The Office of Information Security has identified a trend in which criminals send members of our community a Google Document containing a malicious link, in hopes that a victim may give up their credentials. In this more elaborate scam, hackers posed as Adis Avila, who is not an individual who works at our university, sending […]
Steve Bochte, Information Security Architect, brings a wealth of experience and enthusiasm to the InfoSec team. Steve remembers being interested in IT and security as a grade-schooler, and these fields still appeal to his love for fixing things and improving processes today. After taking the CISSP exam in 2007, he started exploring the world of […]
Letter from the CISO, Vol 3 Issue 3 Washington University Community: Welcome (back) to school! A friend recently shared that her son was assigned a roommate with whom he seems to have nothing in common. They’ve recognized and embraced their differences and are enjoying better, richer experiences because of it. This made me think that […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
Welcome back! We know you will be busy as the semester begins, so we have pulled together resources to help you with a variety of common security needs. See below for our roundup of guidance to help you get in the swing of the semester! Devices Device security is essential for protecting your privacy and […]
The Office of Information Security observes a trend in which criminals send a fraudulent order confirmation claiming the recipient will be charged almost $500. The criminals hope victims will call a phone number to refute the “purchase” and disclose their banking information. If you see a message like the one below, please do not interact […]
Shane Powell, Information Security Architect, is one of the newest members of the InfoSec team here at WashU. Originally, Shane is from Texas, but after many years of visiting St. Louis with his wife, they decided to move here in 2016. In his day-to-day work here, Shane “communicates with various groups throughout the university and […]
Letter from the CISO, Vol 3 Issue 2 Washington University Community: Is our best good enough? In the battle against malicious cyber actors, we are constantly challenged by more clever and sophisticated attacks. For example, for several years after we implemented DUO 2-Factor Authentication (2FA), the number of successful account-compromise attacks dropped to almost zero. […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
The Office of Information Security observes a trend in which criminals use a compromised email account to trick victims into divulging their WUSTL Key password. In this scam, criminals took over a legitimate email address from UT Health San Antonio and used it to send phishing emails. Victims who click on the phishing link are […]
Our Governance, Risk, and Compliance (GRC) team is fortunate to have three GRC Analyst Trainees this summer who are assisting with various InfoSec efforts. We are excited to have them on our team and would like to introduce you to each of them. Lindsey Wichman Lindsey Wichman is currently majoring in Computer Science with a […]
Our office is continually searching for the best ways we can serve you and help you secure your work and WashU’s resources. We regularly update our information security website (https://informationsecurity.wustl.edu) with the latest information and resources to help you navigate the increasingly complicated digital landscape. In addition to the great original content we post on […]
Letter from the CISO, Vol 3 Issue 1 Washington University Community: Do you like chocolate more than kale? Of course! In a recent keynote presentation at the Gartner Security and Risk Management Summit, Mary Mesaglio, a Managing Vice President who leads Gartner’s Executive Leadership Dynamics team, discussed the importance of getting people to care about […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
The Office of Information Security observes a trend in which criminals impersonate the sheriff’s office over the telephone. These scammers claim you signed for a subpoena, are an expert witness, or are a juror and never showed up for court and then demand payment. Along with a false accusation, scammers may list your personal information […]
With the new design of our Policies page, visitors can conveniently locate, search, and preview our office’s policies, standards, and guidelines. Along with a contemporary design, the three terms each include a brief definition. Understanding their differences can prevent confusion and help you find the information you need to carry out your work securely. So, […]
Hannu Turri, cloud security architect, is an integral part of the InfoSec team at WashU. Hannu comes to us from Finland, where he first served in the military and transitioned into IT, working as a CISO. After attending an AWS re:Invent event in Las Vegas, where he met his future wife a few years ago, […]
