Skip to content

Author: waseemz

Published on

Written by Patrick Hansen

Grinch Taking Money Image


Keeping an eye out for scams is a year-round job for anyone who uses the internet. But for scammers, the holiday season is the time to strike, while everyone is distracted by time off, gifts, and plans with family. From fake websites, gift cards, to even fake charities, it is important to stay on guard during the last part of the year.

Holiday Phishing

(If you need a refresher on phishing read this piece.)

Criminals love the amount of shopping and shipping that goes on during the last quarter of the year. They pretend to be Amazon, UPS, FedEx, Apple, and almost every other household brand name there is. A lot of phishing attacks come by email, declaring a problem with your order, shipping, payment, etc. In the past few years, SMS phishing has also shot up with intent just as malicious. Always remember, the real companies you interact with, won’t email or text you asking for personal information, and DON’T CLICK LINKS. If you are ever unsure about an email or text, look up the number for customer support and call.

Gift Cards

A gift card is a very sought after item for criminals because of the anonymous nature of purchases once it is gifted. Once it’s gone, it’s gone, and you won’t be able to get it back. Online, criminals will always try to get you to pay for a gift card and send them the information. Another thing to look out for is gift cards that have been tampered with. When buying a gift card from the store, make sure that the credit card number on the gift card is still covered. Criminals have ways to monitor when the card with that specific serial number is loaded with money so they can try to spend it before you can.

Fake This, Fake That

Online shopping can be extremely convenient, but there are things to watch out for. Some scammers will put up websites and buy domains that look very similar to real brand websites in appearance and URL. Always try to verify the website you are on in some way. If you are ever paying for something online, the “s” in “https” is a must. Sadly criminals will also set up fake charities designed to pull at your heartstrings. A quick Google search of the charity should provide enough information and others to verify it is real.

The holiday season is prime time for cyber thieves to attempt scams and steal your money and information. Always remember to double-check the random Amazon email, the random UPS text, gift cards, and everything else that is common for this time of year. Never give out your information and if there is any doubt, just contact the company itself. It is important to be aware of these attacks and be on guard year-round, but especially around the holidays, so you can enjoy them with cheer.

Published on

Holiday Shopping Image

15 Tips for Online Safe Shopping

Written by Kim Porter for NortonLifeLock

Online shopping is easy to love. What’s more fun than finding what you need and—after a few clicks and a short wait—having it show up at your door

Except when it doesn’t. In 2016, the FBI’s Internet Crime Complaint Center received nearly 300,000 online-theft complaints, and victims lost a total of $1.3 billion. It’s safe to say fake companies and identity thieves can turn the joy of buying into a hassle.

What to do? Don’t click that buy button until you check out these tips to help you do safe online shopping.

  1. Shop where you trust

Shopping IRL (in real life) offers this advantage: You’ll usually know the business and the inventory exist. But on the web, some businesses are fabricated by people who just want your credit card information and other personal details. Consider doing online business only with retailers you trust and have shopped with before.

  1. Size up the business

Break out your detective skills when you want to buy something from a new merchant. Does the company interact with a social media following? What do its customer reviews say? Does it have a history of scam reports or complaints at the Better Business Bureau? Take it one step further by contacting the business. If there’s no email address, phone number or address for a brick-and-mortar location, that could be a red flag that it’s a fake company.

  1. Beware rock-bottom prices

If a website offers something that looks too good to be true—like rock-bottom prices or an endless supply of free smartphones—then it probably is. Use similar websites to compare prices and pictures of the merchandise. Perpetually low prices could be a red flag that the business doesn’t have those items in stock. The website may exist only to get your personal information.

  1. Avoid public Wi-Fi

Wi-Fi networks use public airwaves. With a little tech know-how and the freely available Wi-Fi password at your favorite coffee shop, someone can intercept what you’re looking at on the web. That can include emails, browsing history or passwords. Shopping online usually means giving out information that an identity thief would love to grab, including your name and credit card information. Bottom line: It’s never a good idea to shop online or log in to any website while you’re connected to public Wi-Fi.

