Skip to content

Tag: infosec

Published on

GW IT Risk and Assurance provides various information and resources through workshops and webinars as well as posts to our blog site.  The team is highlighting newly added Blog site resources.  Note some content referenced is hosted on GW Box and only accessible by those with GW Box access.  We hope to add more content sharing options for the wider community soon.

Please visit our resources page for more information about content being shared on GW Box

Quickstart Uploaded - Finding CyberSecurity Awareness Content in Talent@GW

...continue reading "Cybersecurity Training and Awareness Resources"

Published on

Information Sharing Through GW Box

GW IT Risk and Assurance provides information and resources through workshops and webinars as well as posts to our blog site.  Below the team highlights resources added to our newly created GW Box awareness repository.  Unfortunately, content hosted on GW Box is only accessible by those with GW Box access.  We hope to add more content sharing options for the wider community soon.

The following items were posted this week:

Cybersecurity Awareness - Quick Guides, Presentations, Documents and Resources (Shared Folder - Requires GW Box Account) 

    • Every effort is made to share content aligned with copyright holders' intended use of the content as handouts and guides for distribution.  Please let us know if we have something incorrectly posted by email infosec@gwu.edu.

Look for update announcements for these other focus areas coming soon!

unofficial GW hippo mascot holding a lockThis content is presented by the GW IT Cybersecurity Risk and Assurance team. #SecuringGW is a shared responsibility, if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu.

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu

 

 

Published on

Securing Home Networks – Overview and Supporting Materials

GW IT Risk and Assurance provides various information and resources through workshops and webinars as well as posts to our blog site.  The team has compiled an overview of home network configuration focus areas and recommended changes.  This summary aligns to the Cybersecurity@Home Cyber Talk presentation.  Additional information is available on our in-depth Cybersecurity@Home page

Increasing Scope and Complexity of Home Networks

Image depicting expansion of home networks from computer devices to internet of things devices
Increased Scope of Home Network Vulnerabilities

Internet Connectivity Creates Potential Global Access to Home Networks through Gateways or Routers

  • Home network front door to the globe
  • Threat – devices are targeted directly; potentially providing attackers access to in-home devices, data, network activity

Wireless Services Expose Home Network Outdoors

  • Most home networks have WiFi services enabled
  • Threat – attackers and even pranksters can attack your network wirelessly from near your home

Securing Gateways / Routers

https://www.tomsguide.com/us/home-router-security,news-19245.html
Tom's Guide - Router Security
  • Change administrative credentials from default username and password
  • Set strong connection password (different from admin)
    • Enable WPA2  encryption or ideally WPA3 standard, if available, avoid WEP.
  • Change network name, or SSID, default names provide attackers information
    • Don’t use identifying information (names, street or apartment numbers)
  • Investigate / Set Parental Controls – applied to all or select devices
  • Configure Guest Network
    • Separate guest access from primary home network; could be used for some smart-home or IoT devices
  • Use 5GHz band  Wi-Fi not 2.4GHz band (all devices must support 5GHz)
    • 5GHz band signal travels less distance than the 2.4GHz band
  • Disable Wi-Fi Protected Setup, if possible
    • this capability can expedite initial setup, disable when not connecting devices.
  • Disable remote administration of firewall and router devices if not required.

Internet of Things (IoT) Safeguards for Home Network Security

Excerpted - 20 Expert-Approved Tips for In-Home IoT Security Forbes online 2024

Selecting IoT Solutions

  • Research Known Vulnerabilities – Google Before Purchasing
  • Learn Device [Security] Capabilities During [Before Purchase and] Setup
  • Buy Encrypted, Secure Versions Of Devices
  • Review Security Standards Prior To Purchase
  • Question Overly Complex or Intrusive Devices

Securing IoT Solutions

  • Change Default Passwords and Enable Multifactor Authentication
  • Establish Separate Passwords and Networks
  • Review And Limit Data and Service Access
  • Disable Features You Don’t Use – Does everything need connectivity?

