of platforms and services you use.
- Understand how your data is collected, used, and shared.
- Practice Good Data Hygiene:
- Regularly review and delete unnecessary personal data.
- Shred physical documents containing sensitive information before disposal.
- Be Aware of Phishing and Scams:
- Stay vigilant for suspicious emails or messages asking for personal information.
- Verify the sender’s identity before clicking links or providing data.
- Utilize Privacy Settings:
- Adjust privacy settings on social media and online accounts to control who can see your information.
- Regularly review and update these settings.
- Report Data Breaches:
- If you suspect a data breach, report it immediately to infosec@hawaii.edu.
Data Privacy Resources
- How to take control of what data you share: https://staysafeonline.org/resources/how-to-be-an-online-privacy-snob/
- Managing your privacy settings: https://staysafeonline.org/resources/manage-your-privacy-settings/
What is Data Protection?
Data protection focuses on the security measures to ensure data remains safe from breaches, loss, or unauthorized access.
Data Protection Tips You Should Know
- Data Classification:
- Know what type of data you store.
- https://datagov.intranet.hawaii.edu/institutional-data-classification-levels/
- Security Measures:
- Apply Minimum Security Standards to the highest data classification for the data you work with.
- https://www.hawaii.edu/infosec/minimum-standards/
- Educate your users to implement personal security:
- Your infrastructure is only as secure as the people using it!
- https://www.hawaii.edu/infosec/resources-tips/personal-security-checklist/
- Create Data Backup Procedures:
- Regularly backup important data and store backups securely, ideally offline or in the cloud.
- Test backup restoration processes to ensure data can be recovered when needed.
- Regularly Update Software:
- Keep operating systems, applications, and antivirus software updated to protect against vulnerabilities.
- Enable automatic updates where possible to ensure timely patching.
- Limit Data Retention:
- Regularly review and securely delete data that is no longer needed.
Week 3 – Phishing and Scams
What is Phishing?
Phishing is a cyber attack where attackers pose as legitimate entities—such as banks, colleagues, or even your boss—to trick you into revealing sensitive information like passwords, financial details, or personal data. These scams are often sent via email but can also occur through text messages or phone calls.
Types of Phishing Scams:
- Email Phishing:
- This is the most common form of phishing! Attackers send fraudulent emails that appear to come from trusted sources, such as well-known companies or familiar contacts, asking you to click a malicious link or download a harmful attachment.
- Spear Phishing:
- A more targeted form of phishing, spear phishing focuses on a specific individual or organization. Attackers personalize their messages, making them seem even more convincing and harder to detect.
- Smishing (SMS Phishing):
- Attackers use text messages to deliver fraudulent links or requests for personal information. These texts often create a sense of urgency, such as claiming there’s a problem with your bank account or a delivery, prompting you to act quickly.
- Vishing (Voice Phishing):
- Voice phishing involves defrauding people over the phone, enticing them to divulge sensitive information by sounding frantic and pushing their targets to act without thinking. This can often be attackers posing as banks, government agencies, help desk support to gain your trust.
How to Recognize Phishing Attempts
Knowing the signs of phishing is the first step in protecting yourself. Always remember to S.E.A.R the Phish to help keep our community safe.
STOP – Don’t panic and don’t be too quick to click on email links even if the message looks urgent and threatening.
EXAMINE – Look at the email closely. Does the message look suspicious, does the link look unusual, does the request make sense?
- Check the Sender’s Email Address:
Phishing emails often come from addresses that look similar to a legitimate one but contain small variations (e.g., “admin@hawai.co” instead of “admin@hawaii.edu”). - Look for Suspicious Links:
Hover over any links in the email to see where they actually lead. Be cautious if the URL looks strange or doesn’t match the company’s official website. - Poor Grammar and Spelling Mistakes:
Many phishing emails contain spelling errors, awkward phrasing, or grammatical mistakes that reputable organizations would not typically make. AI has made grammar mistakes less common, but it is still a common sign. - Urgent or Threatening Language:
Phishers often try to create a sense of urgency by telling you to “act immediately” or face consequences, such as account suspension or fines. The University will NEVER ask for your username, password, or DUO code through text, calls OR google forms. - Alternative communications:
Emails asking you to text, call, video chat, or use a different email address to correspond to them should always raise suspicions.
ASK – Even if it’s from a hawaii.edu you should always ask! Emails coming from hawaii.edu can be a compromised user, if you receive an email telling you to send information to a non-hawaii.edu, report it immediately.
- Question the sender (if you know him/her personally).
- Check with the ITS Help Desk (help@hawaii.edu) to determine if the email is legitimate or not.
REPORT – Notify ITS if you receive any UH-related phishing emails by forwarding it to phishing@hawaii.edu. Learn how to report a suspicious email at https://www.hawaii.edu/askus/898
How to Avoid Phishing Scams
Here are some practical steps to help you avoid falling victim to phishing:
- Never Click on Links or Download Attachments from Unknown Sources:
- If something looks suspicious, don’t click! Verify the sender or contact the organization directly through official channels before taking action.
- Use Multi-Factor Authentication (MFA):
- MFA adds an extra layer of security, even if you accidentally reveal your password. Remember to change your password should this happen and never approve MFA requests that do not line up to your logins!
- Keep Software and Systems Updated:
- Regularly update your operating system, browsers, and security software to protect against the latest threats.
- Watch for Phishing on Mobile Devices:
- Phishing is not just an email problem. Be vigilant about SMS phishing (smishing) and avoid clicking on suspicious links in text messages.
- Think Before You Act:
- If you receive an unexpected request for personal or financial information, stop and think. Always verify before responding, and if you receive vishing ask to call back and verify the phone number.
Types of Scams at UH:
For examples of job scams and more phishing resources, see the links below:
Week 4: Software Updating
Week 4: Update & Defend: Secure Your Digital Space!
For the final week of Cybersecurity Awareness Month we will focus on Device Security and the critical importance of keeping your software and hardware up to date. Remember, your devices not only store your digital footprint but also contain a wealth of sensitive information related to both your personal and professional life. Securing your devices is crucial for safeguarding your data and privacy.
Why are updates so important?
Keeping your software and hardware up to date is important for patching security vulnerabilities, fixing bugs, improving performance, and enhancing functionality. If you delay patching, daily activities like browsing the web can lead to infections. Compromised web pages can check for outdated browsers and redirect you to malicious pages to exploit the device or download malware. Enabling automatic updates is a good way to keep your device secure, but it also requires you to restart your applications or machine to apply the patches.