  1. Use a VPN

If you must shop online on public Wi-Fi, use a VPN (virtual private network). A VPN creates an encrypted connection between your computer and the VPN server. Think of it as a tunnel your Internet traffic goes through while you browse the web. Hackers lurking nearby can’t intercept it, even if they have the password for the Wi-Fi network you’re using. A VPN means you’ll likely have a safe way to shop online while you’re on public Wi-Fi.

  1. Use a strong password

If someone has the password to your account, they can log in, change the shipping address, and order things while you get stuck with the bill. Help keep your account safe by locking it with a strong password. Here are some tips on how:

  • Use a complex set of lowercase and uppercase numbers, letters, and symbols.
  • Avoid words that come from a dictionary.
  • Don’t use personal information that others can find or guess, such as birthdates, your kids’ names or your favorite color.
  • And don’t use the same password—however strong—on multiple accounts. A data breach at one company could give criminals access to your other, shared-password accounts.
  1. Check out the webpage security

You’ve probably seen that small lock icon in the corner of your URL field. That lock signals you that the web page you’re on has privacy protection installed. It’s called a “secure sockets layer.” Plus, the URL will start with “https,” for “hyper text transfer protocol secure.” These websites mask and transfer data you share, typically on pages that ask for passwords or financial info. If you don’t see that lock or the “s” after “http,” then the webpage isn’t secure. Because there is no privacy protection attached to these pages, we suggest you exercise caution before providing your credit card information over these sites.

  1. Watch out for email scams

Sometimes something in your email in-box can stir your consumer cravings. For instance, it might be tempting to open an email that promises a “special offer.” But that offer could be special in a bad way. Clicking on emails from unknown senders and unrecognizable sellers could infect your computer with viruses and malware. It’s better to play it safe. Delete them, don’t click on any links, and don’t open any attachments from individuals or businesses you are unfamiliar with.

  1. Don’t give out more information than you need to

Here’s a rule of thumb: No shopping website will ever need your Social Security number. If you’re asked for very personal details, call the customer service line and ask whether you can supply some other identifying information. Or just walk away.

  1. Pay with a credit card

When using a credit card, you’ll usually get the best liability protection—online and offline. Here’s why.

If someone racks up unauthorized charges on your credit card, federal regulations say you won’t have to pay while the card company investigates. Most major credit cards offer $0 liability for fraudulent purchases.

Meanwhile, your liability for unauthorized charges on your debit card is capped at $50, if you report it within two business days. But if someone uses your account and you don't report the theft, after 60 days you may not be reimbursed at all.

  1. Try a virtual credit card

Some banks offer nifty tools that act like an online version of your card: a virtual credit card. The issuer will randomly generate a number that’s linked to your account, and you can use it anywhere online and choose when the number expires. It might be best to generate a new number every time you buy something online, or when you shop with a new retailer. Anyone who tries to use that number will be out of luck.

  1. Check your statements regularly

Check your statements for fraudulent charges at least once a week, or set up account alerts. When you receive a text or email about a charge, you can check the message and likely easily recall whether you made the charge.

  1. Mind the details

After you make the purchase, keep these items in a safe place: the receipt, order confirmation number and postal tracking number. If you have a problem with the order, this information will help the merchant resolve the problem.

  1. Take action if you don’t get your stuff

Call the merchant and provide the details noted in Tip 13. If the merchant turns out to be fake, or they’re just plain unhelpful, then your credit card provider can help you sort out the problem. Often, they can remove the charge from your statement.

  1. Report the company

If you suspect the business is bogus, notify your credit card company about the charge and close your account. File a complaint with the U.S. Federal Trade Commission. Tip: The FTC offers an identity theft recovery plan, should you need it.

 

Published on

Logo for National Cybersecurity Awareness MonthNational Cybersecurity Awareness Month (NCSAM) is a month that helps raise awareness and highlight the importance of cybersecurity. Cybersecurity and Information Security overlaps with almost everything we do and every technology we use. NCSAM was started in 2004 by the National Cyber Security Alliance (NCSA) and the Department of Homeland Security (DHS). The creation of NCSAM was to help Americans be secure online. The month raises awareness for security and emphasizes both companies and individuals on how to protect themselves.

