Skip to content

Category: security hygiene

Published on

Securing Home Networks – Overview and Supporting Materials

GW IT Risk and Assurance provides various information and resources through workshops and webinars as well as posts to our blog site.  The team has compiled an overview of home network configuration focus areas and recommended changes.  This summary aligns to the Cybersecurity@Home Cyber Talk presentation.  Additional information is available on our in-depth Cybersecurity@Home page

Increasing Scope and Complexity of Home Networks

Image depicting expansion of home networks from computer devices to internet of things devices
Increased Scope of Home Network Vulnerabilities

Internet Connectivity Creates Potential Global Access to Home Networks through Gateways or Routers

  • Home network front door to the globe
  • Threat – devices are targeted directly; potentially providing attackers access to in-home devices, data, network activity

Wireless Services Expose Home Network Outdoors

  • Most home networks have WiFi services enabled
  • Threat – attackers and even pranksters can attack your network wirelessly from near your home

Securing Gateways / Routers

https://www.tomsguide.com/us/home-router-security,news-19245.html
Tom's Guide - Router Security
  • Change administrative credentials from default username and password
  • Set strong connection password (different from admin)
    • Enable WPA2  encryption or ideally WPA3 standard, if available, avoid WEP.
  • Change network name, or SSID, default names provide attackers information
    • Don’t use identifying information (names, street or apartment numbers)
  • Investigate / Set Parental Controls – applied to all or select devices
  • Configure Guest Network
    • Separate guest access from primary home network; could be used for some smart-home or IoT devices
  • Use 5GHz band  Wi-Fi not 2.4GHz band (all devices must support 5GHz)
    • 5GHz band signal travels less distance than the 2.4GHz band
  • Disable Wi-Fi Protected Setup, if possible
    • this capability can expedite initial setup, disable when not connecting devices.
  • Disable remote administration of firewall and router devices if not required.

Internet of Things (IoT) Safeguards for Home Network Security

Excerpted - 20 Expert-Approved Tips for In-Home IoT Security Forbes online 2024

Selecting IoT Solutions

  • Research Known Vulnerabilities – Google Before Purchasing
  • Learn Device [Security] Capabilities During [Before Purchase and] Setup
  • Buy Encrypted, Secure Versions Of Devices
  • Review Security Standards Prior To Purchase
  • Question Overly Complex or Intrusive Devices

Securing IoT Solutions

  • Change Default Passwords and Enable Multifactor Authentication
  • Establish Separate Passwords and Networks
  • Review And Limit Data and Service Access
  • Disable Features You Don’t Use – Does everything need connectivity?

Maintaining Secure IoT Solutions

  • Monitor Network Traffic
  • Ensure Awareness Of All Home Connected Devices
  • Update Firmware Regularly
  • Use a personal VPN on connected computers – consider a VPN for Home Network

Securing Home Networks – Parental Controls

There have been parental controls for television content for many years.  Similar in context to television parental controls, both devices and your home network have settings for parental controls.  This post addresses resources available from service providers and vendors.

DMV Internet Service Providers (ISPs) – Parental Control Resources

Internet Service Providers (ISPs) are core to internet connectivity and network security at home.  The following information focuses on Parental Control solutions available from the primary internet service providers in the DC, Maryland, and Virginia area.  The following resources are specific to implementing Parental Controls on ISP provided gateways (also known as routers).   

Note – some ISPs provide additional software to subscribers. For example, Cox provides a Cox Security Suite that offers additional controls.  ISPs may also provide device security software such as antivirus or antimalware.

More descriptions available on the CyberSecurity@Home page and through our Webinar offerings.

unofficial GW hippo mascot holding a lockThis post is presented by the GW IT Cybersecurity Risk and Assurance team.

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu

 

Published on

For GW Data Privacy Month a series of webinars, focused on privacy and information security best practices are being collaboratively presented by GW Information Security, GW Data Governance and the GW Privacy Office.  These sessions support the university’s commitment to protecting the privacy and security of institutional data and our community members personal information.

Additional Information available on the Risk and Assurance Blog Events Calendar.

You can help secure our data through direct action. Account compromises impact individuals, families, organizations, and employers. The following tips from the National Cybersecurity Alliance can assist you in keeping your information and GW data safe. 

