Skip to content

Category: passwords

Published on

Between all of your online accounts, whether personal or work accounts, you probably have many unique — and complex — passwords to manage.  And since you know better than to write them down in a notebook, have them on sticky notes hidden under your mouse pad, or stored digitally on your desktop, what are you supposed to do? 

Passwords are one of the most vulnerable cyber defenses used to protect our online accounts, as passwords are the only barrier between online accounts and cybercriminals who have a desire to access to our data and systems. Utilizing a password manager is a security best practice that cyber professionals are recommending for us.  

Along with other security tips, password managers minimize the risk of mis-managing our passwords. The question that arises here, are password managers secure, and what is our responsibility here to manage the password manager? 

What is a Password Manager?

A password manager is a software that allows users to generate passwords, store and manage accounts’ information including user names and passwords all in one location. Password managers offer other features such as complex password suggestions, identifying weak or repeated passwords used, and alerting its users from entering their credentials to suspicious websites. To create a password manager account, you need to set a password that is often referred to as the “master” password. 

Password managers are available in different formats: 

  • An online service hosted by a third party and accessed through a website portal. This type is useful if you need access to the password manager from multiple devices. 
  • Software installed locally on a workstation that can operate either completely offline or connected to the internet to synchronize your information to a cloud database and get software updates.  

Are Password Managers Secure? 

Password managers will offer users the security level they are looking for to their accounts’ credentials and information if they follow best practices to secure their password manager account.  Whether you use, or planning to get, an online, or an offline password manager, you need to follow the following practices: 

  • Do your research and get a trusted password manager software that has a high reputation in the industry. 
  • Use a strong master password for your password manager account and never forget it. Some password manager vendors would never retrieve your account if you can’t remember your master password. 
  • Enable two-factor-authentication (2FA) to your password manager account for an extra layer of security.  
  • Keep your password manager software along with web browsers you use up-to-date. 
  • Audit the list of devices that are approved to access your password manager. 
  • For work-related accounts, always use password managers that are approved by your organization. Follow your organization’s policies, standards and procedures when processing, storing or sharing work-related data. 

Remember, if password managers are managed appropriately, they will offer you the level of security you are looking for to your online accounts’ passwords. 

This blogpost is offered to you by the GW Information Security and Risk Services team. 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu. 

Published on

Cybersecurity has become one of the most significant hot topics inside and outside technology circles over the last two years. From securing learning devices due to a rise in digital learning during the COVID-19 pandemic to coping with the fallout of high-profile breaches of national infrastructure such as the Colonial Pipeline, there is an evidently constant news cycle dedicated to cybersecurity mishaps and concerns. With this continuous stream of bad news, it can be challenging for you to know how to keep secure in the face of cybersecurity and threat actors. 

Everyday users have a huge role in cybersecurity threat prevention, detection, and remediation. According to a Wall Street Journal article, many hacks are successful by convincing someone inside or close to the target company to divulge network access credentials or other critical information. Therefore, GW’s first line of defense in helping to combat cyber-related issues is you. 

Here are 4 essential best practices that you can adopt today to enhance your cybersecurity and create a more secure cyberspace for you and GW.  

Watch out for Phishing Attempts

Phishing is when a threat actor poses as a legitimate party such as a bank, delivery service or other organization in an attempt to get individuals to click harmful links. Phishing remains one of the most popular tactics used  today. In fact, 80% of cybersecurity incidents stem from a phishing attempt. While phishing has gotten more sophisticated, the phishing signs remain the same. Look for typos, poor graphics, and other suspicious characteristics (incorrect logo or email address) as these can be red flags indicating that the content is a phish. In addition, if you think you have spotted a phishing attempt while logged into the GW network, report the incident to GW IT immediately. To report an incident please contact the GW Information Technology Support Center at 202-994-GWIT (4948) or email abuse@gwu.edu . 

Update your Password

Password cracking is another tactic that cybercriminals use to access sensitive personal information.  To guard against password cracking, having unique, long and complex passwords is one of the best ways to boost your cybersecurity immediately.  It is highly recommended not to repeat passwords across your accounts because once a hacker cracks one account, they can easily do the same across all of your accounts. 