Letter from the CISO, Vol 2 Issue 12 Washington University Community: Are cyber threats like pop quizzes? I was recently asked, “How are cyber threats like pop quizzes?” I’ve realized this is an interesting question, but not in the way I originally thought. Initially, I thought of reasons they were similar. They are unexpected, test […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
Starting with our June edition, SECURED will have a new look. Information Security is a big part of the future of IT at WashU, so we are aligning our published content with the rest of the great information and news coming from WashU IT. You can learn more about WashU IT’s strategic plan on the […]
If you work with Protected Health Information (PHI), you have probably heard mention of a business associate agreement. At WashU, it is essentially a contract between WashU and a business associate concerning the handling of PHI. Who is a Business Associate? It is a person or entity outside of WashU who creates, receives, maintains, or […]
The Drug Enforcement Administration (DEA) is warning the public of a widespread fraud scheme where scammers impersonate DEA agents to extort money or steal personally identifiable information. DEA personnel will never contact members of the public to demand payment or sensitive information. No legitimate federal law enforcement officer will request cash or gift cards from […]
A campus-wide initiative is underway to improve computer security by installing the Splunk Forwarder and CrowdStrike on all servers by the end of June, as InfoSec Policy requires. The Splunk Forwarder gathers real-time log data from servers into a searchable repository. This log data can help detect and troubleshoot security incidents quickly and efficiently. CrowdStrike, […]
Letter from the CISO, Vol 2 Issue 11 Washington University Community: With Great Power Comes Great Responsibility As Uncle Ben in Spiderman said to the young Peter Parker, “with great power comes great responsibility.” Thinking back to the way I learned to program computers in high school by writing FORTRAN code onto paper by hand, […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you to a couple of resources that will help you protect yourself from cybercrime and understand how our office can support you. We’d like to thank our challenge participants. We recently […]
These three fundamental cybersecurity concepts are related but have distinct meanings. Security experts define these three concepts in a variety of ways, and the terms threat and risk are sometimes used interchangeably. This article’s definitions come from paraphrasing Computer Security: Principles and Practice by William Stallings and Lawrie Brown. Each term can be thought of […]
The Office of Information Security has observed a trend in which criminals impersonate Chancellor Andrew Martin over text message. Impersonation is one of the most effective social engineering tactics used by scammers, and it can be particularly powerful when the person being impersonated is in a position of authority. If you see a message like […]
Armin Toric, Information Security Analyst I, is passionate about “protecting the university from cyber villains!” After attending St. Louis Community College and Ranken Technical College, Armin took advantage of CompTIA certifications and other cybersecurity boot camps. He took the initiative to obtain his Network+, Security+, and CySA+ certifications to build his skills around topics like […]
Letter from the CISO, Vol 2 Issue 10 Washington University Community: I often encourage everyone to “be vigilant, skeptical, and a little paranoid,” and I usually provide a few pointers on things to watch out for and what to do when (if) you see them. Which Half Are You In? A recent report concluded that […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
Job scams that target students are on the rise. As you may already know from reading our Scam of the Month posts, hackers can and will target you by impersonating a university employee looking to hire a student worker. Often, these scams will reach you via email or your cell phone number. When the hacker […]
The Office of Information Security has observed a trend in which criminals send a fake error message on a website, saying there is a virus on your computer. These fake error messages aim to scare you into calling their “technical support hotline,” and they will likely ask you to install applications that give them remote […]
WashU researchers must persevere through myriad challenges in the quest for knowledge. Among these challenges is developing a comprehensive security plan for their data, applications, and research results. Increasingly, research sponsors require these plans as a condition of funding. Our researchers are pioneers, bringing their expertise to the frontiers of discovery, but they aren’t always […]
On Tuesday, March 28, from 8:30 am to 10:30 am, the Office of Sustainability and WashU Office of Information Security are teaming up to bring the WashU community e-waste recycling and confidential paper shredding services. Certified vendors will securely and safely recycle all confidential papers and hard drives. All are welcome to bring accepted items […]