The Core 4

As with most things in life, an ounce of cybersecurity prevention is worth a pound of cure. Follow our "Core 4" to show hackers you mean business.

1. Passwords / Password Managers

Use long, complex, and unique passwords. Every password should be at least 12 characters long and include letters, numbers, and symbols (like % or $). Ideally, your passwords should be random strings of characters, not recognizable words. Very importantly, each account should be protected by its own unique password. To create and store all these passwords, use a password manager!

2. Multi Factor Authentication

Switch on multi-factor authentication. Multi-factor authentication (MFA), sometimes called 2-factor authentication, adds a whole other level of security beyond your password. MFA will use biometrics, security keys, text messages, or an app to make sure you are you, even if a hacker gets access to your password. Enable MFA for any account that allows it!

3. Recognize and Report Phishing

Think before you click. Learn how to identity phishing messages, which will often try to inspire panic or urgency. Take a few seconds to read through the message and who sent it. With a little knowledge, you can spot most phishing attempts within moments.

4. Automatic Updates

Turn on automatic updates. The best way to get the latest, strongest security is to install software updates as soon as they are available - and the best way to know when they are available is to turn on automatic updates! Set it, forget it, and you won't regret it!

Source: National Cybersecurity Alliance https://staysafeonline.org/online-safety-privacy-basics/hacked-accounts

unofficial GW hippo mascot holding a lockThis post is presented by the GW IT Cybersecurity Risk and Assurance team.

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu

 

Published on

Between all of your online accounts, whether personal or work accounts, you probably have many unique — and complex — passwords to manage.  And since you know better than to write them down in a notebook, have them on sticky notes hidden under your mouse pad, or stored digitally on your desktop, what are you supposed to do? 

Passwords are one of the most vulnerable cyber defenses used to protect our online accounts, as passwords are the only barrier between online accounts and cybercriminals who have a desire to access to our data and systems. Utilizing a password manager is a security best practice that cyber professionals are recommending for us.  

Along with other security tips, password managers minimize the risk of mis-managing our passwords. The question that arises here, are password managers secure, and what is our responsibility here to manage the password manager? 

What is a Password Manager?

A password manager is software that allows users to generate passwords, store, and manage account information including usernames and passwords all in one location. Password managers offer other features such as complex password suggestions, identifying weak or repeated passwords used, and alerting its users when their credentials appear compromises. When you use a password manager, you will set a password that is often referred to as the “master” password.  This will be the only password you will need to remember.

Password managers are available in different formats: 

  • An online service hosted by a third party and accessed through a website portal. This type is useful if you need access to the password manager from multiple devices. 
  • Software installed locally on a workstation that can operate either completely offline or connected to the internet to synchronize your information to a cloud database and get software updates.  

Are Password Managers Secure? 

Password managers can offer a high level of security level for account credentials and information, if best practices are used to secure their master password.  Whether you use, or planning to get, an online, or an offline password manager, you need to follow the following practices: 

  • Do your research and get a trusted password manager software that has a high reputation in the industry. 
  • Use a strong master password for your password manager account and never forget it. Some password manager vendors would never retrieve your account if you can’t remember your master password. 
  • Enable two-factor-authentication (2FA) to your password manager account for an extra layer of security.  
  • Keep your password manager software, web browsers, and all other software you use up-to-date. 
  • Audit the list of devices that are approved to access your password manager. 
  • For work-related accounts, always use password managers that are approved by your organization. Follow your organization’s policies, standards and procedures when processing, storing or sharing work-related data. 

Remember, if password managers are managed appropriately, they will offer you the level of security you are looking for to your online accounts’ passwords. 

This post is presented by the GW IT Cybersecurity Risk and Assurance team with information from CISA.

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu. 

Published on

Cybersecurity is a shared responsibility for everyone. You can help #secureoutworld through direct action. Account compromises impacts individuals, families, organizations, and employers. The following tips can assist you in keeping your information and GW data safe.

The Core 4

As with most things in life, an ounce of cybersecurity prevention is worth a pound of cure. Follow our "Core 4" to show hackers you mean business.

1. Passwords / Password Managers

Use long, complex, and unique passwords. Every password should be at least 12 characters long and include letters, numbers, and symbols (like % or $). Ideally, your passwords should be random strings of characters, not recognizable words. Very importantly, each account should be protected by its own unique password. To create and store all these passwords, use a password manager!