Passwords can be tough to remember. That’s why it’s smart to use a password manager to help you secure your various passwords in one place. Password managers are easy to use and can automatically plug-in your stored password when you visit a site. Along with other security tips, password managers minimize the risk of mis-managing account passwords.

Take Advantage of Secure Wi-Fi 

Mobile hotspots and public Wi-Fi networks are typically not password-protected,  so it’s easier for threat actors  to gain unauthorized access to devices. Students, faculty, and staff should take full advantage of the university Wi-Fi networks when on campus. They are password-protected and only allow internet access across the university premises, operating as a secure online bubble for every user to work in peace.  

Lock your Device

Whenever you're logged into your devices (computer, laptop, phone, etc.),  you’re also open to potential unauthorized access by hackers and other threat actors.  The easiest way to prevent unauthorized access to your device is to lock it whenever you leave it unattended. All you have to do to get back on your device is enter the correct password, and you can pick up where you left off. If you wouldn't leave your house with the front door wide open, you should not leave your devices unlocked, especially when they are unattended.  

This blogpost is offered to you by the GW Information Security and Risk Services team. For more information on GW IT Security, please visit our security website: https://it.gwu.edu/gw-information-security  

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu.  

Original blog content provided by The National Cyber Security Alliance www.stayfaeonline.org, modified and posted with permission. 

Published on

Written by Patrick Hansen

Grinch Taking Money Image


Keeping an eye out for scams is a year-round job for anyone who uses the internet. But for scammers, the holiday season is the time to strike, while everyone is distracted by time off, gifts, and plans with family. From fake websites, gift cards, to even fake charities, it is important to stay on guard during the last part of the year.

Holiday Phishing

(If you need a refresher on phishing read this piece.)

Criminals love the amount of shopping and shipping that goes on during the last quarter of the year. They pretend to be Amazon, UPS, FedEx, Apple, and almost every other household brand name there is. A lot of phishing attacks come by email, declaring a problem with your order, shipping, payment, etc. In the past few years, SMS phishing has also shot up with intent just as malicious. Always remember, the real companies you interact with, won’t email or text you asking for personal information, and DON’T CLICK LINKS. If you are ever unsure about an email or text, look up the number for customer support and call.

Gift Cards

A gift card is a very sought after item for criminals because of the anonymous nature of purchases once it is gifted. Once it’s gone, it’s gone, and you won’t be able to get it back. Online, criminals will always try to get you to pay for a gift card and send them the information. Another thing to look out for is gift cards that have been tampered with. When buying a gift card from the store, make sure that the credit card number on the gift card is still covered. Criminals have ways to monitor when the card with that specific serial number is loaded with money so they can try to spend it before you can.

Fake This, Fake That

Online shopping can be extremely convenient, but there are things to watch out for. Some scammers will put up websites and buy domains that look very similar to real brand websites in appearance and URL. Always try to verify the website you are on in some way. If you are ever paying for something online, the “s” in “https” is a must. Sadly criminals will also set up fake charities designed to pull at your heartstrings. A quick Google search of the charity should provide enough information and others to verify it is real.

The holiday season is prime time for cyber thieves to attempt scams and steal your money and information. Always remember to double-check the random Amazon email, the random UPS text, gift cards, and everything else that is common for this time of year. Never give out your information and if there is any doubt, just contact the company itself. It is important to be aware of these attacks and be on guard year-round, but especially around the holidays, so you can enjoy them with cheer.

Published on

Devices such as cell phones, laptops, tablets are increasingly relied on whether from home, campus, and workplaces. The interconnectivity of those devices, especially from home locations, was heightened during the pandemic lockdown. According to recent data, smart home systems are set to rise to a market value of $157 billion by 2023, and the number of installed connected devices in the home is expected to increase by a staggering 70% by 2025. With the rise in virtual work and learning, it’s critical that you remain vigilant in practicing smart cyber hygiene while online. Here are some useful tips:        

Smart Devices need Smart Security 

Make cybersecurity a priority when purchasing a new cell phone, laptop, or tablet device. When setting up your new device, be sure to set your privacy and security settings, bearing in mind that you can limit with whom you are sharing information. Once your device is set up, remember to keep tabs on securing the information and where it is stored. Make sure that you manage location services actively to avoid unwittingly exposing your location. 

