Category: Build a Resilient Cybersecurity Environment

Why You Should Delete Old Apps and Files

Posted on

We store everything in our phones–saved media, files, and data stored inside apps. While this makes it convenient to document our life on social media or quickly retrieve a class file, it can also slow down your iPhone or Android device.

Even worse: A phone with tons of data and images stored on it is the holy grail for cybercriminals, who can hack into it and ransom your photos and personal information (like credit card numbers stored in an app) back to you. They can steal your identity and go shopping with your credit card or PayPal balance. They can decide to sell your data on the dark web. Whatever they do will severely disrupt your life. In addition to making sure you
use a strong password on your phone, it’s a good idea to delete any apps from your phone that are obsolete for your life now.

Your device will also run faster if unused apps and files are deleted. Most phones will list when you last visited each app. Did you download an app for a class or for a trip taken last year? If you don’t need it, delete it! Also, relocate content from your phone to an external storage service. Did you know that faculty, students, and staff get 5TB of OneDrive storage? Take advantage of this highly secure free cloud service today! Contact the UFIT Help Desk if you need assistance using OneDrive.

Restricted Data: Retention and Destruction

Posted on

Restricted data is subject to retention and destruction standards imposed
by federal and state laws, regulatory mandates, and campus policies.
The UF data retention schedule is available on the Smathers Library site.

As important as it is for faculty and staff to know data retention standards, it’s equally important to know how to properly discard restricted data. Different media requires different destruction methods. For example, just throwing away paper records or deleting restricted data from a PC or other device does not meet university requirements. Paper records, CDs, and DVDs with restricted data cannot be reused and should be cross-cut shredded or incinerated. The sanitization and destruction standards policy should be mandatory reading for anyone in the UF community prior to working with or handling restricted data.

UF Property Surplus provides campus with secure media disposal services. They have two drop-off locations, at Building 811 off of Elmore Drive and at the UFIT Help Desk in the Hub. Faculty and staff who have questions about working with or properly disposing of restricted data are welcome to email UF’s Information Security Office.

Protecting Your Smartphone

Posted on

Mobile malware is malicious software that targets mobile devices. Widespread ownership and constant daily usage of smartphones make them an ideal target for cybercriminals trying to steal personal information, money, or gain control of a device. Zimperium’s 2023 Global Mobile Threat Report notes a 53% increase in malware affecting cellphones in 2022.

Vulnerabilities in the operating system and activities such as rooting or jailbreaking are the most common means for getting a malware infection. Never jailbreak or root your phone, because the device’s built-in security controls will be disabled. And do not download third-party apps from outside official Apple and Android stores because they are not vetted for malicious content.

Stay cyber-aware, Gators! Did you know anti-malware software is available for most smartphones? Spend 20 minutes to better protect your phone – along with your money and personal information – by reviewing these webpages:

1. Visit UFIT’s ‘protect my mobile device page’ and learn about enabling encryption, turning on automatic updates, and more.
2. Use the Security Checkup feature in DUO’s mobile app to review your phone’s security settings.

Updated Info Security Training for 2023

Posted on

Just in time for the new academic year! UF’s Information Security Office has updated its mandatory annual training. Faculty and staff will receive an email reminder on their one-year anniversary of their previous training completion date, but can take the training any time. There are six modules in the training and they take approximately 35-45 minutes to complete. Visit this page to take the training.

The number one cause for compromised GatorLink accounts is when a student, faculty, or staff member opens and responds to a phishing email.

Students can take the phishing module that’s part of the full training. The stand-alone phishing module is a great way to become better informed about how cyber-criminals operate. Now that you’ll be interacting with campus departments and faculty (who cyber-criminals will try to impersonate), students are strongly encouraged to learn how phishing works. Students can find the link to the phishing module training in the ONE.UF menu. The 15-20 minutes you invest in taking the phishing training can pay off in a big way when you learn how to spot and report malicious emails, instead of opening one and inadvertently bringing on a world of hurt on yourself…and potentially your university.

Increasing in Higher Ed: Malware Attacks

Posted on

Malware attacks against higher education increased by 26% last year. With a reported 191+ million malware attacks in 2022 in the state of Florida alone, cyber-awareness is as important on college campuses as writing skills and advanced math knowledge. Cybercriminals frequently target universities through malware attacks to steal sensitive and restricted data, such as student and employee social security numbers, protected health information, and credit card information. Malware is malicious software or code that steals, encrypts, and/or deletes sensitive information after being introduced to a device through phishing emails, compromised flash drives, fraudulent websites, and peer-2-peer file sharing sites. According to SonicWall, the 10 most common malware file names are:

1. purchase order.exe
2. soa.exe
3. invoice.exe
4. swift copy.exe
5. quotation.exe
6. img-order-confirmation-pdf.exe
7. payment copy.exe
8. ziraat bankasi swift mesaji.exe
9. shipping documents.exe
10. new order.exe

If you receive what you think is a suspicious email or an email with one of these .exe files attached, do NOT open, reply, or click any embedded links or files. Report suspicious emails received in your GatorMail inbox using the phish alert button. Faculty, students, and staff can become better cyber equipped by taking the free training available through the UF Information Security Office.