Maintaining Secure IoT Solutions

  • Monitor Network Traffic
  • Ensure Awareness Of All Home Connected Devices
  • Update Firmware Regularly
  • Use a personal VPN on connected computers – consider a VPN for Home Network

Securing Home Networks – Parental Controls

There have been parental controls for television content for many years.  Similar in context to television parental controls, both devices and your home network have settings for parental controls.  This post addresses resources available from service providers and vendors.

DMV Internet Service Providers (ISPs) – Parental Control Resources

Internet Service Providers (ISPs) are core to internet connectivity and network security at home.  The following information focuses on Parental Control solutions available from the primary internet service providers in the DC, Maryland, and Virginia area.  The following resources are specific to implementing Parental Controls on ISP provided gateways (also known as routers).   

Note – some ISPs provide additional software to subscribers. For example, Cox provides a Cox Security Suite that offers additional controls.  ISPs may also provide device security software such as antivirus or antimalware.

More information available on the CyberSecurity@Home page and through our Webinar offerings.

unofficial GW hippo mascot holding a lockThis content is presented by the GW IT Cybersecurity Risk and Assurance team. #SecuringGW is a shared responsibility, if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu.

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu

 

 

Published on

For GW Data Privacy Month a series of webinars, focused on privacy and information security best practices are being collaboratively presented by GW Information Security, GW Data Governance and the GW Privacy Office.  These sessions support the university’s commitment to protecting the privacy and security of institutional data and our community members personal information.

Additional Information available on the Risk and Assurance Blog Events Calendar.

Direct Actions to Secure Our Data

Account compromises impact individuals, families, organizations, and employers.  Your actions will assist in securing our data.  The following tips from the National Cybersecurity Alliance can assist you in keeping your personal information and GW data safe. 

The Core 4

As with most things in life, an ounce of cybersecurity prevention is worth a pound of cure. Follow our "Core 4" to show hackers you mean business.

1. Passwords / Password Managers

Use long, complex, and unique passwords. Every password should be at least 12 characters long and include letters, numbers, and symbols (like % or $). Ideally, your passwords should be random strings of characters, not recognizable words. Very importantly, each account should be protected by its own unique password. To create and store all these passwords, use a password manager!

2. Multi Factor Authentication

Switch on multi-factor authentication. Multi-factor authentication (MFA), sometimes called 2-factor authentication, adds a whole other level of security beyond your password. MFA will use biometrics, security keys, text messages, or an app to make sure you are you, even if a hacker gets access to your password. Enable MFA for any account that allows it!

3. Recognize and Report Phishing

Think before you click. Learn how to identity phishing messages, which will often try to inspire panic or urgency. Take a few seconds to read through the message and who sent it. With a little knowledge, you can spot most phishing attempts within moments.

4. Automatic Updates

Turn on automatic updates. The best way to get the latest, strongest security is to install software updates as soon as they are available - and the best way to know when they are available is to turn on automatic updates! Set it, forget it, and you won't regret it!

Source: National Cybersecurity Alliance https://staysafeonline.org/online-safety-privacy-basics/hacked-accounts

unofficial GW hippo mascot holding a lockThis post is presented by the GW IT Cybersecurity Risk and Assurance team.

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu

 

Published on

Cybersecurity is a shared responsibility for everyone. You can help #secureoutworld through direct action. Account compromises impacts individuals, families, organizations, and employers. The following tips can assist you in keeping your information and GW data safe.

The Core 4

As with most things in life, an ounce of cybersecurity prevention is worth a pound of cure. Follow our "Core 4" to show hackers you mean business.

1. Passwords / Password Managers

Use long, complex, and unique passwords. Every password should be at least 12 characters long and include letters, numbers, and symbols (like % or $). Ideally, your passwords should be random strings of characters, not recognizable words. Very importantly, each account should be protected by its own unique password. To create and store all these passwords, use a password manager!

