Congratulations to the winners of a $25 UM BookStore gift card!

Students:

• Brian Toor
• Ann Ahn
• Jacalyn Grey
• Karen Livingston
• Camila Chacon
• Jordyn Lerner
• Viktor Popp
• Kha Pham
• Vahid Askarpour
• Peter Gailis

Staff:

• Janice Winkler
• Doreen Davies
• Emily Falk
• Heidi Adamko
• Louella Yambot
• Helen Wong
• Andrew Murray
• Isam Al-Darabsah
• Lisa Lausch
• Brian Lithgow

Opt-in to MFA to be entered to win 

Using multi-factor authentication (MFA) is essential to keep our systems as secure as possible. If you haven’t already, please take the time to opt-in to MFA with Duo today. For more information, visit http://umanitoba.ca/dotheduo 

Note: You do not need to opt-in if you are already using Duo MFA for any university service. Duo MFA is available to all faculty, staff, and students. 

Important note:
If after enrolling in MFA you cannot send or receive email from some of your devices, or you are continually prompted to enter your login information when trying to access your email on one or more of your devices, you will need to remove and re-add your email account.

• Instructions for Mac and iOS (PDF)
• Instructions for Windows: Remove an email account, Add an email account
• Instructions for Android: Add or remove an account on Android

Information Services and Technology (IST) will be applying MFA to Microsoft 365, UM Intranet, UM Zoom, VPN and other services and applications this year. Using Duo helps protect these systems and your data from cyber fraud attempts because it requires you to verify your identity after entering your password.

According to Zdnet.com, 99.9% of compromised accounts did not use multi-factor authentication (MFA).

To help you get started with MFA and Duo, we are challenging you to ‘Do the Duo.’

How do I Do the Duo?

Get started using Duo in just two steps:

1. Opt-in to MFA using the online form.
2. Enrol your phone or mobile device in Duo.

Please note that once you have opted into using MFA, you will be asked to verify your identity with a second factor (Duo) for all MFA-protected systems and services at the university.

Important:
If after enrolling in MFA you cannot send or receive email from any of your devices, or you are continually prompted to enter your login information when trying to access your email on any of your devices,  you will need to remove and re-add your email account.

• Instructions for Mac and iOS (PDF)
• Instructions for Windows: Remove an email account, Add an email account
• Instructions for Android: Add or remove an account on Android

Win great prizes!

Starting this week, everyone using Duo multi-factor authentication (MFA) will be eligible to win some great prizes in weekly draws! If you are already enrolled Duo MFA, your name will be automatically entered in all prize draws.

Prizes include:

• Weekly draws for $25 UM BookStore gift cards
• Early bird draw for a Dell Latitude notebook
• Grand prize draws for an iPad 9 and iPhone 13

The first draw is on February 4, and the list of winners will be published in UM Today weekly.  For more information about the Do the Duo Challenge, visit http://umanitoba.ca/dotheduo.

MFA adds only seconds to the authentication process while greatly increasing security for you and the university.

Last week, the university launched MFA to access the virtual private network  and Information Services and Technology received some great feedback !

The MFA web page answers many questions about using multi-factor authentication but we wanted to provide you with the answers to some of the most asked questions so far.

MFA questions

Do I have to use a smart phone to authenticate with Duo?

No. Using your smart phone with the Duo Mobile app is the recommended method to verify your identity to log in to the virtual private network. But if you can’t use a smart phone, there are other options:

Text message

• You can choose to receive a text message to your mobile phone. This would require a texting plan on your device.

Phone call to a number

• You also have the option of using a landline for authenticating.  However, keep in mind that you would have to change your authentication number if you are away from your landline. Work phone of course requires either being on campus, call forwarding or a soft phone setup like Jabber.

Hardware token

• You can also use a hardware token such as the DUO keys. This is a thumb-drive sized fob that you must carry with you. Please contact the IST Service Desk to inquire about getting one.