2. Multi Factor Authentication

Switch on multi-factor authentication. Multi-factor authentication (MFA), sometimes called 2-factor authentication, adds a whole other level of security beyond your password. MFA will use biometrics, security keys, text messages, or an app to make sure you are you, even if a hacker gets access to your password. Enable MFA for any account that allows it!

3. Recognize and Report Phishing

Think before you click. Learn how to identity phishing messages, which will often try to inspire panic or urgency. Take a few seconds to read through the message and who sent it. With a little knowledge, you can spot most phishing attempts within moments.

4. Automatic Updates

Turn on automatic updates. The best way to get the latest, strongest security is to install software updates as soon as they are available - and the best way to know when they are available is to turn on automatic updates! Set it, forget it, and you won't regret it!

Checkout the Events Calendar for details on webinars related to the Core 4 and other cybersecurity topics.

Source: National Cybersecurity Alliance https://staysafeonline.org/online-safety-privacy-basics/hacked-accounts

This blogpost is offered to you by the GW Information Security and Risk Services team. 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu. 

Published on

Do you get a little chill thinking about the dozens of login credentials you have set up throughout the wilderness of the internet? If so, don’t worry – you aren’t alone. Identity management, sometimes called identity and access management (IAM), increases in importance every year. That’s why we celebrate Identity Management Day!   

Identity management, though, is not just a concern for businesses and organizations. You can help protect your data by understanding and implementing some simple identity management practices. You have the power to own and maintain your digital identity!  

CONFIGURE YOUR SECURITY SETTINGS  

Every time you sign up for a new account, download a new app, or get a new device, immediately configure the privacy and security settings to your comfort level. Check the settings on old accounts and delete any apps or accounts you no longer use.  

DON’T TAKE THE BAIT  

If you receive an enticing offer via email or text, don’t be so quick to click on the link. Instead, go directly to the company’s website to verify it is legitimate. If you’re unsure who an email is from—even if the details appear accurate—or if the email looks “phishy,” do not respond and do not click on any links or open any attachments found in that email as they may be infected with malware. Report phishing to your organization’s IT department or your email provider.  

SHARE WITH CARE  

Think before posting about yourself and others online, especially on social media. Consider what a post reveals, who might see it and how it might affect you or others. Personal information readily available online can be used by attackers to do a variety of things, including impersonation and guessing usernames and passwords.  

SHIELD YOUR PASSWORD WITH MFA   

Multi-factor authentication (MFA), or as referred to in GW as 2-Step Authentication, will fortify your online accounts by enabling the strongest authentication tools available, such as biometrics or a unique one-time code sent to your phone or mobile device.  

USE A PASSWORD MANAGER  

Use password managers to generate and remember different, complex passwords for each of your accounts. While not a perfect solution, a password manager is currently the most secure way to send passwords and other login credentials to family members or coworkers. Duplicating passwords or using common passwords is a gift to hackers. If one account is compromised, a hacker will typically try the same username and password combination against other websites.  

TURN ON AUTOMATIC UPDATES  

Keep all software on internet connected devices – including personal computers, smartphones and tablets – current to reduce risk of infection from ransomware and malware. Configure your devices to automatically update or to notify you when an update is available. Software updates often fix security flaws. Outdated software can be riddled with security holes easily exploited by attackers.  

For more tips and advice, visit www.identitymanagementday.org/  

Original blog content provided by The National Cyber Security Alliance. For the original post, click here. 

For more information on GW IT Security, please visit our security website: https://it.gwu.edu/gw-information-security 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), or visit ithelp.gwu.edu 

Published on

Between all of your online accounts, whether personal or work accounts, you probably have many unique — and complex — passwords to manage.  And since you know better than to write them down in a notebook, have them on sticky notes hidden under your mouse pad, or stored digitally on your desktop, what are you supposed to do? 

Passwords are one of the most vulnerable cyber defenses used to protect our online accounts, as passwords are the only barrier between online accounts and cybercriminals who have a desire to access to our data and systems. Utilizing a password manager is a security best practice that cyber professionals are recommending for us.  

