Keeping Information Security Simple – It’s All About “The Hook”

Letter from the CISO, Vol 2 Issue 4 Washington University Community: What’s the best defense against the phishing attacks responsible for over 90% of cyber intrusions and breaches? The simple answer is all of us working together. And “The Hook.” Given time, attention, basic suspicion, and a little paranoia, we can all individually spot most […]

Security Resources for Faculty and Researchers

Research Security

By Christina Pomianek-Smith The Office of Information Security (OIS) supports WashU’s mission of excellence in teaching, research, and patient care by assessing the security of the tools our community uses every day to do our work. Faculty and researchers often have specific needs for secure storage and communication services and unique needs for tools that […]

Smart Gadgets Are Mostly Insecure

Internet of Things

By David Puzder Devices like smart thermostats, speakers, and doorbells might be more functional than their non-internet-enabled designs, but are they smart enough to protect themselves or the network they are on? According to a survey released in August of 2022, there were about 8.6 billion smart devices – or Internet of Things (IoT) devices […]

Win Up To $1,000 in Our Cybersecurity Awareness Month Test Your Knowledge Competition

Trophy with five stars

The Office of Information Security (OIS) is always looking for ways to improve your security and reward your participation in our efforts. For this year’s Cybersecurity Awareness Month, we broadened the range of topics covered by our knowledge test, and we increased our prize amounts accordingly. We hope that taking this quiz and playing the […]

Information Security for your Car

Automobile Information Security

By Matt Lang Deeply integrated into our daily lives, laptops and cell phones are well-known targets for hackers. A less-obvious target that we also use almost every day has recently emerged—the car. Today’s cars are like big computers on wheels, and the consequences of a hack could be deadly. To hack your car, all a […]

Scam of the Month: Fake Password Expiration

The Office of Information Security has observed a trend where criminals send fraudulent password expiration notices in hopes that victims will disclose their WUSTL Key on a fake login page. If you see a message like the one below, please do not interact with any links or follow any special instructions regarding authentication methods. Simply […]

Meet Your InfoSec Team: Andrew Duba, Information Security Analyst III

Andrew Duba

Andrew Duba, Information Security Analyst III, is a member of the Digital Forensics and Incident Response Team. During conversations about his job, “most people think of what they see in movies and TV.” These depictions often embellish what the job is like, so “it can be tough to demystify and make it more accessible.” Realistically, […]

Keeping Information Security Simple – Help Yourself by Helping Others

Letter from the CISO, Vol 2 Issue 3 Washington University Community: Want to know how to be “enough” of an information security expert? In “Outliers,” Malcolm Gladwell popularized the idea of needing 10,000 hours of practice to become an expert. I studied karate for many years, and one of my sensei’s (instructor’s) expectations was that […]

Helpful Resources for Students (and Everyone Else)

Return to College

Welcome back! We know you’ll be busy as the semester begins, so we’ve pulled together resources to help you with a variety of common security needs. See below for our roundup of guidance to help you get in the swing of the semester! Devices Device security is essential for protecting your privacy and data. Sound […]

InfoSec Ally: University Registrar, Keri Disch

By: Christina Pomianek-Smith University Registrar Keri Disch is serious about securing student data in the digital era. Disch moved to St. Louis in July 2020 to join the WashU community after twenty years at Northwestern University, where she first became interested in central registrar work. The University Registrar serves as a central hub for many […]

Scam of the Month: Student-Focused Scams

Student Aid Scam Sample

As school begins on campuses nationwide, criminals turn their attention to scams targeting students who are busy preparing for the upcoming semester. Criminals frequently rely on timely topics and strategies to exploit their victims. Below, you will find examples of real scam emails reported to our team within the last month. As we all gear […]

Meet Your InfoSec Team: Greg Whipple, Information Security Analyst III

Greg Whipple

Greg Whipple, Information Security Analyst III, is new to the Digital Forensics and Incident Response Team. In his role, Greg will perform forensic analysis of log data to further investigations into potential system compromises. Greg will also recommend ways to improve our processes and tools. Greg started his journey in information security with the US […]