Letter from the CISO, Vol 2 Issue 9 Washington University Community: Rule #1: Be Vigilant, Skeptical, and a Little Paranoid Cybercriminals and scammers are constantly changing and adapting, trying new ways to take advantage of us. Therefore, I return to the one thing I challenge you to do – be vigilant, skeptical, and even a […]
The Office of Information Security is changing how we manage emails sent to infosec@wustl.edu. Starting 2/27/2023, every email that reaches our inbox will automatically be assigned to a ticket in ServiceNow. Tickets are how the rest of WashU IT handles work and requests, and we intend to align with this standard. Apart from solidarity, the […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a few resources to help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish Alert Button? […]
You’ve all heard the phrases, “just Venmo me”, “do you have Zelle?”, and “can I send you Apple Cash?”. In the blink of an eye and a tap of a finger, your money can be sent to whomever you choose. However, without considering some basic protections, this convenience could come at a cost. As quickly […]
The Office of Information Security observes a trend in which criminals send an email impersonating a Professor of Mathematics, hoping that victims will share their phone number and eventually purchase gift cards for them. If you see a message like the one below, please do not interact with the sender or phone number, and do […]
Adam Coyle, Information Security Analyst I, believes that information security is becoming one of the most critical roles in any organization. Over the first nine years at WashU on the Deskside Support team, Adam became fascinated with information security and the strides the university takes to become more secure. His current role as a security […]
Letter from the CISO, Vol 2 Issue 8 Washington University Community: There has been a lot of news lately about the exciting and alarmingly adept Artificial Intelligence (AI) known as ChatGPT, which may be able to pass Alan Turing’s famous test of being indistinguishable from real (human) intelligence. Some say this is the beginning of […]
Most of the time, using an online service – checking email, shopping, and using social media – requires users to log into an account with a password. As we covered in the Password-based Authentication article, passwords are “something known,” so they can be leaked. And security breaches happen often. Recently, LastPass had its second security […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a couple of resources that will help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish […]
With the release of iOS 16.2, Apple offers Advanced Data Protection for iCloud as an optional setting to adult US users. For those who enable the feature, iCloud will provide end-to-end encryption for Photos, Notes, iCloud Backup, and more. As a result, nobody else – not even Apple – can access your end-to-end encrypted data. […]
The Office of Information Security observes a trend in which criminals send a convincing fraudulent PayPal invoice, hoping that victims will click a malicious link. If you see a message like the one below, please do not interact with the sender or phone number, and do not follow any special instructions. Simply report the email […]
Madeline Quigley, Cybersecurity Awareness and Culture Specialist, is the newest member of the Cybersecurity Awareness, Behavior, and Culture team. Madeline spent her childhood in Rhode Island and moved to St. Louis to attend Maryville University from 2018 – 2021, earning a bachelor’s degree in Cybersecurity with a minor in Creative Writing. Madeline has resided in […]
By Chris Shull, CISO Over the past few weeks, the Artificial Intelligence (AI), called ChatGPT from OpenAI, has captured many headlines, ranging from wonder to panic. Central to the panic is the idea that knowledge workers would be put out of work and students would use ChatGPT to do their homework and take their exams. […]
On December 22nd, 2022, LastPass notified their customer base of a cybersecurity incident that put customer data and passwords at risk. This incident occurred in November of 2022. Bad actors could potentially possess encrypted user data that includes “usernames, passwords, secure notes, and form-filled data,” according to LastPass. While in possession of this data, the bad […]
Letter from the CISO, Vol 2 Issue 7 Washington University Community: Am I Smarter than a Sixth Grader? I like to think so, but the evidence suggests otherwise. At least when it comes to figuring out how to limit the trouble my young nieces can get into on their mobile devices. Yes, their mother, father, […]
The OIS is always looking for ways to improve your security and reward your participation in our efforts. This month, we want to point you toward a couple of resources that will help you protect yourself from cybercrime and understand how our office can support you. Guidance for Reporting Phishing Have you seen the Phish […]