Over the years, NCSA and the DHS have put on joint events around many states for NCSAM. In the past events with panels of information security professionals have been done as well as talks and presentations. They have even done some summits around the states and webinars for all to join. This year they have panels, and presentations all around the country, including Washington, D.C. These events have had growing popularity each year and have had some high ranking and nationally recognized officials make appearances at these events.

Each year there are different themes. The themes are meant to emphasize a particular change in behavior that would help everyone be safer online. This year the theme is, “Own It, Secure It, Protect It”. The goal for this year's theme is to draw attention to careers in information security and to encourage accountability. Each week of the month will focus on a different area of the theme. The “own it” part of the theme is to have people take ownership of their data. Most people don’t realize how much private information is going out on the web. “Secure it”, is for having strong passphrases and avoiding scams and phishing. “Protect it” is being proactive with your information after it is out there. Being active in knowing where and who has your data, and how to keep it protected.

Here at GWU, we are involved with NCSAM by spreading awareness through the university and by hosting our own events. We have events like meet and greets with the Information Security team, Cybersecurity Jeopardy, webinars, and presentations throughout the month of October. If you want to attend any events or have a chance at winning some of our excellent prizes this year, check out the event calendar here, http://go.gwu.edu/ncsam2019.

Published on

Security is in your hands image

95%  of all successful cyberattacks start with human error according to the IBM Cybersecurity Intelligence Index. That would make it pretty important to periodically evaluate and increase your own awareness of Information Security hygiene and awareness. 

Information security is one of the fastest-changing fields in the world. New technologies emerge every day that change the way people attack and defend systems and networks. While professionals in information security are required to be in a constant state of learning to keep up with the field as a whole, those without day to day dealings tend to be the primary targets and the least informed. Being aware and informed enables everyone to protect themselves. Staying informed is simple, there are a wide range of awareness organizations and individuals dedicated to reaching outside of the information security community and enabling everyday users to secure themselves, their data, and thereby their organizations. 

 

Awareness Companies

Security awareness training should be a high priority for any organization. To facilitate effective awareness training, a number of companies focus on providing awareness training as a professional service, often using computer based training. Companies such as Habitu8, SANS, KnowBe4, and Security Ninja focus on providing awareness training packages to organizations who want to inform and educate their employees. These packages are frequently integrated into something called a learning management system (LMS). An LMS is something like Blackboard. Other free resources are also available and essential to reaching people both inside and outside the Information Security community. Free websites often feature webinars, talks, and videos. You can ask your organization or awareness training coordinator what resources are available to educate yourself. (At GW, you can email infosec@gwu.edu for more resources or to request training for your student organization or department.)

Free training resources
Reading and news: https://www.sans.org/security-resources/
Test your knowledge and learn: https://www.khanacademy.org/partner-content/nova/cybersecurity/cyber/e/cybersecurity-101-quiz

 

On the Web

While organized and mandatory awareness training can be effective, it isn’t the only way to reduce risk and stay up to date on cybersecurity. There are an abundance of websites, blogs, and other informational pages freely available to all. Cybersecurity is often in the news as well, it is worth noting that it comes up more and more often. 

One website run by Troy Hunt, Have I Been Pwned not only allows users to check if their email has been associated with a data breach, but also stay up to date on data breaches happening around the world. Hunt’s website provides information on hundreds of breaches that may impact you or your family and can often provide the early warning you need to change your passwords before your accounts are stolen. In addition to providing a breach checking service, the site also offers a way for users to check their password against the ever growing list of compromised passwords that Hunt maintains, and if you are unsure of how to choose a secure password look no further than the same page for guidance.

Credit monitoring services like Credit Karma and Equifax also offer services the track your exposure to identity fraud or a credit data breach.