Along with other security tips, password managers minimize the risk of mis-managing our passwords. The question that arises here, are password managers secure, and what is our responsibility here to manage the password manager? 

What is a Password Manager?

A password manager is a software that allows users to generate passwords, store and manage accounts’ information including user names and passwords all in one location. Password managers offer other features such as complex password suggestions, identifying weak or repeated passwords used, and alerting its users from entering their credentials to suspicious websites. To create a password manager account, you need to set a password that is often referred to as the “master” password. 

Password managers are available in different formats: 

  • An online service hosted by a third party and accessed through a website portal. This type is useful if you need access to the password manager from multiple devices. 
  • Software installed locally on a workstation that can operate either completely offline or connected to the internet to synchronize your information to a cloud database and get software updates.  

Are Password Managers Secure? 

Password managers will offer users the security level they are looking for to their accounts’ credentials and information if they follow best practices to secure their password manager account.  Whether you use, or planning to get, an online, or an offline password manager, you need to follow the following practices: 

  • Do your research and get a trusted password manager software that has a high reputation in the industry. 
  • Use a strong master password for your password manager account and never forget it. Some password manager vendors would never retrieve your account if you can’t remember your master password. 
  • Enable two-factor-authentication (2FA) to your password manager account for an extra layer of security.  
  • Keep your password manager software along with web browsers you use up-to-date. 
  • Audit the list of devices that are approved to access your password manager. 
  • For work-related accounts, always use password managers that are approved by your organization. Follow your organization’s policies, standards and procedures when processing, storing or sharing work-related data. 

Remember, if password managers are managed appropriately, they will offer you the level of security you are looking for to your online accounts’ passwords. 

This blogpost is offered to you by the GW Information Security and Risk Services team. 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu. 

Published on

Cybersecurity has become one of the most significant hot topics inside and outside technology circles over the last two years. From securing learning devices due to a rise in digital learning during the COVID-19 pandemic to coping with the fallout of high-profile breaches of national infrastructure such as the Colonial Pipeline, there is an evidently constant news cycle dedicated to cybersecurity mishaps and concerns. With this continuous stream of bad news, it can be challenging for you to know how to keep secure in the face of cybersecurity and threat actors. 

Everyday users have a huge role in cybersecurity threat prevention, detection, and remediation. According to a Wall Street Journal article, many hacks are successful by convincing someone inside or close to the target company to divulge network access credentials or other critical information. Therefore, GW’s first line of defense in helping to combat cyber-related issues is you. 

Here are 4 essential best practices that you can adopt today to enhance your cybersecurity and create a more secure cyberspace for you and GW.  

Watch out for Phishing Attempts

Phishing is when a threat actor poses as a legitimate party such as a bank, delivery service or other organization in an attempt to get individuals to click harmful links. Phishing remains one of the most popular tactics used  today. In fact, 80% of cybersecurity incidents stem from a phishing attempt. While phishing has gotten more sophisticated, the phishing signs remain the same. Look for typos, poor graphics, and other suspicious characteristics (incorrect logo or email address) as these can be red flags indicating that the content is a phish. In addition, if you think you have spotted a phishing attempt while logged into the GW network, report the incident to GW IT immediately. To report an incident please contact the GW Information Technology Support Center at 202-994-GWIT (4948) or email abuse@gwu.edu . 

Update your Password

Password cracking is another tactic that cybercriminals use to access sensitive personal information.  To guard against password cracking, having unique, long and complex passwords is one of the best ways to boost your cybersecurity immediately.  It is highly recommended not to repeat passwords across your accounts because once a hacker cracks one account, they can easily do the same across all of your accounts. 

Passwords can be tough to remember. That’s why it’s smart to use a password manager to help you secure your various passwords in one place. Password managers are easy to use and can automatically plug-in your stored password when you visit a site. Along with other security tips, password managers minimize the risk of mis-managing account passwords.

Take Advantage of Secure Wi-Fi 

Mobile hotspots and public Wi-Fi networks are typically not password-protected,  so it’s easier for threat actors  to gain unauthorized access to devices. Students, faculty, and staff should take full advantage of the university Wi-Fi networks when on campus. They are password-protected and only allow internet access across the university premises, operating as a secure online bubble for every user to work in peace.  