Is multi-factor authentication required on campus?

No. You don’t have to log in to the virtual private network (VPN) while on campus. Multi-factor authentication is currently only required for logging in to the VPN from an off-campus location.

Who has to use multi-factor authentication?

Currently, only staff and faculty will be required to use multi-factor authentication.

Is multi-factor authentication easy to set up?

Yes. Enrolling in the Duo Security service is straightforward , and you only have to do it once.

To initiate multi-factor authentication, you will have to create a new virtual private network (VPN) connection in Pulse Secure. Then, using the new connection, you will enrol in the Duo service and choose your second factor option. It takes about five minutes to set up your new VPN connection and another five to ten minutes to enrol in Duo. That’s it!

When do I have to enrol?

The university is gradually rolling out multi-factor authentication. When Information Services and Technology has determined that your faculty or unit is ready, you will receive an email notice informing you that you can enrol in Duo and set up multi-factor authentication.

Can I avoid using multi-factor authentication altogether?

No. Staff and faculty will be required to use multi-factor authentication to log in to the virtual private network (VPN) in the near future . If you enrol in Duo and start using multi-factor authentication now, you don’t have to worry about losing access to the VPN. And you will have the opportunity to win some fabulous prizes !

Remember: Information Security Starts with You!

These five tips will help you—and all of us—stay cyber safe!

1. Use the VPN

The university’s Virtual Private Network (VPN) gives you the ability to securely connect to the university’s network, allowing you access to the same university file servers that you usually access while at work on campus.

Find instructions to install and use VPN on our Tools for working remotely web page.

Don’t forget to disconnect from the VPN when you are done working for the day.

2. Be conscious of where you’re storing data

Protect your data by storing sensitive documents on the available network storage, not on your local device.

Sensitive documents temporarily stored on a local device should be copied to the university local network storage and deleted after use.

3. Use your university-issued device

Your university-issued device is the best tool to use when working remotely. If you have a university-issued laptop or device, check with your IT support staff to ensure that the operating system and applications are up to date.

Beware if you are using a shared computer. Working on a home device used by other members of your household for entertainment, gaming or filesharing creates an opportunity for malicious code that may be running on your home machine to ‘jump’ onto the university’s network.                                                               

A note about personal devices

If you must use a personal computer to work remotely, ensure it is updated with the latest versions of the operating system and applications. Do not disable any security protections such as anti-virus or firewalls.

4. Protect your mobile device 

You can access university email and accounts from your personally owned or university-issued mobile device. Lost mobile devices (and the data they possess) are of particular concern to the university. Ensure that adequate protection is in place on your devices by using strong passwords, lock screens and encryption.

5. Beware of scams and phishing!

Scammers may seek sensitive information, payments, gift cards, etc. They may contact you via email, text, phone or social media—and may pretend to be a trusted colleague or someone on the executive level. 

It is easy to create an email address and then pretend to be a dean or department head. Even if you recognize a phone number or email address, be sure to confirm every request for sensitive information via a trusted means of communication such as an UM directory phone number. 

“We have seen a dramatic rise in the reported number of gift card scams over the past few months,” says David Treble of the information security and compliance team.

“Any email that leads off with a brief ‘Are you available?’ or ‘I need you to do me a favour,’ should immediately be suspect. It is important that the entire university community participate in cybersecurity because anyone can be a target.”

Send it to spam@umanitoba.ca and we can verify if it is legit. 

Also remember that UM Information Services and Technology (IST) will never ask you for your login credentials.

For more information about the types of phishing attacks and scams attempting to exploit the pandemic, see:

• Protect yourself against fraud this tax season
• Let’s crush phishing
• ‘Buy me a prepaid VISA’

Stay connected! Check the latest phishing alerts on the Information and Security Compliance website.

Remember: Information Security Starts With You!