Put Cybersecurity First  

Make cybersecurity a priority when you're connected and online. Some precautions with all of your online accounts include performing regular software updates, downloading and installing software from trusted sources, using Two Factor Authentication (like we have at GW), and avoid being phished by ensuring that you know senders of an email before opening attachments. 

Make passwords and passphrases long and strong 

Generic and easy-to-remember passwords are easy to hack. Create secure and strong passwords, and be sure to combine capital and lowercase letters with numbers and symbols.  At a minimum, change your passwords every 6-months. If you need help remembering and storing your passwords, use a trusted password manager.   

Avoid connecting to public Wifi 

As smaller and more capable devices enable us to be mobile, we are all tempted to change scenery and change our physical location like a coffee shop or another type of public space. When you are away from trusted networks (your home or GWireless, for example), be wary of free, no password required, and even corporate hotspots. These connections may be fraudulent and easily accessible by bad actors.  

Use caution with publicly shared computers  

Avoid using publicly shared computers as often as possible. If you do use these, be careful and thoughtful in the information you share while online. If you are using your own devices, use known network hotspots, consider using your cellular connection (phone tethering), and avoid performing sensitive activities like accessing banking online. 

Turn off WiFi and Bluetooth when unneeded  

The uncomfortable truth is, when your WiFi and Bluetooth are on, they usually are set up to broadcast availability/presence and effectively invite other devices to connect.  While not always practical, to stay as safe as possible, switch them off if you do not need them. It’s a simple step that can help alleviate tracking concerns and incidents. You can also secure your WiFi and Bluetooth connections through your device settings. 

Staying safe online is an active 24/7 process that requires constant oversight 365 days a year. These helpful steps are how we in GW IT do our part to help you in doing your part to remain cyber smart. 

For more information on GW IT Security, please visit our security website: https://it.gwu.edu/gw-information-security.  

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu or it.gwu.edu. For self-help resources and answers to frequently asked questions, please visit the GWiz knowledge base at http://go.gwu.edu/GWiz. 

Original blog content provided by The National Cyber Security Alliance www.stayfaeonline.org, modified and posted with permission. 

Published on

Logo for National Cybersecurity Awareness MonthNational Cybersecurity Awareness Month (NCSAM) is a month that helps raise awareness and highlight the importance of cybersecurity. Cybersecurity and Information Security overlaps with almost everything we do and every technology we use. NCSAM was started in 2004 by the National Cyber Security Alliance (NCSA) and the Department of Homeland Security (DHS). The creation of NCSAM was to help Americans be secure online. The month raises awareness for security and emphasizes both companies and individuals on how to protect themselves.

Over the years, NCSA and the DHS have put on joint events around many states for NCSAM. In the past events with panels of information security professionals have been done as well as talks and presentations. They have even done some summits around the states and webinars for all to join. This year they have panels, and presentations all around the country, including Washington, D.C. These events have had growing popularity each year and have had some high ranking and nationally recognized officials make appearances at these events.

Each year there are different themes. The themes are meant to emphasize a particular change in behavior that would help everyone be safer online. This year the theme is, “Own It, Secure It, Protect It”. The goal for this year's theme is to draw attention to careers in information security and to encourage accountability. Each week of the month will focus on a different area of the theme. The “own it” part of the theme is to have people take ownership of their data. Most people don’t realize how much private information is going out on the web. “Secure it”, is for having strong passphrases and avoiding scams and phishing. “Protect it” is being proactive with your information after it is out there. Being active in knowing where and who has your data, and how to keep it protected.

Here at GWU, we are involved with NCSAM by spreading awareness through the university and by hosting our own events. We have events like meet and greets with the Information Security team, Cybersecurity Jeopardy, webinars, and presentations throughout the month of October. If you want to attend any events or have a chance at winning some of our excellent prizes this year, check out the event calendar here, http://go.gwu.edu/ncsam2019.