Lock your Device

Whenever you're logged into your devices (computer, laptop, phone, etc.),  you’re also open to potential unauthorized access by hackers and other threat actors.  The easiest way to prevent unauthorized access to your device is to lock it whenever you leave it unattended. All you have to do to get back on your device is enter the correct password, and you can pick up where you left off. If you wouldn't leave your house with the front door wide open, you should not leave your devices unlocked, especially when they are unattended.  

This blogpost is offered to you by the GW Information Security and Risk Services team. For more information on GW IT Security, please visit our security website: https://it.gwu.edu/gw-information-security  

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu.  

Original blog content provided by The National Cyber Security Alliance www.stayfaeonline.org, modified and posted with permission. 

Published on

Your digital identity and information are incredibly valuable to cybercriminals, whether it comes from your social media profiles, search engine history, or email accounts. If your account is compromised, cybercriminals may obtain personal information to commit identity theft, steal money, or conduct phishing attacks on others. According to the Verizon 2021 Data Breach Investigations Report, 61% of all breaches involve credentials, whether they be stolen via social engineering or hacked using brute force. In recent years, increased occurrences of identity theft and data breaches have been attributed to several factors, including a rise in the number of remote workers and the adoption of cloud technologies. 

Here are a few best practices that can, if followed, reduce the opportunity for a cybercriminal to steal your identity and associated information: 

Think Before You Click

Attackers often send fraudulent emails and text messages, referred to as phishing, to trick individuals into providing information such as usernames and passwords or downloading malware. If you receive an enticing offer via email or text, don't click without thinking. Go directly to the company's website to verify its legitimacy. If you're not sure who an email is from—even if the details appear correct—or if the email looks to be "phishy," do not respond and do not click on any links or open any files in the email as it may contain malware.

Report suspicious emails or ask GW Information Security questions you may have by emailing abuse@gwu.edu.

Share With Care

Cybercriminals can use publicly available personal information for various purposes, such as impersonating a user and guessing usernames and passwords. Think before posting about yourself and others online. Take into account what a post reveals, who could view it, and how it might affect you or others. Consider creating an alternate persona that you use for online profiles to limit how much of your personal information you share. 

Practice Good Password Hygiene

Never use the same password for your social media accounts, financial institutions, work accounts, or any other site that collects personally identifiable information (PII). Best practices for password hygiene include choosing long passwords, selecting a unique password for each account, resisting the temptation to select passwords that are simple to remember or guess, and never emailing or sharing passwords with others.

Use Two-Step Authentication (2SA)

Two-Step Authentication (2SA) is a security measure that requires users to go over two steps to verify their digital identity (something you know and something you own). With 2SA, a user is granted access to their account after entering the correct username and password credentials (Something you know) and completing the second authentication process using an authenticator app, SMS text, or phone call to authenticate a piece of information (Something you own). 

For GW accounts, 2SA is enabled on  GW Box, Google Apps (GW email, calendar, Drive), GWeb, and various other applications. Visit our website at  https://it.gwu.edu/two-step-authentication and learn more.

Download a Password Manager

Remembering passphrases and complex password combinations can be difficult for people to do. Password managers are encrypted digital tools that store passwords and online credentials in a centralized location secured by a single, strong master password. Additionally, password managers can also be used for generating unique passwords for each of your accounts. GW utilizes LastPass for managing passwords within certain departments and units. 

Some of the blog content is provided by https://staysafeonline.org/identity-management-day/identity-management-tips-advice/, modified to align with the University’s mission and common terminologies.

Visit the GW Information Security site at it.gwu.edu/gw-information-security

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit GW IT site at it.gwu.edu. For self-help resources and answers to frequently asked questions, please visit the GWiz knowledge base at go.gwu.edu/GWiz

Published on

The George Washington University (GW) offers Information Technology Resources (IT Resources) to facilitate virtual learning and teleworking. Complying with the University guidelines is essential to performing academic and work-related activities securely while preserving the confidentiality, integrity, and availability of the University information. 

Higher education institutions are facing increased cyber threats, from cyberattacks such as phishing and ransomware to hijacking video conferencing sessions. Higher education institutions are a prime target for cyber attackers that are seeking to acquire and steal university information, such as research, personally identifiable information (PII), or to disrupt operations for financial or political gains. As a GW community member, it is essential to safeguard GW’s digital environment by understanding modern cyber threats and taking a role in minimizing risks associated with the unintentional misuse of the University IT Resources. This includes reporting events and incidents that could put university information and IT Resources at risk of exposure, theft, or misuse.  

