Be Cyber Savvy

“My account has been hacked!”  

We hear this regularly, but in almost every case that is not an entirely true statement. 

Hacking involves a person using technical methods to find a way around the security of systems and expose data that was supposedly secure.  Yes, such security breaches happen and when they do they make headline news.  But when a single personal account is compromised, “hacking” is usually not the reason.  In almost all cases of individual account compromises, we are simply fooled into giving away our private data or account credentials to a scammer.  It isn’t very high tech.

Protect yourself.  

• Take the time to learn about “Phishing” and “Spear Phishing”.  This is something that anyone using technology should be doing. It is like being a pedestrian and learning how to safely cross the street, we just have to do it. Check out the “Valparaiso University Phishing Awareness” video at YouTube.  It is a VERY good video done by a Google Apps school.
• Avoid randomly clicking on unfamiliar web links that pop up in a search result or in an advertisement. 
• Don’t use a single password for all of your accounts. When you do, one mistake compromises ALL of your accounts!  

New security threats.

• Nearly all of us are carrying a smart phone now which is, in essence, a small computer.  And like all computers these phones can be infected with malware.  We need to be using the same security techniques with our phones as we do with our computers:  
• keep the software on your phone updated 
• install software to help protect from malware.  There are some decent options out there for free.  One unfortunate employee recently had spam spewing from their e-mail account and it appears the source of the problem was malware on their Apple iPhone.
•  As we all become more inclined to use the internet for shopping we have to remember to never use our Harding passwords for our other online accounts (Amazon, WalMart, etc.)  We know it's a bother to keep up with more than one password but please reserve your Harding password strictly for Harding use. Consider using tools like LastPass to manage your passwords.

Please ensure that your Harding password is different from other passwords you may use for your personal accounts.

What's new in office computing?

New update service

We are slowly implementing a new service that installs updates to a wide array of software on Windows computers.  Languard is scheduled to work overnight, as are most anti-virus scans, so you will want to leave you computer on overnight to avoid the having these things run during the day while you are trying to work.  We plan to evaluate the Apple version of the same product soon.

Secure Off Campus Connections

Harding now has a solution which will help protect your data when you must use your Harding laptop from an off-campus network.  Fortinet creates a secure connection to the campus network which not only protects any sensitive data you might need to access, but also gives you access to your M: drive and other departmental storage. Over the next few months we plan to install it on all Harding laptops.

New software

New software from Microsoft and Apple is being tested to make sure it works will with our campus tools.  Soon we will be looking for volunteers to help us test Windows 10, Mac OS 10.11 (El Capitan), and Office 2016 for Macs.  Once these are determined to be safe we will begin offering upgrades and training for those who would like to upgrade.  FYI Office 2016 is now available for iOS devices and it's free!

The material for this entry was written by Jim Baird and John Nunnally. Thank you Jim and John.

Hackers post millions of stolen Gmail passwords on Russian site - Are Harding's passwords safe?

No doubt many of us have seen a headline over the last few days about stolen Gmail passwords appearing on a Russian website. If you haven't you can read some news about it here: Hackers post millions of stolen Gmail passwords on Russian site.

As you know Harding uses Google as our email service. So are our passwords safe?

There is an article in this weeks issue of Computerworld that talks about the issue in general: What you need to know about the Gmail Password Compromise.

More specifically in regard to Harding passwords, John Nunnally advises the following:

"The Russians are releasing the data they have a little bit at a time to keep the story "hot", if for no other reason.  Four days ago they released these five million or so gmail accounts and their passwords.  ...Google is aware of no security breach that allowed this information to be accessed.  They believe these five million accounts were compromised by phishing schemes and malware that does keyboard logging, etc.  In other words, these gmail owners effectively gave away their account information.

Harding.edu accounts are not gmail.com accounts even though Google hosts our harding.edu accounts. So I seriously doubt this list of five million gmail accounts includes any harding.edu accounts.  But that does not mean these Russians do not have some harding.edu accounts in the billion or so account credentials they collected.  I spend a lot of time dealing with Harding accounts that have been compromised, so certainly a number of our Harding users give their credentials away just like these gmail account owners did.

Our conclusion at the time of the original August report was that most of the data was so old that it was of little consequence to most of us. Harding requires regular password changes which all but guarantees that any "old" passwords have been aged out already.  But of course if anyone is ever concerned, they are encouraged to go to password.harding.edu and change their password. They certainly do not have to wait until they receive expiration notices.

As a matter of record -- Anyone with accounts anywhere with passwords over a year old should change them immediately.  Once a year is certainly not too often these days. Hackers do not want you to know that they have your password.  So usually the only way you find out you have been hacked is when you realize your account has been abused. The primary defense we have is to change our passwords regularly in hopes that, if we are hacked, we will have changed our password before the bad guys get around to using it."