Published on

Information Security Photo Collage

People have a lot of pre-conceived notions about security teams and practices. While some misconceptions may be grounded in truth and others fairly outlandish, there is a lot going on behind the scenes that users may not see. From claims that we are all hackers wearing hoodies and doing nefarious deeds to the perception that we are here to get in your way, we will help you understand what is true, what is not, and why these perceptions might exist.

Myth #1: Security is just here to say no

Being at a university presents the unique challenge of providing the tools and technology necessary for students and faculty to research, learn, and achieve their goals. We must strike a difficult balance between the availability of those resources and the security of the university and our community. As security professionals, we do everything we can to enable safe and reliable access to the tools that the GW community needs to reach their goals. We are here to facilitate a safe IT environment in which all students, faculty, and staff can access the resources that they need, sometimes it sounds like, “no”, but what we are really requesting is modifications that reduce risk of exposure or breaches at GW.

Myth #2: Security only deals with technology

Many people believe that IT security only works on securing servers, reading logs, and other highly technical tasks. On the contrary, the security team has a wide range of responsibilities of which technology is only a part. The security team is continuously engaging with people and data in a multitude of ways. Often trying to help people protect themselves and the organization through a security awareness program or working directly with other teams to enhance security within their operations. They are constantly trying to improve way to protect the GW community’s data by updating policies, implementing best practices, and assessing security processes.

Myth #3: The security team is just a bunch of hackers

Just as many people think that the security team is nothing but hackers. This is far from the truth. Information security is a wide field with many specializations and it takes all sorts to be effective. While some members of the team might be highly technical penetration testers, their counterparts are security professionals focused on defensive security and protecting the GW network and assets from outside threats. Not to mention that members of the IT Security team range from awareness professionals working with people and outreach to analysts focused on identifying and reducing risk.

Myth #4: The security team takes care of security so I don’t have to

The security team works tirelessly to ensure that the GW community, information, and assets are as well protected as possible, but the team is not always the first line of defense. Security is your responsibility too. Our community is often the first line of defense when it comes to attacks from outside GW. Social engineering (aka tricking people and deceiving them) is a common tactic employed by attackers and encompasses phishing, piggy backing, and taking advantage of users in the workplace. All of this means that you, the user, needs to play a vital role in protecting the university, or, as we call it #SecuringGW. Protecting your own information is an essential puzzle piece to overall security of GW.  Catching phishing emails and forwarding them to abuse at GW may seem like a small task, but it is small actions like this that alert the team and protect GW from large breaches. Being aware of people trying to enter buildings where they don’t belong, and maintaining a clean desk free of sensitive materials are all security measures that you can take to do your part in #SecuringGW.

Fact: GW Information Security – Your Trusted Advisor

The information security team strives to facilitate access to the resources that the GW Community needs in as secure a manner as possible. Security affects everyone; data loss, lack of availability, and compromised systems impede day to day business functions, which means it affects the day to day lives of everyone on campus. In order to help prevent this, the security team acts as a Trusted Advisor to everyone in the GW Community. Whether you want to implement a new system, service, or application, or begin a new project, involving the GW security team as Trusted Advisors from the start enables us to aid in proper project oversight and completion while maintaining and promoting the confidentiality, integrity, and availability of GW’s data, systems, and services.

 

Published on

Over the past few months, GW has been introducing two-step authentication to all students, faculty and staff for GW Google apps. By February 28, 2018, the entire GW community will be required to use two-step authentication to sign into GW Google email, calendar and drive.

Two-Step Authentication Image

Two-step authentication is a second layer of security in addition to your password for any kind of login. It means you have to confirm your identity in two ways – with something you know (your password) and something you have (a code sent to your phone).

OK, how does this work?
GW uses Microsoft two-step authentication to ask individuals for a second confirmation of their identity at login, using a physical device in their possession. The device may be a smartphone or tablet using the free Microsoft Authenticator app, a text message sent to your phone, or an automated voice call to landline or cell phone.

Why do we need two-step authentication?
Passwords alone aren’t good enough to protect your personal information and our systems and networks. Two-step authentication makes it much harder for unauthorized individuals to access your account, in addition to GW systems and networks.

