Staff and faculty are required to regularly log in to the university network to maintain to the activation of software licenses and to receive security patches and software updates.

This October, you will be encouraged to add an additional security factor when signing in to the virtual private network (VPN).

What is MFA?

Multi-factor authentication or MFA adds an extra layer of security to your university accounts to protect you, your data and university systems from unauthorized access and phishing attacks. 

Verifying your identity using a second factor such as your phone or mobile device prevents others from accessing your accounts, even if they know your password.

“Traditional security methods like passwords are no longer enough,” says Patrick McCarthy, director of information security and compliance. 

“Bad actors have become skilled at exposing the weaknesses of password-based authentication. One effective method to successfully mitigate this vulnerability is adding an additional security layer with multi-factor authentication.”

How does it work?

Using multi-factor authentication is simple:

1. Self-enroll by registering your phone or mobile device in Duo. You only have to enrol once.
2. Use Pulse Secure to connect to the VPN and enter your username and password.
3. Use your phone or mobile device to verify your identity.
4. You’re securely logged in!

Note: If you are unable to use a mobile device for MFA, please contact the IST Service Desk at 204-474-8600 for more options. 

Why is it important?

With an increase in remote work, more staff are using the virtual private network (VPN) to connect to a variety of systems, using both university-managed and personal home computers. 

And, because VPN is accessible from anywhere on the Internet, cyber security advisers expect VPN attacks to increase. Non-profit cyber security agencies and government bodies like the Canadian Centre for Cyber Security strongly recommend that organizations enable multi-factor authentication to protect VPN accounts from unauthorized access.

The university will begin rolling out multi-factor authentication to all staff and faculty VPN users starting October 13, 2020.  You will receive an email notification and enrollment instructions when MFA is rolled out to your area.

Win a prize!

Enrol in Duo and use multi-factor authentication to connect to the VPN this October and November to qualify! Visit our Cyber Security Awareness Month website for contest details.  

If you have any questions or concerns about this new initiative, please contact the Service Desk at 204-474-8600.

Compared to last year, the simulation saw a slight decrease in the number of people who clicked the link — 6.7% compared to last year’s 6.8%. 

The results also showed that of the 6.7% who clicked the link, many were repeat offenders.

“Given the global coverage of our community, this is not surprising,” says David Treble, IT Security Officer. “Sometimes users travelling outside the country are more apt to click links that stress urgency or action, as they may not wish to be inconvenienced while travelling.  Other times a phishing email may be timed nicely with real life events, like tax time. ”

Regardless,  the trend over three years of the same phishing simulation shows a gradual decrease in staff and faculty who click the link. 

To avoid falling for a tax-phishing scam, follow these three simple tips:

• Don’t open it. Most tax-related government agencies do not initiate contact by email, text message or social media. If the email mentions tax forms, it is likely a scam. Either delete the email or forward it to spam@umanitoba.ca for review.
• Verify the sender. Don’t assume an email is legitimate by looking at the header– it’s easy to fake a From: or Reply-to: Call the sender to confirm the request is legitimate.
• Check if the URL is correct. Don’t be misled by sites claiming to be a government agency or tax-software company. Just mouseover any link to verify the URL it is really linked to. Make sure URLs are spelled correctly too. 

Think before you click!

About email simulations

Simulated email messages provide a realistic experience in a safe and controlled environment. They are designed to help us recognize and resist tactics used in real phishing attacks.

Periodic simulations will continue as a part of the university’s Cyber Security Awareness Campaign.

Remember, information security starts with you!

For more information about phishing attacks, visit the Information Security and Compliance web page at http://umanitoba.ca/computing/ist/security/phishing.html.

According to the Canada Business Network website, “There are many social engineering tactics, but the basic idea is the same for all: a hacker will pretend to be someone they are not, and will try to trick or bully someone into giving away sensitive information that the hacker needs to carry out their attack.”

Technology makes manipulation through phishing easy. Setting up and operating a phishing attack is fast, inexpensive and low risk: any cybercriminal with an email address can launch one.

According to Verizon’s 2017 Data Breach Investigations Report, the education sector saw a rise in social engineering–based attacks. Students, staff, and faculty all lose when personal data and research are disclosed to unauthorized parties.

Phishing played a part in more than 40 per cent of these breaches. Knowing what you’re up against can help you be more secure in your online life. 

Here are the six signs of a suspicious email:

1. Stranger danger: A sender address that does not match the sender name
2. No John Hancock: A signature that is overly generic
3. Hover to discover: Mouse over links in email to reveal their true URL. If the name and the URL do not match, delete the email.
4. Do not open unexpected attachments: They are a cybercriminal’s #1 choice for spreading malicious software.
5. Trust your instincts: Does that email feel ‘off’ in some way? It probably is. Forward it to spam[at]umanitoba[dot]ca to confirm the message.
6. Is it urgent? Slow down. An “IMPORTANT MESSAGE” may be a phishing attempt. Cybercriminals want you to do what you’re told, when you’re told. Think before you click.

If an email you’ve received contains two or more of the indicators listed above, delete it or forward the message to spam[at]umanitoba[dot]ca.

For more information about phishing attacks, visit the Information Security and Compliance web page at http://umanitoba.ca/computing/ist/security/phishing.html.

Our Information and Security Compliance staff works diligently to ensure that your computing information is protected all year round. This means improving our practices around network security, e-mail security and device security, in addition to the daily monitoring and reporting of cyber threats.

The new identity and access management system — signUM — is part of these efforts to maximize the security of your personal data. It supports the U of M password standard, which requires users to create a 10-character password that must be changed on an annual basis.

Since the Internet is always “on,” individuals must also remain vigilant to protect personal information and mobile devices — including laptops, tablets, smartphones, and wearable technology.

Here are some tips:

• Add a passcode to your cell phone, tablet, or laptop right now!
• Use strong passwords or passphrases, especially for online banking and other important accounts.
• Enable multifactor authentication wherever possible. This helps secure your accounts by requiring hardware or biometrics in addition to your password.
• Check your social media settings. Enable two-step verification whenever possible.
• Educate yourself. Stay informed about the latest  security issues such as malware and phishing on the IST website.  Review these online safety practices from the Government of Canada.

READ MORE

• Think before you click!
• Phishing attacks: Identifying malicious links in your email
• Protect yourself and the university against phishing attacks
• Beware of malicious attachments
• Protecting sensitive data

Visit the IST website for more about Information Security and Compliance at the U of M.