This advisory guide is intended to support the GW community when using university-approved video conferencing software and related collaboration tools. Recommendations are included to reduce the likelihood of unintentional exposure of university and personal information beyond intended recipients. 

Recommendations for GW End-Users: 

  1. Only Use “Approved Platforms” to host events, and meetings.
    • Do not host school business via unapproved tools. Use only tools that have been provided or approved by GW. 
    • Carefully review meeting invitations. Think before you click and be wary of links sent by unfamiliar addresses 
  2. Secure your meeting for attendees.
    • Only make meetings “public” when necessary for the planned audience. 
    • Have a plan to terminate a meeting if needed.
    • Require a meeting password and use features such as a waiting room to secure private meetings.  
    • Provide a link to the meeting directly to your students and share passwords in a separate email.  
  3. Secure University Information.
    • Manage screensharing, recording, and file sharing options prior and during your hosted meeting. 
    • Protect non-public information, especially when screensharing and displaying GW information. 
    • Follow GW IT's guidelines for web conferencing storage.
    • Report suspicious activities or unusual events you notice during a meeting. 
  4. Secure Yourself and our GW Community.
    • Don’t unintentionally reveal information. Check your visual and audio surroundings to safeguard your personal information. 
    • Check and update your home network. Change default settings and use complex passwords for your Wi-Fi network. 
    • Always use GW VPN when accessing GW non-public information and IT Resources.  

Please visit the individual collaboration web pages for specific platform best practices.

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or it.gwu.edu. For self-help resources and answers to frequently asked questions, please visit the GWiz knowledge base at http://go.gwu.edu/GWiz.  

Some of the blog content is provided by The Cybersecurity and Infrastructure Security, modified to align with the University’s mission and common terminologies. 

Published on

Written by Patrick Hansen

Grinch Taking Money Image


Keeping an eye out for scams is a year-round job for anyone who uses the internet. But for scammers, the holiday season is the time to strike, while everyone is distracted by time off, gifts, and plans with family. From fake websites, gift cards, to even fake charities, it is important to stay on guard during the last part of the year.

Holiday Phishing

(If you need a refresher on phishing read this piece.)

Criminals love the amount of shopping and shipping that goes on during the last quarter of the year. They pretend to be Amazon, UPS, FedEx, Apple, and almost every other household brand name there is. A lot of phishing attacks come by email, declaring a problem with your order, shipping, payment, etc. In the past few years, SMS phishing has also shot up with intent just as malicious.

Always remember, the real companies you interact with, won’t email or text you asking for personal information, and DON’T CLICK LINKS. If you are ever unsure about an email or text, look up the number for customer support and call.

Gift Cards

A gift card is a very sought after item for criminals because of the anonymous nature of purchases once it is gifted. Once it’s gone, it’s gone, and you won’t be able to get it back. Online, criminals will always try to get you to pay for a gift card and send them the information.

Another thing to look out for is gift cards that have been tampered with. When buying a gift card from the store, make sure that the credit card number on the gift card is still covered. Criminals have ways to monitor when the card with that specific serial number is loaded with money so they can try to spend it before you can.

Fake This, Fake That

Online shopping can be extremely convenient, but there are things to watch out for. Some scammers will put up websites and buy domains that look very similar to real brand websites in appearance and URL. Always try to verify the website you are on in some way. If you are ever paying for something online, the “s” in “https” is a must.

Sadly criminals will also set up fake charities designed to pull at your heartstrings. A quick Google search of the charity should provide enough information and others to verify it is real.

Conclusion

The holiday season is prime time for cyber thieves to attempt scams and steal your money and information. Always remember to double-check the random Amazon email, the random UPS text, gift cards, and everything else that is common for this time of year.

Never give out your information and if there is any doubt, just contact the company itself. It is important to be aware of these attacks and be on guard year-round, but especially around the holidays, so you can enjoy them with cheer.

 

Viewing Message: 1 of 1.
 Notice

This site uses cookies to offer you a better browsing experience. Visit GW’s Website Privacy Notice to learn more about how GW uses cookies.