However, third party audits and UM internal investigations have identified numerous security and privacy concerns, including a lack of data transport layer security and several below standard data encryption practices. DeepSeek also collects extensive data (including personal information) and, as a result of insecure practices, this data is at risk.

These concerns have prompted the Canadian federal government and several Canadian universities to take precautionary action by banning the use of DeepSeek.

After careful review by IST and the Provost Office, several recommendations were proposed to safeguard the safety and privacy of UM members. These recommendations have been approved by the President’s Executive Team and the following regulations now apply to all UM students, faculty, and staff.

New regulations:

1. All members of UM must remove DeepSeek from any UM owned devices or any other devices (including personal devices) that connect to the UM network.
2. IST will block the DeepSeek domain and URL’s on the UM campus firewall.
3. IST will block DeepSeek (via Intune and Defender application firewall) on any devices that are managed with Intune or Defender applications.

Exceptions may be considered for academic purposes. Please contact Information Security and Compliance via the IST Service Desk for more information.

The UM Artificial Intelligence (AI) Committee is in the process of establishing an AI Framework for the university.

These restrictions are issued under the UM Use of Computer Facilities Policy and the Information Security Policy. Non-compliance may be addressed through appropriate remedies in accordance with UM policies.

“Canadian researchers are at the cutting edge in many important emerging fields, including AI, quantum technology, biosciences, and clean technologies. These leading practices will help to ensure Canadian research stays secure,” said Chad Gaffield, CEO of U15 Canada. “Our universities recognize that research is a global enterprise, and our aim is to help make Canada’s research ecosystem as open as possible and as secure as necessary.”

Open collaboration internationally, with other research institutions, and locally, with community and industry partners, is fundamental to research success at UM. Later this year the federal government is expected to release new requirements for research collaborations in sensitive research areas. The Office of Research Security is working to ensure that new practices can be implemented seamlessly, without creating a burden for researchers.

“UM is committed to upholding the safety and protection of research knowledge, data and intellectual property for the benefit of Canada’s entire research community,” says Mario Pinto, Vice-President Research & International. “That is why the Office of Research Security is taking additional measures to safeguard research and intellectual property from interference and espionage. This new unit is dedicated to identifying and addressing potential security risks and collaborating with partner institutions to ensure UM’s continued leadership in this area.”

If you work in a sensitive research area or wonder how the new guidelines may impact your work, please email for one-on-one advice: Research.Security@umanitoba.ca

The Office of Research Security is also supported by the Research Security Fund.

To better protect the information used and shared by the university community, the information security policy, procedure and standards were developed and approved by the UM Board of Governors on Feb. 3, 2020. 

“Higher education institutions manage vast amounts of sensitive data involving finance, research, health and more, which makes them prime targets for hacking and malicious breaches of security,” says Patrick McCarthy, director, IST information Security and Compliance.

“With cyber threats and breaches increasing exponentially over the last few years and the requirement to have robust security controls in place to obtain cyber insurance, it is essential we all do our part to keep our data safe and protected.”

The policy, procedure and standards apply to everyone in the university, including visitors, because, as McCarthy notes, we all have a responsibility to keep our data safe and protected.

WHAT DO I NEED TO DO?

Read the policy, procedure and associated standards.

Some standards like the Password Standard apply to everyone, while others like the Workstation Patch Management Standard  apply to anyone responsible for managing, updating or maintaining computer systems.

Review these additional tips for online safety.

WHERE DO I GET MORE INFORMATION?

The purpose of the Information Security Policy is to:

• ensure the protection of all information and information systems;
• mitigate risks associated with theft, loss, misuse, damage or abuse of information systems;
• ensure staff, students, faculty and researchers are aware of and comply with provincial and federal legislation;
• minimize the university’s exposure to cyberattacks;
• ensure that information users understand their responsibilities; and
• protect the university from liability.

If you have any questions, concerns or would like more information about your responsibilities, email the Information Security and Compliance team directly at infosec [at] umanitoba [dot] ca.

Thank you for your continued help in ensuring the confidentiality, integrity and availability of the university’s data.

Remember: Information Security Starts with You!

Security analysts are already warning Canadians to watch out for COVID-19 vaccine scams. We also continue to see an increase in fraud scams during tax season.

Protect yourself against fraud this tax season and throughout the year by learning how to recognize, reject and report a scam. 

Recognize

Fraudsters will use any communication vehicle–phone, email, text message, letter, website, social media–to try to get you to give up your personal information. Don’t let them.

You can recognize a scam by the urgency of the message and by the direct request for personal information such as a credit card number, bank account number or your bank account password. 

The University of Manitoba will never:

• Ask you for your login credentials or personal information by email.