Many information security websites can be so technical that they drive less informed readers away, but don’t let that discourage you. Brian Krebs an investigative journalist runs a site called Krebs on Security where he writes about the most recent information security news. Krebs provides in depth coverage of ongoing stories that far surpass traditional news media coverage. He achieves this without alienating less technical readers with overly complicated and technical language and articles. Krebs on Security provides a good way for the average user to stay up to date on relevant topics in the information security space.

As social media has gained popularity, more and more professionals are turning towards it to keep informed and spread their message. It may come as a surprise to some that there is a large information security community on twitter, but it is one of the best places to keep up with the latest in security news. While some may think that only information security professionals should be following each other on twitter, everyone can benefit from the discussions, news, and events that are posted all over the #infosec twitter space. Users will frequently post links to free webinars, blogs, and conferences covering a wide range of topics that would help even the least technical user remain aware and informed. Big names on twitter such as Jake Williams (@MalwareJake), Brian Krebs (@briankrebs), Troy Hunt (@troyhunt), and Lesley Carhart (@hacks4pancakes) provide a constant stream of information security news, issues, and tips to benefit everyone. Organizational Twitter accounts like the National Cyber Alliance (@StaySafeOnline) and SANS Internet Storm Center (@sans_isc) also provide comprehensive and consistent updates to the cybersecurity student and professional. Don’t be afraid to use less traditional methods such as Twitter and social media to educate and protect yourself.

Published on

Information Security Photo Collage

People have a lot of pre-conceived notions about security teams and practices. While some misconceptions may be grounded in truth and others fairly outlandish, there is a lot going on behind the scenes that users may not see. From claims that we are all hackers wearing hoodies and doing nefarious deeds to the perception that we are here to get in your way, we will help you understand what is true, what is not, and why these perceptions might exist.

Myth #1: Security is just here to say no

Being at a university presents the unique challenge of providing the tools and technology necessary for students and faculty to research, learn, and achieve their goals. We must strike a difficult balance between the availability of those resources and the security of the university and our community. As security professionals, we do everything we can to enable safe and reliable access to the tools that the GW community needs to reach their goals. We are here to facilitate a safe IT environment in which all students, faculty, and staff can access the resources that they need, sometimes it sounds like, “no”, but what we are really requesting is modifications that reduce risk of exposure or breaches at GW.

Myth #2: Security only deals with technology

Many people believe that IT security only works on securing servers, reading logs, and other highly technical tasks. On the contrary, the security team has a wide range of responsibilities of which technology is only a part. The security team is continuously engaging with people and data in a multitude of ways. Often trying to help people protect themselves and the organization through a security awareness program or working directly with other teams to enhance security within their operations. They are constantly trying to improve way to protect the GW community’s data by updating policies, implementing best practices, and assessing security processes.

Myth #3: The security team is just a bunch of hackers

Just as many people think that the security team is nothing but hackers. This is far from the truth. Information security is a wide field with many specializations and it takes all sorts to be effective. While some members of the team might be highly technical penetration testers, their counterparts are security professionals focused on defensive security and protecting the GW network and assets from outside threats. Not to mention that members of the IT Security team range from awareness professionals working with people and outreach to analysts focused on identifying and reducing risk.

Myth #4: The security team takes care of security so I don’t have to

The security team works tirelessly to ensure that the GW community, information, and assets are as well protected as possible, but the team is not always the first line of defense. Security is your responsibility too. Our community is often the first line of defense when it comes to attacks from outside GW. Social engineering (aka tricking people and deceiving them) is a common tactic employed by attackers and encompasses phishing, piggy backing, and taking advantage of users in the workplace. All of this means that you, the user, needs to play a vital role in protecting the university, or, as we call it #SecuringGW. Protecting your own information is an essential puzzle piece to overall security of GW.  Catching phishing emails and forwarding them to abuse at GW may seem like a small task, but it is small actions like this that alert the team and protect GW from large breaches. Being aware of people trying to enter buildings where they don’t belong, and maintaining a clean desk free of sensitive materials are all security measures that you can take to do your part in #SecuringGW.