How to Properly Dispose of Tech Waste

Posted on

Have you ever wondered what happens to all the outdated tech devices that you throw away? When disposed of incorrectly, the old phones, tablets, laptops, and other gadgets you’ve replaced contribute to a growing problem: tech waste.

The World Health Organization reports 53.6 million tons of tech waste was generated in 2019. By 2030 it is estimated the annual amount will increase to 74.7 million tons! Tech waste can release hazardous chemicals into the environment, causing air, soil, and water pollution. The report also notes these chemicals, such as lead, mercury, and cadmium, can pose a significant risk to human health, including cancer and neurological damage.

There are safe ways to properly dispose of tech waste, such as donating, selling, recycling, or taking electronic devices to specific drop-off locations for e-waste. The City of Gainesville offers free appointments for large-sized electronic item collection. Smaller items can be dropped off at the Alachua County Household Hazardous Waste Collection Center. For campus departments and faculty, students, and staff, UF Property Surplus manages a secure disposal service of electronic media and electronic waste. Contact UF Surplus for service particulars: /https://www.fa.ufl.edu/directives/electronic-media-disposal/.

Let’s work to e-rase our e-waste, Gators!

Safely Use Virtual Payment Apps

Posted on

Scammers use peer-to-peer (P2P) payment apps like Cash App, Zelle, and Venmo to steal money. According to the Pew Research Center, 10% of P2P app users have been scammed. P2P apps allow users to easily send money with a phone tap. But if it’s convenient for you, it’s also convenient for scammers.

Vishing or smishing is often used to initiate P2P scams. For example, a scammer may impersonate a bank representative in a call or text to a victim about a “suspicious transaction” on their Zelle account. The scammer will request the victim’s bank login information to resolve the concern but will use the information to steal money. A bank representative will never ask for your username and password to access your account. Stay cyber-secure by only sending money to people you know, and double-checking you are sending money to the correct name, phone number, and username. Also, you should only use a credit card for transactions with strangers, because credit cards have fraud protection. And Gators, make sure to allow app updates (or install them when they become available on your device) for the latest security enhancements, like multi-factor authentication updates and app safety features.

Learn to protect yourself online by becoming more cyber-aware. Schedule a ½ hour to take the https://security.ufl.edu/resources/training/information-security-training/ today.

Work Safely with Restricted Data

Posted on

Restricted data refers to data collected, maintained, or managed by the university or through any university activities that are restricted by special protections from federal or state laws, regulatory mandates, or contractual obligations. Improperly working with, storing of, or transmitting restricted data could result in the revocation of research certifications, university business partnerships, and federal and state grants. In addition to the legal liabilities and financial obligations placed on individual employees and the university, a breach or misuse of restricted data would negatively impact UF’s reputation.

Types of restricted data are listed here. They include, but are not limited to, student records (FERPA), protected health information (HIPAA), Social Security numbers and credit card information, and export controlled data (ITAR).

All faculty and staff are required to annually complete the Information Security Awareness training, which includes a section on working with restricted data. UF’s Mobile Computing and Storage Devices Policy explains security and encryption standards required for devices operating with restricted data. UFIT’s Integrated Risk Management team is available to help clarify data classifications and the technologies and tools cleared for use with restricted data. Anyone in the UF community with questions is welcome to email irm-uf@ufl.edu.

ChatGPT: Guidelines for Campus Usage

Posted on

Responses provided by the ChatGPT application can save time, but beware: the data you input or ask the app to develop may be retained and provided as responses to other users. ChatGPT users have very limited control over its use of the data provided to the app, and its parent company–OpenAI–does not currently offer a process to amend or delete entries submitted. UF’s Privacy Office and the UF Information Security Office want everyone in the Gator community to understand that putting data into ChatGPT or a similar service is equivalent to disclosing the data to the public.

ChatGPT is currently being assessed for regulatory concerns related to privacy and confidentiality of data. University of Florida data classified as sensitive or restricted is not approved for use with ChatGPT. Sensitive and restricted data includes:

• Social Security Numbers
• Education Records
• Employee Data
• Credit Card Numbers
• Protected Health Information
• Human Subject Research Data
• Unpublished Research Data
• Personally Identifiable Information

An assessment of ChatGPT has been added to the university’s technology solutions website: https://irm.ufl.edu/fast-path-solutions/items/chatgpt.html. Remember that all faculty, staff, and students share the responsibility of keeping UF information secure. Visit the Office of Privacy website for additional information on using ChatGPT.