A huge portion of information security issues start with fraudluent/malicious emails. The cyber criminals sending these messages hope to trick people into one of the following activities:
- Opening an attachment that contains malicious software (viruses, worms, trojans, etc.)
- Clicking on a link that brings you to a malicious website. Once brought to the malicious website, you may be hit by a drive-by attack (where you can be infected just by visiting a malicious site) or may be tricked into giving out sensitive information (most commonly your username and password).
Though there are technological defenses in place (at the computer and network level on-campus) they cannot protect against all attacks. How can you protect yourself? This is a short guide to help you recognize these threats and protect not only your data - but the sensitive data you are entrusted to if you are a faculty or staff member.
Before clicking opening an email attachment
EVERY time you before you open an attachment you should be doing these things. Don't open attachments by rote without thinking of these items below:
- Ask yourself - do you know the sender? If not - you should definitely not be opening the attachment.
- If you do know the sender - are you expecting something from them? Even if you recognize the sender, the sender's name and/or address could be spoofed (faked to make it look like someone you know), or the sender's own email account could be compromised by criminals.
- When in doubt - contact the Service Desk if you are unsure of the authenticity of the message.
After opening an email attachment
So assuming you do open attachment - even if it is malicious all is not necessarily lost.
If you open a Microsoft Office attachment - you'll usually be notified that you are viewing the message in PROTECTED VIEW - this is a layer of protection that helps defend against some kinds of malicious attachments. Don't click the "Enable Editing" button unless you absolutely have to edit the document.
Be cautious of instructions to "Enable Editing" mode
Be extra suspicious if the document you open explicitly asks you to click Enable Editing. This is a common tactic used in malicious attachments to trick people into clicking the Enable Editing button. An example of this is below:
Caption: Image from My Online Security
Be suspicious of links within attachments
Often criminals will try to hide links to malicious sites within attachments. Be just as cautious about clicking links in attachments as you are about links in emails. A particularly ommon example is one in the image below. You open an attachment and the attachment itself has a link to "View" the file.
