PowerSchool is a California-based provider of cloud software to over 16,000 customers in more than 90 countries. The company informed its Manitoba customers on Tuesday that a cyber incident had occurred on Dec. 28 and that some specific student information had been compromised.

“There’s some conversations now, going around, that maybe they waited too long to inform people … it took until the beginning of January before people started to find out,” said David Gerhard, head of computer science at the University of Manitoba.

To read the entire article, please follow the link to CBC Manitoba. 

Common Phishing Email Gift Card Scams

Phishing email gift card scams rely on impersonation and social engineering tactics to engage with victims and ask them to purchase gift cards. The attackers often impersonate executives, supervisors, or trusted contacts, using a sense of urgency to pressure recipients into buying gift cards or transferring funds under the guise of a business requirement.

How to Recognize a Phishing Email

1. Unexpected Requests: Any sudden pleas for money or sensitive information should immediately raise suspicion. Verify these requests directly through a known phone number before taking any action.
2. Unverified Sources: Always verify the origin of a request through known, independent contact details. UM officials or departments will never ask for banking or personal details through unsolicited communication.
3. Sense of Urgency: Phishing emails often create a sense of urgency, pressuring you to act quickly without thinking. Be cautious of any email that demands immediate action.
4. Poor Spelling and Grammar: Many phishing emails contain spelling and grammatical errors. If an email looks unprofessional, it could be a scam.

How to Protect Yourself

• Verify Requests: If you receive an email asking you to buy gift cards, verify the request through official channels before taking any action. Call your supervisor or the person requesting the gift cards using a known phone number.
• Report Suspicious Emails: If you suspect a phishing email, report it to IST Service Desk or spam@umanitoba.ca.
• Stay Informed: Educate yourself about the signs of phishing emails and how to respond to them. Regular training and awareness programs can help prevent these scams.

Information Security Starts with You

The holiday season is a prime time for cybercriminals to exploit the generosity and busy schedules of shoppers. By staying informed and cautious, you can enjoy a scam-free holiday season. For more information on how to protect yourself from phishing scams, visit https://umanitoba.ca/information-services-technology/information-security-compliance/email-security

The project’s next implementation prioritizes the system’s security. On April 3, 2024, the VIP Evolution project will enable Entra MFA (multi-factor authentication) for VIP/ESS. Multi-factor authentication is a crucial tool in safeguarding the university’s sensitive data.

Entra MFA’s successful integration into numerous UM systems makes its extension to VIP/ESS an instrumental stride in fortifying data security.

What will change?

The most noticeable change will be the login experience for all users. As with other MFA-protected university systems, you will now log in using your email address and password instead of your UMNetID. You will then receive a message requesting you verify your identity through Entra MFA.

To prepare our employees for this modification, the VIP Evolution project conducted several information sessions and ran a soft launch to gather feedback. The project team found that the new authentication experience does not drastically impact the overall user experience. However, you will have to log in to VIP/ESS every time you want to access it.

“Validating the logout function is an important security feature to keep private information safe,” explains project architect Lonnie Smetana. “We will have to log in to VIP/ESS even if we are already logged in to university systems in a browser. We must also re-authenticate if we close our browser or if our VIP session times out,” Smetana adds.

What does it mean to you?

Before the implementation on April 3, 2024, all staff should ensure they have set up Entra MFA and are using either the Microsoft Authenticator app or a hardware token to verify their identity. For those already using it, the transition will be seamless – begin using it for VIP/ESS when prompted.

Ensuring our data is protected is a shared responsibility, and we all have a role to play in safeguarding our university from data breaches.

We welcome your feedback and suggestions regarding this change and thank you for your cooperation during this transition.

Please feel free to contact the IST Service Desk with any questions or concerns.

Use a strong and unique password that is hard to guess

Is your password the name of your pet or child? Easy to remember but also easy to find. Cybercriminals look for information that is readily available on social media and other online sources for clues to guessing your password.  