Isn’t this an inconvenience?
We hope not! Many people already use two-step authentication systems for online banking and shopping. Even social media sites may ask you to confirm your identity when you’re trying to log in from a new device or location. If you try to use your credit card to buy gas, you may be asked to enter your ZIP code. That's two-step authentication at work.

In addition, the GW community has the ability to select a “Remember me for 14 days” option. This means you’ll only have to use two-step authentication every 14 days to sign into your GW email from a trusted device.

Does two-step authentication really provide better protection?
Yes. While it’s not foolproof or perfect, it is a great additional measure to safeguard your accounts and data. At GW, the most secure option is to use two-step authentication with the Microsoft Authenticator app, which will generate a one-time code each time you login, even if you don’t have cellular reception. This eliminates the possibility of getting hacked through your text messages or email. Although two-step authentication isn’t perfect, it’s one of the best options to protect your data.

The Division of IT is committed to providing the GW community with resources to be more secure. To learn more about two-step authentication at GW, visit https://it.gwu.edu/two-step or check out this November Hatchet article.

If you’re interested in learning more about security best practices and data privacy, the Division of IT is holding a Data Privacy Event on January 30, 2018 in the lower level of District House.

If you like winning things, please take our short data privacy survey: https://it.gwu.edu/data-privacy-survey. Respondents will be entered to win one of two books about data privacy. Your feedback will help us develop better data privacy practices here at GW.

Published on Leave a comment on Public credential dumps affecting the GW community

Last week, the Division of IT sent an e-mail to the GW community regarding the recent discovery of 1.4 billion stolen credentials(usernames and passwords). The purpose of this blog post is to discuss the risks associated with credential re-use and things you can do to minimize the chances of your GW credentials being used by unauthorized persons. We wanted to take a moment to elaborate on the nature of this threat and how "credential dumps" can impact you and your online safety.

As you may have heard, large websites like Adobe.com, LinkedIn.com, and Yahoo.com have all suffered major cyber incidents in the last few years. A common hallmark of these incidents is that attackers steal the usernames and passwords for users of these sites and then leak the credentials publicly. There's very little that any regular user can do to prevent these types of incidents from occurring, but there are some actions that you can take to safeguard your accounts and your data. The most recent credential dump referenced in the above article is a collection of  credentials gathered from numerous hacks.

Follow these guidelines to help protect your accounts:

1.) Check haveibeenpwned.com* to see if any of your e-mail addresses are associated with any large credential breaches. This site is operated and maintained by Troy Hunt, who is a well-known, reputable computer security expert.

"Have I been pwned?" image

Simply type your e-mail address, click the "pwned?" button and see a list of any websites where your e-mail address and password has been part of a known credential breach.

Pwn All-clear Image
If you see this, that's good. No passwords to change.

Pwned report image
If you see this, change the passwords for the impacted accounts.

Feel free to share this URL with your family and friends.

2.) It is important that you do not re-use passwords. For example, if I use my GW e-mail address to register for Pinterest.com, the password used should not be the same as the password that you use with your GW e-mail address. This way, if Pinterest is ever compromised, that password is essentially useless for anything other than Pinterest. If you have trouble remembering passwords (this applies to roughly 99.9% of all people including the author) use a password manager. While not officially supported by the GW Division of IT, we like LastPass. LastPass works on PCs and Macs, as well as mobile devices that run iOS and Android. Password managers help users manage unique, long, complex passwords in an efficient manner.

3.) Choose passwords that are long (the longer the better) and complex (no dictionary words). Easily guessable passwords or passwords that employ obvious obfuscation techniques (e.g. Ra1seH1gh!) are not great passwords. While GW does not require you to change your password, it's not a bad idea to change your password periodically. There are some competing schools of thought on this issue but the GW security team recommends changing your password at least once annually.

The GW information security team is always on the lookout for notices of public credential dumps. We may tell you about these from time to time, especially if we learn that you may have been impacted by one of these dumps. In the meantime, follow the above guidance. These little things will go a long way to protect your accounts and your data from an attacker.

* - "pwned" is hacker-speak for "owned" or compromised.

Viewing Message: 1 of 1.
 Notice

This site uses cookies to offer you a better browsing experience. Visit GW’s Website Privacy Notice to learn more about how GW uses cookies.