2. Multi Factor Authentication

Switch on multi-factor authentication. Multi-factor authentication (MFA), sometimes called 2-factor authentication, adds a whole other level of security beyond your password. MFA will use biometrics, security keys, text messages, or an app to make sure you are you, even if a hacker gets access to your password. Enable MFA for any account that allows it!

3. Recognize and Report Phishing

Think before you click. Learn how to identity phishing messages, which will often try to inspire panic or urgency. Take a few seconds to read through the message and who sent it. With a little knowledge, you can spot most phishing attempts within moments.

4. Automatic Updates

Turn on automatic updates. The best way to get the latest, strongest security is to install software updates as soon as they are available - and the best way to know when they are available is to turn on automatic updates! Set it, forget it, and you won't regret it!

Checkout the Events Calendar for details on webinars related to the Core 4 and other cybersecurity topics.

Source: National Cybersecurity Alliance https://staysafeonline.org/online-safety-privacy-basics/hacked-accounts

This blogpost is offered to you by the GW Information Security and Risk Services team. 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse[@]gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp[@]gwu.edu, or visit ithelp.gwu.edu. 

Published on

The National Cybersecurity Alliance partnered with Consumer Reports to bring you a new animated video [opens YouTube link] about how you can take control of your data! Check out "The Tale of Privacy Peyton" below, and download Consumer Reports' Permission Slip.

Image of for Tale of Privacy Peyton Video

Published on

Between all of your online accounts, whether personal or work accounts, you probably have many unique — and complex — passwords to manage.  And since you know better than to write them down in a notebook, have them on sticky notes hidden under your mouse pad, or stored digitally on your desktop, what are you supposed to do? 

Passwords are one of the most vulnerable cyber defenses used to protect our online accounts, as passwords are the only barrier between online accounts and cybercriminals who have a desire to access to our data and systems. Utilizing a password manager is a security best practice that cyber professionals are recommending for us.  

Along with other security tips, password managers minimize the risk of mis-managing our passwords. The question that arises here, are password managers secure, and what is our responsibility here to manage the password manager? 

What is a Password Manager?

A password manager is a software that allows users to generate passwords, store and manage accounts’ information including user names and passwords all in one location. Password managers offer other features such as complex password suggestions, identifying weak or repeated passwords used, and alerting its users from entering their credentials to suspicious websites. To create a password manager account, you need to set a password that is often referred to as the “master” password. 

Password managers are available in different formats: 

  • An online service hosted by a third party and accessed through a website portal. This type is useful if you need access to the password manager from multiple devices. 
  • Software installed locally on a workstation that can operate either completely offline or connected to the internet to synchronize your information to a cloud database and get software updates.  

Are Password Managers Secure? 

Password managers will offer users the security level they are looking for to their accounts’ credentials and information if they follow best practices to secure their password manager account.  Whether you use, or planning to get, an online, or an offline password manager, you need to follow the following practices: 

  • Do your research and get a trusted password manager software that has a high reputation in the industry. 
  • Use a strong master password for your password manager account and never forget it. Some password manager vendors would never retrieve your account if you can’t remember your master password. 
  • Enable two-factor-authentication (2FA) to your password manager account for an extra layer of security.  
  • Keep your password manager software along with web browsers you use up-to-date. 
  • Audit the list of devices that are approved to access your password manager. 
  • For work-related accounts, always use password managers that are approved by your organization. Follow your organization’s policies, standards and procedures when processing, storing or sharing work-related data. 

Remember, if password managers are managed appropriately, they will offer you the level of security you are looking for to your online accounts’ passwords. 

This blogpost is offered to you by the GW Information Security and Risk Services team. 

#SecuringGW is a shared responsibility, so if you see something, say something. Report suspicious digital activities, including phishing emails, to abuse@gwu.edu. 