Fact: GW Information Security – Your Trusted Advisor

The information security team strives to facilitate access to the resources that the GW Community needs in as secure a manner as possible. Security affects everyone; data loss, lack of availability, and compromised systems impede day to day business functions, which means it affects the day to day lives of everyone on campus. In order to help prevent this, the security team acts as a Trusted Advisor to everyone in the GW Community. Whether you want to implement a new system, service, or application, or begin a new project, involving the GW security team as Trusted Advisors from the start enables us to aid in proper project oversight and completion while maintaining and promoting the confidentiality, integrity, and availability of GW’s data, systems, and services.

 

Published on

Learn Social Engineering
OZKAYA, E. (2018). LEARN SOCIAL ENGINEERING

 

Previously, we discussed Social Engineering in the form of Phishing, a typically untargeted attack type that focuses on quantity over quality. However, not all Social Engineering attacks cast a large net, some get up close and personal. Attacks that involve pretexting are typically more focused and can be well planned and highly targeted; making them a credible threat to information security at any company.

Whether used in person or through other means of communication, pretexting is a dangerous method used by attackers to worm their way into systems and financial profit. Pretexting can be relatively simple and recycled constantly, but can also be well thought out, researched, and specifically tailored to each target. Ultimately, pretexting involves an attacker impersonating someone or having a “legitimate” reason to gain access where they do not belong.  Pretexting relies heavily on an attacker having convincing and effective aliases, stories, identities, and credibility.

The research conducted to carry out a pretexting attack is typically all open source. They might scour an organization’s web pages to understand the size, structure, and relationships, or they might look for company login portals such as HR sites, mail hosting, and VPN portals. Often times, attackers will try to find information on specific employees like email addresses, position within the company, and any other information that can be used to impersonate or manipulate them. Gathering all of this information about an organization helps attackers in understanding how the business operates and what type of attacks might work. If the target is a large company with thousands of employees then an attempt to impersonate someone is more likely to be successful than if the target is a small close knit business that would easily recognize an imposter.

Thorough research enables attacker to determine the best methods to gain unquestioned access to money transfers, systems, and other restricted areas. A tactic that attackers frequently use is to impersonate a target’s boss, an executive, or other important figure, and then urgently request money transfers to specified accounts. The hope is that the targeted individual will panic due to the urgency and fail to verify the transaction with anyone else. Other attack types include impersonating vendors, internal departments, or other entities who might have an already established relationship with the organization. The attacker may try to call the victim and using their false identity and back story, then get them to visit a fake company login page and input their credentials. With those credentials, attackers can now access potentially sensitive systems and data.

Whether a Social Engineer uses a relatively general pretext, or a highly targeted and well planned one, users should be aware of and able to prevent the danger that they pose. Preventing these kinds of attacks is not necessarily difficult, it just takes a bit of time and diligence. If someone asks you to complete a wire transfer, take the time to confirm that they are the ones that sent the email or made the phone call. Reach out with another form of communication to verify. Always confirm any backstory that is offered to you, if you have been asked to log into a portal to accept new compliance documents or policies, contact your compliance office to double check. If someone visits the office and claims to work for a maintenance company but they aren’t on your schedule, call the corporate office and verify that their employee is supposed to be there. Confirm package deliveries from delivery people you have never seen before. Be highly suspicious of anyone who contacts you and asks for login credentials, personal information, or financial details over the phone or through email. Always be wary of strangers trying to access systems, data, and even your office building. Take the time to protect yourself and your organization from attackers who try to manipulate you with convincing and well thought out back-stories and personas.

-

Kennedy, D. (2014, March 05). Pretexting Like a Boss. Retrieved June 20, 2019, from https://www.trustedsec.com/2014/03/pretexting-like-boss/

Nadeem, M. (2019, April 17). Pretexting: Definition and examples | Social engineering. Retrieved June 20, 2019, from https://blog.mailfence.com/pretexting/

Published on

Phishing diagram
From Wombat Security

Phishing

Phishing is a very simple and useful tool in an attacker’s arsenal. Phishing can lead to the exposure of sensitive information such as usernames, passwords, PII (personally identifiable information), and credit card information. So what is Phishing? It is at method used to obtain sensitive information from a victim that leverages social engineering and communications technologies that normal people use every day. There are various methods of phishing, with the most common being email, vishing (voice phishing), and smshing (text phishing). These methods can be blanket attempts that rely on quantity instead of quality (often called campaigns) or they can be very carefully crafted attacks with very specific targets (spear phishing and whaling). Luckily, identifying and defeating these attacks can be simple if you know what to look out for.