Chance to Win $100 in Our Monthly Challenge

Trophy with five stars

The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a couple of resources that will help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish […]

The CIS Workbench is Your Security Toolkit

CIS Workbench Guidance Image

CIS WorkBench is a resource where IT staff at Washington University in St. Louis can view CIS Benchmarks (Center for Information Security Benchmarks). These benchmarks are configuration standards and best practices for hardening digital assets; therefore, they help determine how to harden legacy systems.Here is how you can create your account with CIS WorkBench: Visit […]

InfoSec Alert: Critical Security Updates for Apple Devices (iOS, macOS)

Apple recently released a critical software update for all iOS (iPhones and iPads) and macOS devices designated iOS 15.6.1 and macOS 12.5.1. With the launch of these updates, Apple took the increasingly common step of alerting users that these updates patch vulnerabilities that criminals may actively exploit. Please update your iOS and macOS devices as […]

Keeping Information Security Simple – Why Do Cars Have Brakes?

Letter from the CISO, Vol 2 Issue 2 Washington University Community: Why Do Cars Have Brakes? Why do cars have brakes? The obvious answer is that it helps them slow down and stop. The “real” counter-intuitive reason is that brakes let cars go fast. Imagine the panic and fear of being in a car that […]

Identity Theft: Unflattering Imitation

Identity Theft

By David Puzder Identity theft is nothing new. The term itself dates back to 1964 – a time exclusive to physical theft of documents like social security cards, credit cards, and driver’s licenses. These days, much of our personal information is on the internet. Due to the pandemic’s restrictions, more people used the internet for […]

Wonderful OneTrust

By Christina Pomianek-Smith The Information Security Governance, Risk, and Compliance (GRC) team, led by Assistant Director, Denise Woodward, handles many types of security-related requests from the WashU community. When researchers need a security review of the tools they’re using for a study, when a department wants to adopt new technology, or when someone requires a […]

QR Codes: How Safe are They?

By Matt Lang Quick Response Codes (QR codes) are increasingly popular, especially since most people no longer need a third-party app to scan them. During the Super Bowl last year, cryptocurrency company Coinbase spent millions of dollars on an ad that simply featured a QR code displayed on the screen. That ad became one of […]

Vulnerability Management Project: Expanded Server Protection

Data Center Servers

Overview The WashU Information Security team is actively engaged in keeping our network and data safe. Through the Security Vulnerabilities Project, one of the team’s main objectives is to expand server protection throughout WashU. Why A recent serious security incident was detected early because a server had the WashU Falcon CrowdStrike sensor installed. Due to […]

Chance to Win $100 in Our Monthly Challenge

Trophy with five stars

The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you towards a couple of resources that will help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish […]

Business Impact Analysis and Risk Assessment Reviews

Business Impact Analysis

Over the next several months, the Office of Information Security will conduct a Business Impact Analysis (BIA) and Risk Assessments (RA) on 24 important and critical applications. The BIA is essential to building an effective framework for a Business Continuity Plan. The goal of the BIA is to identify critical functions of the organization and […]

Scam of the Month: Fake (Real) Invoice Scam

The Office of Information Security has observed a trend where criminals are sending fraudulent invoices to unsuspecting victims in hopes that they will be paid without the recipient noting that they are part of a scam. The tricky part of this particular scam is that the invoices are actually generated by payment handlers like PayPal. […]

Meet Your InfoSec Team: Brett McFadden, Information Security Analyst II

Brett McFadden

Brett McFadden, Information Security Analyst II, originally wanted to be a website designer. After taking a few classes in web development, he concluded that CSS – a style sheet language used by effective web developers – can only be understood by “wizards.” After consulting with a friend, Brett decided to investigate the cybersecurity program at […]

Keeping Information Security Simple – Who’s Responsible for Information Security?

Letter from the CISO, Vol 2 Issue 1 Washington University Community: Who’s responsible for Information Security at WashU? It seems like an odd question for me to ask since I’m the Chief Information Security Officer, but I ask it anyway. I know information security is my responsibility. Or, at least, it’s usually the person in […]

Top Ten Travel Tips for Better Information Security

Travel map and compass.