The Canada Revenue Agency will never:

• Demand immediate payment by Interac e-transfer, bitcoin, prepaid credit cards or gift cards from retailers such as iTunes, Amazon, or others.
• Give or ask for personal or financial information by email and ask you to click on a link.
• Send you an email with a link to your refund.
• Threaten you with arrest or a prison sentence.
• Use text messages or instant messaging such as Facebook Messenger or WhatsApp to communicate with taxpayers about tax-related issues under any circumstance.

Source: Read more at Slam the scam!

Reject

Watch for the external message notice at the top of any email you receive to your UM email address. If the message comes from a person or organization you don’t recognize, delete it!

• Don’t react to scare tactics: All these attacks depend on scaring you, such as with a lawsuit or criminal charges, that your computer is full of viruses, or that you might miss out on a chance at a great interest rate. Don’t fall for it!
• Verify contacts independently: Legitimate companies and service providers will give you a real business address and a way for you to contact them, which you can independently verify on a company website, support line, etc.
• Know the signs: Does the message/phone call start with a vague information, a generic company name like “card services,” an urgent request or threat and/or an offer that seems impossibly good? Hang up or click that delete button!

Source: Protect yourself against fraud this tax season 

Report

Forward any suspicious messages to infosec[at]umanitoba[dot]ca.

Fraud Prevention Month phishing simulation

To help you recognize, reject and report an email scam, the university will be sending a phishing simulation email to all staff and faculty during Fraud Prevention Month this March.  Watch out for any suspicious messages in your Inbox and slam the scam!

Canadian anti-fraud resources

• Slam the scam – Protect yourself against fraud – Canada Revenue Agency
• National Cyber Security Alliance
• Canadian Anti-Fraud Centre
• Report fraud and cybercrime – Canadian Anti-Fraud Centre

1^st Prize

Philip Dufresne
Asst to Head/Administrative Asst, Biochemistry & Medical Genetics

2^nd Prize

James Nagy
Professor, Physiology & Pathophysiology

3^rd Prize

Richard Hodges
Director, Animal Care & Veterinary Services

Congratulations to the winners and a big thank you to everyone who participated in our Duo Enrolment Contest!

Using multi-factor authentication is a convenient and effective way to keep our systems as secure as possible. If you haven’t already, please set up multi-factor authentication for logging into the VPN today. Find the Duo set-up instructions and more information about multi-factor authentication at UM multi-factor authentication.

Remember: Information Security Starts with You!

• Maintain the activation of your Microsoft Office (M365) and Windows licenses
• Receive security patches and software updates

If you are working remotely and use a UM-provisioned computer, using the virtual private network (VPN) will help you keep your device up-to-date and secure.

What is VPN?

VPN is used to allow offsite users to access secured or restricted resources. It allows the authentication and encryption of data between your computer and the campus network.

VPN also provides an extra layer of security for public or unsecure Wi-Fi networks—if you are working at a coffee shop or a library, for example.

VPN access is required for the following systems:

• Shared drive access
• Home (H:) drive access
• Cisco Jabber Softphone
• VIP access to full tool
• Libraries – Alma Administrator access

See: How to install and set up VPN

How often do I have to connect?

Log in to VPN at least once a week and leave it logged in overnight even if you are not accessing these systems regularly. This will ensure that your computer will receive all important security patches and software updates.

If you have any questions about VPN and the security of the university’s network, please contact the Information Systems and Technology security team at infosec[at]umanitoba.ca.

Remember: Information Security Starts With You!

“Systems used to process, store, retrieve and transmit information play a vital role in the conduct and success of the UM’s teaching, learning, research, outreach and business processes,” says Patrick McCarthy, director of IST Information Security and Compliance.

“The Information Security Policy will also enable us to reduce the impact of the cyber threats all organizations and educational institutions are facing,” he adds.

The policy, procedure and standards apply to everyone in the university because, as McCarthy notes, we all have a responsibility to keep our data safe and protected.

The purpose of the Information Security Policy is to:

• ensure the protection of the all information and information systems;
• mitigate risks associated with theft, loss, misuse, damage or abuse of information systems;
• ensure staff, students, faculty and researchers are aware of and comply with provincial and federal legislation;
• minimize the university’s exposure to cyber attacks;
• ensure that information users understand their responsibilities; and
• protect the university from liability.

Developed by the Information Security and Compliance team, the draft policy and procedure were reviewed by units including human resources, the office of legal counsel, audit services, access and privacy and the unions across the university prior to ratification.

What do I need to do?

Read the policy, procedure and associated standards.

Some standards like the Password Standard apply to everyone, while others like the Workstation Patch Management Standard  apply to anyone responsible for managing, updating or maintaining computer systems.