IT Support Questions? For IT support, please contact the Information Technology Support Center at 202-994-GWIT (4948), ithelp@gwu.edu, or visit ithelp.gwu.edu. 

Published on

National Cybersecurity Awareness Month (NCSAM) is a month that helps raise awareness and highlight the importance of cybersecurity. Cybersecurity and Information Security overlaps with almost everything we do and every technology we use. NCSAM was started in 2004 by the National Cyber Security Alliance (NCSA) and the Department of Homeland Security (DHS). The creation of NCSAM was to help Americans be secure online. The month raises awareness for security and emphasizes both companies and individuals on how to protect themselves.

Over the years, NCSA and the DHS have put on joint events around many states for NCSAM. In the past events with panels of information security professionals have been done as well as talks and presentations. They have even done some summits around the states and webinars for all to join. This year they have panels, and presentations all around the country, including Washington, D.C. These events have had growing popularity each year and have had some high ranking and nationally recognized officials make appearances at these events.

Each year there are different themes. The themes are meant to emphasize a particular change in behavior that would help everyone be safer online. This year's theme is "Secure Our World" and more importantly #BeCyberSmart. This year’s theme aims to promote the idea that security should be a continuous process in which people and organizations make proactive decisions about their digital lives. Key areas will include staying safe online, using multi-factor authentication and good passwords setup as well how to avoid common cyber threats such as phishing and ransomware

Here at GWU, we are involved with NCSAM by spreading awareness through the university and by hosting our own events. We have events like meet and greets with the Information Security team, Cybersecurity Jeopardy, webinars, and presentations throughout the month of October. If you want to attend any events or have a chance at winning some of our excellent prizes this year, check out the event calendar here https://it.gwu.edu/it-events.

Published on

Information Security Photo Collage

People have a lot of pre-conceived notions about security teams and practices. While some misconceptions may be grounded in truth and others fairly outlandish, there is a lot going on behind the scenes that users may not see. From claims that we are all hackers wearing hoodies and doing nefarious deeds to the perception that we are here to get in your way, we will help you understand what is true, what is not, and why these perceptions might exist.

Myth #1: Security is just here to say no

Being at a university presents the unique challenge of providing the tools and technology necessary for students and faculty to research, learn, and achieve their goals. We must strike a difficult balance between the availability of those resources and the security of the university and our community. As security professionals, we do everything we can to enable safe and reliable access to the tools that the GW community needs to reach their goals. We are here to facilitate a safe IT environment in which all students, faculty, and staff can access the resources that they need, sometimes it sounds like, “no”, but what we are really requesting is modifications that reduce risk of exposure or breaches at GW.

Myth #2: Security only deals with technology

Many people believe that IT security only works on securing servers, reading logs, and other highly technical tasks. On the contrary, the security team has a wide range of responsibilities of which technology is only a part. The security team is continuously engaging with people and data in a multitude of ways. Often trying to help people protect themselves and the organization through a security awareness program or working directly with other teams to enhance security within their operations. They are constantly trying to improve way to protect the GW community’s data by updating policies, implementing best practices, and assessing security processes.

Myth #3: The security team is just a bunch of hackers

Just as many people think that the security team is nothing but hackers. This is far from the truth. Information security is a wide field with many specializations and it takes all sorts to be effective. While some members of the team might be highly technical penetration testers, their counterparts are security professionals focused on defensive security and protecting the GW network and assets from outside threats. Not to mention that members of the IT Security team range from awareness professionals working with people and outreach to analysts focused on identifying and reducing risk.

Myth #4: The security team takes care of security so I don’t have to

The security team works tirelessly to ensure that the GW community, information, and assets are as well protected as possible, but the team is not always the first line of defense. Security is your responsibility too. Our community is often the first line of defense when it comes to attacks from outside GW. Social engineering (aka tricking people and deceiving them) is a common tactic employed by attackers and encompasses phishing, piggy backing, and taking advantage of users in the workplace. All of this means that you, the user, needs to play a vital role in protecting the university, or, as we call it #SecuringGW. Protecting your own information is an essential puzzle piece to overall security of GW.  Catching phishing emails and forwarding them to abuse at GW may seem like a small task, but it is small actions like this that alert the team and protect GW from large breaches. Being aware of people trying to enter buildings where they don’t belong, and maintaining a clean desk free of sensitive materials are all security measures that you can take to do your part in #SecuringGW.