By Christina Pomianek-Smith Many in the WashU community will travel this summer, visiting friends and family, taking vacations, attending classes and summer programs, staking out new study abroad opportunities, conducting research, or meeting with colleagues. The long days of summer ahead provide time to rest, relax, and recharge while also renewing professional and academic pursuits […]

The SIM Swap Scam

Hacker's Hand With Black Glove Stealing SIM Card Information.

By David Puzder Your mobile phone number may be pivotal for accessing your most important accounts. Many banks, brokers, businesses, and payment service providers rely on text messaging to verify your identity when you access or update your account. Sometimes, a login screen will offer users a choice between text messages or phone calls to […]

Chance to Win $100 in Our Monthly Challenge

Trophy with five stars

The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you towards a couple of resources that will help you protect yourself at home and while traveling. Guidance for Reporting Phishing Have you seen the Phish Alert Button? It’s the easiest […]

Joint IT and InfoSec Project Seeks Better Protections for WashU

Storage servers in data room

A joint Information Technology and Office of Information Security vulnerability management project aims to strengthen and better protect the WashU network from attacks.  The project has two main objectives: Install CrowdStrike on all Wash U servers immediately. Remediate tool-evaluated critical vulnerabilities, guiding department owners through updates, patches, and other steps. About Objective 1 WashU IT […]

Scam of the Month: Urgent Administrative Job Opportunity

This month’s scam is a recent and widespread phishing attack that attempted to use social engineering and impersonation to gain account access. If you see a message like the one below, please report it immediately using the Phish Alert Button (PAB) in your Outlook interface. You can find more information about the PAB and alternative […]

Meet Your InfoSec Team: Clark Huskey, Information Security Analyst

Clark Huskey, Information Security Analyst III, started his journey in information security as an amateur radio broadcaster. In his youth, Clark tinkered with personal computers and radio broadcasting equipment. Specifically, his family used citizen band radios with a large antenna to broadcast their own bulletin board service, Silver Fox BBS, until someone hacked their broadcast. […]

SMiShing Scam Seeks to Obtain Gift Cards by Impersonating Chancellor

SMiSh Example

A recent SMiShing scam targeted our institution by impersonating Chancellor Martin and asking recipients for gift cards. You can rest assured that the chancellor (or your supervisor) will not reach out to ask for gift cards. SMiShing is a type of attack that uses the social engineering tactics commonly associated with email phishing via text […]

Website Scavenger Hunt with $250 prize and New Protections in Office 365

Trophy with five stars

The Office of Information Security’s website is full of helpful resources and information for keeping you more secure online. To encourage you to become more familiar with what our website has to offer, the OIS office is holding a virtual scavenger hunt featuring a chance to win $250 in Bear Bucks! How to Participate Follow […]

Keeping Information Security Simple – Phishing, Spear Phishing & Whaling

Letter from the CISO, Vol 1 Issue 12 Washington University Community: Do you know the differences between phishing, spear-phishing, and whaling? Let’s start with the difference between phishing and spear phishing. In short, phishing messages are those all-too-familiar messages that try to get you to give away information or install malware. They arrive via email, […]

InfoSec Allies: Office of Resource Management

By Christina Pomianek-SmithHave you ever snagged a WashU staff discount for a product or service, or found a great deal on gently used WashU office equipment through the WashUReuse Surplus Program? Do you sometimes pause to admire the design of a new office space? Did you receive personal protective equipment (PPE) or a COVID vaccine […]

Chance to Win $250 with OIS Website Scavenger Hunt

Trophy with five stars

The Office of Information Security’s website is full of helpful resources and information for keeping you more secure online. To encourage you to become more familiar with what our website has to offer, the OIS office is holding a virtual scavenger hunt featuring a chance to win $250 in Bear Bucks! How to Participate Follow […]

The Dark Side of Cryptocurrency

By David PuzderAs of the writing of this newsletter, the price of Bitcoin, according to CoinMarketCap, is $29,239.16 (although this number is bound to change quickly due to Bitcoin’s high volatility) to $40,176.86. About three years ago, the price of Bitcoin was $5,251.94 (“Bitcoin price Today, BTC to USD live, market cap and Chart”). If […]