The internet is full of data about you. Do you know where it is, and who can see it? Every time you download an app, check in on a Google Map or catch a Pokémon, personal information about you is created and retained. Do you know what that information consists of, and who has access to it?

Privacy means the right of an individual to seclude themselves, or information about themselves, from others and the right to share information about themselves selectively.

We often choose to share information about ourselves in return for a benefit or service. We have the right to share our information, but also the responsibility to ensure we understand what we are sacrificing, and how our information is being used or shared.

What can you do to mark Data Privacy Day?

1. Review the privacy settings on all of your social media accounts.
2. Use strong passwords for all of your accounts, and do not use the same password for multiple accounts.
3. Read the permissions applications request when you install apps.
4. Think before you post, not only about your own privacy, but also about the privacy of your friends and family.

Remember, information security starts with you!

On a wider scale, the University also works to protect the privacy of members of our community and maintain the security of the information intrusted to us.

Protect the information, identity and privacy of others and become educated about privacy resources available at the University of Manitoba.

Under the provincial privacy legislation, The Freedom of Information and Protection of Privacy Act (FIPPA) and The Personal Health Information Act (PHIA), the University of Manitoba has an Access and Privacy Office that facilitates the University’s compliance with the legislation.

Services provided by the Access and Privacy Office:

• Guidance to support University compliance with access and privacy legislation
• Coordination of University responses to access to information requests
• Leadership and support of the University’s records management program
• Privacy training programs
• Privacy breach investigations
• Privacy risk assessments on new and existing information management systems

See more at the Access and Privacy Office website.

Additionally, there is the Information Security and Compliance unit within Information Services and Technology (IST). Their goal is to maintain and enhance the security and integrity of information, computing resources and technology at the UM.

Know what policies are in place at the University of Manitoba.

A privacy policy governs how the institution collects, processes, stores, and deletes personal information.

University of Manitoba Website Privacy Statement
Access and Privacy Policy and Procedures

The data classification guideline governs how the institution organizes the data it interacts with and what rules are in place for processing it.

Data Security Classification Guidelines

An information security policy articulates how the institution governs and prioritizes information security activities.

Information Security & Compliance Policies and Procedures

Collect and use only the minimum amount of personal information for an authorized purpose.

And only provide access to personal information to the minimum amount of people who need to know for an authorized purpose.

Only use the information that has been collected for its intended purpose.

If you need to use the information for another reason, check with Access and Privacy Office and refer to applicable policies.

Destroy or de-identify personal information when you no longer need it.

The University has a comprehensive records management program that determines the appropriate length of time that information needs to be maintained before destruction or transfer to Archives. 

Check out our Common Records Schedules for University administrative records. Contact the Access and Privacy Office if your unit has records that fall outside of the Common Records Schedules.

Cybercriminals use phishing—a type of social engineering—to manipulate people into doing what they want. Social engineering is at the heart of all phishing attacks, especially those conducted via e-mail.

Social engineering is the art of manipulating people so they give up confidential information.  Perhaps you’ve seen an email that looks like it came from PayPal asking you to click on a link, and the link went to a website asking for more personal information? This is a prime example of social engineering. Attackers will try to fool you into believing they are trustworthy.

Any one of us can become a victim of a cyberattack. The education sector is particularly vulnerable because so much of our day-to-day activities and interactions happen online. That’s why staying informed about how to protect your data and confidential information is part of being a good cyber citizen.

The IST Information Security and Compliance team works hard to keep our information safe. But ensuring that it remains safe, starts with you.

This October, IST is focusing on helping you become a better cyber citizen. Cyber Security Awareness Month Activities include:

Phishing simulations

Look out for suspicious looking email messages. Do they fit the criteria listed in our “How to catch a phish”  article? If so, forward them to spam@umanitoba.ca.

A poster contest

Hey students! Here is your chance to get creative. Submit a poster design to promote cyber security and you could win a $300 gift card for the U of M Bookstore. Check out the IST website for more information.