Email Phishing

Email is the hacker’s go-to for most phishing attacks; people wouldn’t think twice about receiving an email. Often times phishing emails will contain a malicious link, a malware attachment, or directly ask for sensitive information. In order to trick victims, these emails are crafted to appear from a big company, such as FedEx, Apple, or even from inside your own organization. Attackers use look-a-like or spoof emails to convince the target the email is legitimate. This can lead to compromised systems and/or exposed personal information, which can lead to further exposure of friends, family, and the victim’s organization.

Defeating Email Phishing:

  • Is the company logo/banner/design slightly off?
  • Would this person/company normally be sending you an email?
  • Should they already have the information they are asking for?
  • Never open unsolicited attachments
  • Legitimate Companies should never ask sensitive information through email
  • Use other methods to confirm the communication

Vishing

Voice phishing is growing in popularity and just like other types of phishing, vishing can be automated making it a dangerous tool. Attack examples include an “FBI” automated message, “IRS” tax refund/payment notification, or as a call from your local home improvement company. When attackers get on the line with their target they present a well thought out and engaging backstory to hook their victims. Impersonation is used in most vishing calls; attackers will impersonate IT staff, management in your company, and HR to appear official.

Defeating Vishing:

  • Ask the caller to provide information only you and they would know to ensure the caller’s identity
  • Never give sensitive information over the phone
  • If the call is suspicious, contact someone close to the individual, or through other means
  • Offer to call the individual back at the number in your staff/corporate directory, or at the number listed on the legitimate website

       

Smshing

Smishing sends texts to the targets phone in hopes of them clicking a malicious link, downloading malware, or returning sensitive information. Texts follow email phishing outlines and can be identified similarly. Many victims fall for smishing because they are unaware of the tactic and more trusting of texts. Don’t trust it more just because it’s a text message.

Defeating Smshing

  • Never provide sensitive information over text message
  • Avoid following random links
  • If you are unsure, reach out to your security team, or the communicating company
  • Do not call the number that texted you

Spear-phishing, Whaling & Campaigns

Most individuals come into contact with phishing campaigns. The goal of campaigns are to reach as many people as possible and hope for a hit. Whereas, spear phishing and whaling are techniques aimed at selected groups of individuals and executives. These are well planned, crafted, and executed, and shouldn’t be taken lightly. They aim to compromise victims with privileged access to systems, accounts, and resources. Victims typically don’t have the time to review these carefully crafted emails highly specific to the target and fall for the trap.

Defeating Spear-phishing and Whaling

  • Report suspicious emails looking for information to security
  • Verify communication with the contact through other methods
  • Attackers often impersonate colleagues, friends, and family
  • Always assume you’re a target
  • Opt for face to face meetings when possible (online or in person)

Published on
What is Social Engineering?

We frequently hear about cyber-attacks on organizations using highly technical and sophisticated methods, involving malware and vulnerabilities that most people don’t understand. However, what we don’t typically hear about is how the attacker got in. According to Verizon’s Data Breach Investigation Report, in 2019, a third of all data breaches involved social engineering attacks to include phishing, pretexting, and a variety of other social engineering methods.

Social Engineering involves gaining the trust of unsuspecting users via manipulation or trickery, in order to gain unauthorized system access, credentials, or commit fraud. Attackers will attempt to take advantage of a multitude of psychological traits such as carelessness, curiosity, empathy, complacency, and most frequently ignorance.

Why does it Matter?

Social Engineering attacks are more common than you might think and odds are that you will encounter one yourself in some form or another. Failing to recognize a social engineering attack could range from a minor inconvenience to a life changing event. Compromise from such an attack could lead to needing a password reset to having a bank account drained of funds, or could even be the launching point for the next massive data breach that makes headlines worldwide.