Try using a passphrase instead of a password. A passphrase is a mix of random words only you would think to combine. According to GetCyberSafe.ca, ideally, each passphrase would be at least four words and at least 15 characters long. A quick way to choose one is to look around and create a passphrase out of the first four words you see. For example, you might see a phone, tissue, lemonade and bracelet. The resulting passphrase would be entirely unique to you and almost impossible to guess!    

Don’t share your password

Not sharing your password is a fundamental cybersecurity practice. Following this principle helps protect your digital identity, keep your personal information secure and maintain control over your online presence. 

Change your password regularly

The University’s  Password Standard and Computer Accounts Usage Agreement requires everyone to change passwords and re-accept the usage agreement on an annual basis.  

Use a different password for each app and website

Use your university email address and password only for university accounts. In 2023, PayPal, Reddit, Discord, UPS Canada, Duolingo, Forever 21, and Freecycle were just a few of the popular sites that reported data breaches. Keep bad actors away from your university data by using your account information for University of Manitoba services only.  

Enable MFA in all accounts

Multi-factor authentication (MFA) pairs something you know (e.g., your password/UMNetID) with something you have (e.g., mobile phone or hardware token) to verify your identity when logging in to your account. MFA is required for all UM accounts.  

Enable MFA in your personal accounts where possible to add that extra layer of protection to your data.

This week’s challenge 

• Take five minutes to try this interactive learning module: Eight Ways to Strengthen and Secure Your Passwords Today!! 
• Enable multi-factor authentication on all your social media accounts.
• Ask a question and grab a snack at one of our Cyber Month info booths! 
  • Oct. 10 – University Centre – 10 a.m. to 12 p.m. 
  • Oct. 11 – Brodie Atrium – 10 a.m. to 12 p.m. 

To better protect the information used and shared by the university community, the information security policy, procedure and standards were developed and approved by the UM Board of Governors on Feb. 3, 2020. 

“Higher education institutions manage vast amounts of sensitive data involving finance, research, health and more, which makes them prime targets for hacking and malicious breaches of security,” says Patrick McCarthy, director, IST information Security and Compliance.

“With cyber threats and breaches increasing exponentially over the last few years and the requirement to have robust security controls in place to obtain cyber insurance, it is essential we all do our part to keep our data safe and protected.”

The policy, procedure and standards apply to everyone in the university, including visitors, because, as McCarthy notes, we all have a responsibility to keep our data safe and protected.

WHAT DO I NEED TO DO?

Read the policy, procedure and associated standards.

Some standards like the Password Standard apply to everyone, while others like the Workstation Patch Management Standard  apply to anyone responsible for managing, updating or maintaining computer systems.

Review these additional tips for online safety.

WHERE DO I GET MORE INFORMATION?

The purpose of the Information Security Policy is to:

• ensure the protection of all information and information systems;
• mitigate risks associated with theft, loss, misuse, damage or abuse of information systems;
• ensure staff, students, faculty and researchers are aware of and comply with provincial and federal legislation;
• minimize the university’s exposure to cyberattacks;
• ensure that information users understand their responsibilities; and
• protect the university from liability.

If you have any questions, concerns or would like more information about your responsibilities, email the Information Security and Compliance team directly at infosec [at] umanitoba [dot] ca.

Thank you for your continued help in ensuring the confidentiality, integrity and availability of the university’s data.

Remember: Information Security Starts with You!

The university’s Information Security and Compliance Team uses a number of tools to ensure your data is as safe as possible, but it is important that every individual who uses the network be aware of the tricks cyber criminals use to access our valuable information.

Over the last three years, the university has implemented a phishing simulation program to help staff and faculty recognize suspicious emails. This year, we are extending the program to students.

Monthly phishing simulations

Starting this October, some students will receive a suspicious looking email message in their myumanitoba.ca Inbox. The phishing simulation messages are designed using popular social engineering techniques and contain common markers that identify a suspicious email message.

These tests will continue every month to the end of the Fall-Winter school year.

What is phishing?