Fact: GW Information Security – Your Trusted Advisor

The information security team strives to facilitate access to the resources that the GW Community needs in as secure a manner as possible. Security affects everyone; data loss, lack of availability, and compromised systems impede day to day business functions, which means it affects the day to day lives of everyone on campus. In order to help prevent this, the security team acts as a Trusted Advisor to everyone in the GW Community. Whether you want to implement a new system, service, or application, or begin a new project, involving the GW security team as Trusted Advisors from the start enables us to aid in proper project oversight and completion while maintaining and promoting the confidentiality, integrity, and availability of GW’s data, systems, and services.

 

Published on
What is Social Engineering?

We frequently hear about cyber-attacks on organizations using highly technical and sophisticated methods, involving malware and vulnerabilities that most people don’t understand. However, what we don’t typically hear about is how the attacker got in. According to Verizon’s Data Breach Investigation Report, in 2019, a third of all data breaches involved social engineering attacks to include phishing, pretexting, and a variety of other social engineering methods.

Social Engineering involves gaining the trust of unsuspecting users via manipulation or trickery, in order to gain unauthorized system access, credentials, or commit fraud. Attackers will attempt to take advantage of a multitude of psychological traits such as carelessness, curiosity, empathy, complacency, and most frequently ignorance.

Why does it Matter?

Social Engineering attacks are more common than you might think and odds are that you will encounter one yourself in some form or another. Failing to recognize a social engineering attack could range from a minor inconvenience to a life changing event. Compromise from such an attack could lead to needing a password reset to having a bank account drained of funds, or could even be the launching point for the next massive data breach that makes headlines worldwide.

For example, the 2020 Twitter hack, which affected numerous high-profile accounts, resulted from a social engineering attack targeting employees. Similarly, the 2020 SolarWinds breach, one of the most significant cyber-espionage campaigns, involved social engineering tactics used against employees to gain access to critical infrastructure.

Social Engineering is a large threat to the safety of not just large organizations, but also the individual.

Social Engineering Life Cycle Image

Social Engineering Life Cycle

Much like software development and risk management, many cyber-attacks follow a lifecycle approach; with a continuing cycle of input and output constantly improving the process. Social engineering is no different and even has a few lifecycle models dedicated to it. In its simplest form however, the Social engineering lifecycle follows four basic phases: Investigation, Hook, Play, and Exit.

The Investigation phase is when an attacker performs their recon. They might choose their targets based on position within an organization, ease of access, or they might choose a wide range of targets just to see what sticks. After choosing a target they will use public information to learn as much as possible. Sources such as social media, company websites, and other profiles provide a wealth of information for attackers to use.

The Hook phase involves the initial interaction with the target; ranging from email to in person contact. During the hook, the attackers focus is on spinning a web of lies to manipulate victims at their will.

During the Play phase an attacker gains a stronger foothold and carries out the attack. Depending on their goals, they will begin disrupting or stealing sensitive and valuable data.

The Exit phase points to the end of the lifecycle. The Social Engineer will attempt to remove all traces of their presence and bring an end to their charade. Everything the attacker has gained or learned during the process is then used during a new attack cycle to more effectively con another victim.

Social Engineering and unaware users provide a vast attack surface that can be easily taken advantage of.  Meaning that you need to do everything you can to be prepared for and protect yourself from the conmen of the internet age.

Viewing Message: 1 of 1.
 Notice

This site uses cookies to offer you a better browsing experience. Visit GW’s Website Privacy Notice to learn more about how GW uses cookies.