Where do I get more information?

If you have any questions, concerns or would like more information about your responsibilities, email the Information Security and Compliance team directly at infosec@umanitoba.ca.

Thank you for your continued help in ensuring the confidentiality, integrity and availability of the university’s data. 

Remember: Information Security Starts with You!

Examples of COVID-19 Scams

• Fabricated notices from health organizations (e.g., the Federal Government, CDC, WHO or local health departments).
• Phony websites containing maps and dashboards
• Information about protecting yourself, your children or your community that contains malicious links or attachments
• Charitable appeals, claiming to help victims of the virus, which are not legitimate
• Misleading ads or spam about masks or other protective gear, or other helpful hints to combat the virus.

What Can You Do? 

Be vigilant for Coronavirus-COVID-19 scams during the coming weeks. If you suspect a message may be a phishing scam, please report it by forwarding the email message as an attachment to spam@umanitoba.ca.

1. Rely on established lines of communication from the university for your updates. Important announcements and information will be posted on the university’s Coronavirus webpage: http://umanitoba.ca/coronavirus.
2. Be cautious about opening any Web links or attachments even if you know the sender, as they may be from a compromised account.
3. Look for red flags in emails you receive. Red flags include abnormalities in the sender, topic, links, content, etc. Tips for spotting phishing scams—along with detailed instructions for reporting suspicious email messages—are available on our Email Securityweb page.
4. Contact spam@umanitoba.ca whenever you have any doubts or concerns about a message you have received. Our security team will investigate and follow up with any necessary warnings to you and the university community.

Vigilance is key. Reporting suspicious messages is the best way for us to combat the attacks.

Remember, information security starts with you!

Make sure you’re on the lookout for these variants on the traditional, mass email phishing attack:

• Spear phishing: This kind of attack involves often very well-crafted messages that come from what looks like a trusted VIP source, often in a hurry, targeting those who can conduct financial transactions on behalf of your organization (sometimes called “whaling”).
• SMiShing: Literally, phishing attacks via SMS, these scams attempt to trick users into supplying content or clicking on links in SMS messages on their mobile devices. Flaws in how caller ID and phone number verification work make this an increasingly popular attack that is hard to stop.
• Vishing: Voice phishing, these are calls from attackers claiming to be government agencies such as Canada Revenue Agency, software vendors like Microsoft, or services offering to help with benefits or credit card rates. Attackers will often appear to be calling from a local number close to yours. As with SMiShing, flaws in how caller ID and phone number verification work make this a dangerous attack vector.

Social engineering attacks are getting harder and harder to recognize. But no matter the medium, follow these techniques to help prevent getting tricked:

• Don’t react to scare tactics: All of these attacks depend on scaring you, such as with a lawsuit or criminal charges, that your computer is full of viruses, or that you might miss out on a chance at a great interest rate. Don’t fall for it!
• Verify contacts independently: Financial transactions should always follow a defined set of procedures, which includes a way to verify legitimacy outside email or an inbound phone call. Legitimate companies and service providers will give you a real business address and a way for you to contact them back, which you can independently verify on a company website, support line, etc. Don’t trust people who contact you out of the blue claiming to represent your company.
• Know the signs: Does the message/phone call start with a vague information, a generic company name like “card services,” an urgent request or threat and/or an offer that seems impossibly good? Hang up or click that delete button!

*Adapted from Educause article: April 2019: Whaling, SMiShing, and Vishing…Oh My!

More Information

• CBC News: Interac e-transfer tax refund scam circulating among students 
• Slam the scam – Protect yourself against fraud – Canada Revenue Agency
• ‘Buy me a prepaid VISA’: Be wary of gift card request scams that seem to be from people you know
• National Cyber Security Alliance
• Canadian Anti-Fraud Centre

When you use your university credentials to log into non-university services like Dropbox, Twitter or Facebook, you risk your information getting into the hands of a hacker.

Take steps to protect yourself and the university:

• Use a different username and password for each online service you access
• NEVER use your U of M credentials for any non-university services
• If you have to use your U of M email address for an online service, use a DIFFERENT PASSWORD

Data breaches occur more often than you think. Sites like LinkedIn, Evite, Canva and Houzz have all experienced data breaches in the last two years. The person or group behind a breach counts on the fact that between 31% and 55% of people use the same login credentials at multiple sites . Once they have your username, email address, password and possibly other personal information, they will attempt to access other sites with your login, including U of M’s systems.

This is why the university continues to improve our cyber security safeguards by requiring a yearly password change, and by introducing device encryption to ensure that your data is only readable with a password.

Read More

• A new initiative to protect university data is underway!
• Password and usage agreements expiring next month