Cybercriminals use phishing—a type of social engineering—to manipulate people into doing what they want. Social engineering is at the heart of all phishing attacks, especially those conducted via e-mail.

Social engineering is the art of manipulating people so they give up confidential information.  Perhaps you’ve seen an email that looks like it came from TD Bank asking you to click on a link, and the link went to a website asking for more personal information? This is an example of social engineering. Attackers will try to fool you into believing they are trustworthy.

Phishing Checklist

Use the checklist below to verify the message. If the message matches one or more the criteria below, DELETE it or forward it to spam[at]umanitoba[dot]ca for confirmation.

Any message from an unknown sender could be a phishing email:

1. Does the address match the sender name? If there is no match, it could be a phish
2. Is the email signature too generic? If there is only a name or title at the bottom of the message, then it could be suspicious.
3. Do the name and URL match? Think before you click. Mouse over links in email to reveal their true URL. If the name and the URL do not match, DELETE the email.
4. Does it contain an unexpected attachment? They are a cybercriminal’s #1 choice for spreading malicious software.
5. Does that email feel ‘off’ in some way? It probably is. Forward it to spam[at]umanitoba[dot]ca to confirm the message.
6. Is it urgent? Slow down. An “IMPORTANT MESSAGE” may be a phishing attempt. Cybercriminals want you to do what you’re told, when you’re told.

Don’t be fooled.  Information Security Starts With You!

Go to the Information and Security Compliance website for more information and for list of the latest phishing alerts.

Compared to last year, the simulation saw a slight decrease in the number of people who clicked the link — 6.7% compared to last year’s 6.8%. 

The results also showed that of the 6.7% who clicked the link, many were repeat offenders.

“Given the global coverage of our community, this is not surprising,” says David Treble, IT Security Officer. “Sometimes users travelling outside the country are more apt to click links that stress urgency or action, as they may not wish to be inconvenienced while travelling.  Other times a phishing email may be timed nicely with real life events, like tax time. ”

Regardless,  the trend over three years of the same phishing simulation shows a gradual decrease in staff and faculty who click the link. 

To avoid falling for a tax-phishing scam, follow these three simple tips:

• Don’t open it. Most tax-related government agencies do not initiate contact by email, text message or social media. If the email mentions tax forms, it is likely a scam. Either delete the email or forward it to spam@umanitoba.ca for review.
• Verify the sender. Don’t assume an email is legitimate by looking at the header– it’s easy to fake a From: or Reply-to: Call the sender to confirm the request is legitimate.
• Check if the URL is correct. Don’t be misled by sites claiming to be a government agency or tax-software company. Just mouseover any link to verify the URL it is really linked to. Make sure URLs are spelled correctly too. 

Think before you click!

About email simulations

Simulated email messages provide a realistic experience in a safe and controlled environment. They are designed to help us recognize and resist tactics used in real phishing attacks.

Periodic simulations will continue as a part of the university’s Cyber Security Awareness Campaign.

Remember, information security starts with you!

For more information about phishing attacks, visit the Information Security and Compliance web page at http://umanitoba.ca/computing/ist/security/phishing.html.

Students are now required to change their email password and re-accept the account user agreement annually. A strong password is an important step in blocking attempts to access your data. That’s why the university’s new password policy requires everyone to have a password that’s a minimum of 10 characters long, with at least one uppercase character, one lowercase character and one number.

If you haven’t changed your password yet, here is your chance to do so and be rewarded with a free snack before you receive your expiry notification.

Watch this quick animation for more about email and password security.

The Mobile Service Desk will be available at both campuses on the following days and times:

Fort Garry
University Centre
Tuesday, October 23 and Wednesday, October 24
9:00 am – 12:00 pm

Bannatyne
Brodie Centre Atrium
Wednesday, October 24
1:00 pm – 4:00 pm

Also during Cyber Security Month: Don’t forget to view the Phishing module in UM Learn for your chance to win a new iPad and enter our Cyber Security Poster contest.