UPDATED
Phishing training contest

Test your cyber security awareness for the chance to win the new 9.7” iPad. The training is open to students, staff and faculty. The training module will be available Oct 1-31, 2018.

Take the Cyber Security Awareness – Phishing Module now for your chance to win!  Log into UM Learn using your U of M network ID and password.

Find out more at umanitoba.ca/ist/security/cyber-security-month

The Anti-Phishing Working Group, a global consortium dedicated to fighting cyber crime, reported that the incidence of global phishing attacks increased by 65 percent from 2015 to 2016.

Phishing victims will likely encounter ransomware, banking trojans, adware or credential theft attempts at the other end of an unfortunate click.

In addition to the increased frequency of phishing attacks, they are also becoming more sophisticated. You may receive an unusual email from someone you know and not immediately realize it is actually a fraud­.

Colleges and Universities are particularly at risk for cyber attacks. This is because they rely heavily on Internet usage, from coursework to research to conducting the day to day business of the institution.

During National Cyber Security Awareness Month, the University of Manitoba encourages you to think before you click on links in unsolicited email from unknown senders (and the occasional unusual email from a known sender).

Cyber Security Awareness Month is an annual global campaign that educates people about cyber threats and offers tools and resources to stay safe online.

NEW VIDEO RESOURCES

If a phishing email lures you in, you (and your friends and co-workers) might end up in the deep end.

SECURITY POP QUIZ: TEST YOUR CYBER-SMARTS

Do you think you can tell the difference between a normal email message and a phishing email? Test yourself with the Open DNS Phishing Quiz .

If you are unsure about an email message you received that contains a link or an attachment, contact the IST Service Desk as soon as possible or forward the email to spam [at] umanitoba.ca.

Visit the IST website for more about Information Security and Compliance at the U of M.

People now looking to reserve an outdoor location on our campuses simply need to login to JUMP and fill in the required information. (Instructions can be found here.)

“We are very excited to roll out this online booking tool for use of outdoor space,” says Andrew Konowalchuk, Associate Vice-President (Administration) at the U of M. “Our IST team has done a great job in creating a user friendly platform that will make the request for booking outdoor space a much easier, more efficient process that is environmentally friendly. Rather than walking a paper form across multiple offices on campus, approvals are now handled electronically.”

The University collaborated with several units and the University of Manitoba Students Union (UMSU) to develop the online form. 

“We’re thrilled to be rolling out the online booking tool for outdoor spaces on campus after collaborating with the University,” says Tanjit Nagra, UMSU President. “The online tool streamlines the process and makes it much easier for student groups, UMSU members and others to book outdoor spaces on campus for events and other initiatives.”

The U of M is dedicated to creating a work environment that meets the needs of the campus community, and to creating efficient, environmentally friendly systems that support the work we do.

The attack spreads by multiple methods, including phishing emails.  Once the malware has infected a system on a network, it can spread rapidly due to a vulnerability in all Windows operating systems that was discovered and subsequently patched in March of this year.

Due to the scale of the attack, Microsoft has taken the unusual step of releasing updates for older operating systems such as Windows XP, Server 2003 and early versions of Windows 8.  These patches can be downloaded from Microsoft.

The University of Manitoba has taken the following precautions to protect against this malware:

• all core servers were patched for this vulnerability in March
• managed desktops have been patched
• un-managed desktops will have automatic updates applied.  It is important that end users accept and apply these updates.

All employees and students should ensure their personally owned systems have operating system and application patches applied on a monthly basis or when they are made available.

Email Safety

Don’t click on links in an unsolicited email.  Report the email to spam@umanitoba.ca and delete the message.

Don’t open unexpected attachments.  Malware in MS Office documents, PDF’s and ZIP files is very common.

If you have any questions, or need assistance with patching, please contact the Service Desk at servicedesk@umanitoba.ca or 204-474-8600