The massive Target data breach of 2013, which exposed the credit card and personal information of 110 million people, was a result of a contractor falling for a phishing email, one of the many social engineering methods attackers use. The DNC email leak in 2016 was caused by a well-crafted but fake password reset request from Google; sent to a high ranking DNC official and resulting in the leak of highly sensitive information regarding the Democratic campaign.

Social Engineering is a large threat to the safety of not just large organizations, but also the individual.

Social Engineering Life Cycle Image

Social Engineering Life Cycle

Much like software development and risk management, many cyber-attacks follow a lifecycle approach; with a continuing cycle of input and output constantly improving the process. Social engineering is no different and even has a few lifecycle models dedicated to it. In its simplest form however, the Social engineering lifecycle follows four basic phases: Investigation, Hook, Play, and Exit.

The Investigation phase is when an attacker performs their recon. They might choose their targets based on position within an organization, ease of access, or they might choose a wide range of targets just to see what sticks. After choosing a target they will use public information to learn as much as possible. Sources such as social media, company websites, and other profiles provide a wealth of information for attackers to use.

The Hook phase involves the initial interaction with the target; ranging from email to in person contact. During the hook, the attackers focus is on spinning a web of lies to manipulate victims at their will.

During the Play phase an attacker gains a stronger foothold and carries out the attack. Depending on their goals, they will begin disrupting or stealing sensitive and valuable data.

The Exit phase points to the end of the lifecycle. The Social Engineer will attempt to remove all traces of their presence and bring an end to their charade. Everything the attacker has gained or learned during the process is then used during a new attack cycle to more effectively con another victim.

Social Engineering and unaware users provide a vast attack surface that can be easily taken advantage of.  Meaning that you need to do everything you can to be prepared for and protect yourself from the conmen of the internet age.

Published on

GW Box is the university's enterprise file sharing service for online cloud storage and collaboration. GW also uses Gmail for email service, as such, the community has access to Google Drive as a cloud storage solution as well. Sharing and collaborating is essential to every work and study environment in the 21st century. Whether it’s for class projects or work projects, cloud storage and sharing solutions have changed and simplified how we do things. But, there are practices we should implement and guidelines we should follow in order to use the cloud responsibly. Below are the recommended Best Practices by GW IT and GW Information Security.

 

Security Best Practices Document

 

Published on

Social media trends are not only fun, but they also include a hint of FOMO if we don’t participate. The same can be said for the newest viral trend of “how hard did aging hit me” challenge, also know as the “10 year challenge.” There have been speculations on the origin and purpose of this trend across the internet, even in the information security Twitter community.

Kate o'Neill Tweet Image

Kate O’Neill’s tweet is a perfect example of a growing distrust the public has of social media and the internet in general after the introduction of many AI technologies, whether they be related to ad content or predictive text.

This affects the GW community at every level; students, staff members, and faculty members alike partake in social media sharing. There is nothing that confirms that O’Neill’s tweet has truth to it. However, our goal is to highlight the need of users to be smart and to be safe online. Always be vigilant of what you post and how much detail you give out, especially when it comes to location sharing. Criminals are becoming increasingly more knowledgable about how to use technology to their advantage, as are large corporations like Facebook where we live our daily lives. The younger the clientele, the more common it is for them to live their life in the digital world. Be #securityaware.

Skeptics can agree that this trend and some others can be seen as data mining or data harvesting parading as a harmless social game. Realistically speaking, information security professionals know that technology has become so mobile that it goes where we go. So, our message to you is be mobile, but be mindful. Stay mindful of what you share and how much you share. It may sound like an older generation reprimanding you, but it is true, everything you do does not have to be a social media post.

Let us know in the comments below if you make it a habit to consider what details you post on social media or if you have generally seen it as harmless fun.

#bemobile #bemindful #securityaware

 

Viewing Message: 1 of 1.
 Notice

This site uses cookies to offer you a better browsing experience. Visit GW’s Website Privacy Notice to learn more about how GW uses cookies.