Scam of the Month: Authenticate Your Account

This month’s scam is a recent and widespread phishing attack that attempted to use social engineering and impersonation to gain account access. This one is particularly tricky, but it uses a very common set of steps that criminals deploy to steal account credentials. The user receives the suspicious email, in this case from an ‘@wustl’ […]

Meet Your InfoSec Team: David Puzder, Information Security Analyst

David Puzder is our newest information security team member. David hails from Ohio and is a recent graduate of the University of Dayton. He splits his time as an Information Security Analyst between Governance, Risk, and Compliance (GRC) and Information Security Awareness, Behavior, and Culture. With the GRC, he will identify internal and third-party risks […]

Catch a Phish to Protect Yourself and WashU

Phishing is the most common tactic cybercriminals use to steal login credentials, data, and intellectual property. Billions of these messages are sent every day, but it’s now easier than ever to protect yourself and WashU by helping the Office of Information Security (OIS) catch the phish and remove it from our system. The Phish Alert […]

Keeping Information Security Simple – The Only Constant in Life is Change

Letter from the CISO, Vol 1 Issue 11 Washington University Community: There are only two things to worry about—that things will never get back to normal, or . . . that they already have. In other words, the only constant in life is change, and Information Security is no exception. I sometimes worry that I […]

Cybersecurity and the Supply Chain

Supply Chain

By Christina Pomianek-Smith You’ve undoubtedly heard the term “supply chain disruption” more times than you can count lately. The past few years have been fraught with disruptions—labor shortages caused by COVID-19, warfare, tropical storms and wildfires, factory fires, railroad transportation disruptions, and the six-day blockage of the Suez Canal. We’ve endured incredible upheavals, and many […]

Advice from a Graduating Student: Things to do as You Leave WashU

Woman moving with boxes

By Harrison Stites As members of our community graduate or otherwise move on from their time at WashU, it can be tempting to ignore or put off the things you need to do here as you look forward to the path ahead. WashU’s Office of Information Security offers you some tips and tricks to help […]

Avoid Phishing and Another Chance to Win $100 in Bear Bucks

Trophy with five stars

The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you towards a couple of resources that will help us identify and report potential phishing attacks. Have you seen the Phish Alert Button? It’s the easiest way for you to report […]

Scam of the Month: Important Payroll Message

Example of Important Payroll Message Phish

This month, we’re focusing on a particularly tricky scam. This one isn’t tricky because it’s complex on its surface; it actually relies on simplicity and brevity to lure in its victims. This scam mimics an important notification to trick recipients into handing over sensitive login information. It contains many hallmarks of a typical phish, but […]

Meet Your InfoSec Team: Jason Murray, Assistant Director and Architect of Digital Forensics and Incident Response

Jason Murray - Assistant Director and Architect of Digital Forensics and Incident Response

Jason Murray, Assistant Director and Architect of Digital Forensics and Incident Response, describes his role as the leader of “a team of talented Security Analysts who defend the university from cyber villains.” Throughout his career, he’s subscribed to the design principle, “build it secure,” considering the methods hackers might use to exploit flaws and access […]

Keeping Information Security Simple – Device Management – March 2022

Letter from the CISO, Vol 1 Issue 10 Washington University Community: This month I’m going to bore you with another really basic idea: that everyone needs to manage their devices. I can almost hear you yawning when I write those words, but it’s essential and not quite as easy as you might think. Step 1: […]

Security Spring Cleaning Top Five

Spring Flowers

By Christina Pomianek-Smith  Spring has arrived, and with it, the age-old tradition of spring cleaning. Getting organized, cleaning up your computer, and checking on your security hygiene will make your life easier as you approach the end-of-semester push toward summer adventures! As you clear away the cobwebs and shake off the dust of winter, also […]

Another Chance to Win and New Defender Features Coming to Office 365

Trophy with five stars

The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we’re introducing new security features in Office 365 and running another prize competition! March Prize Giveaway We had a great turnout for our February Information Security prize giveaway, so we’re doing it again this month! […]