18^th Annual Cybersecurity Awareness Month

National Cybersecurity Awareness Month, now in its 18^th year, was created under the leadership of the U.S. Department of Homeland Security (DHS) and the National Cyber Security Alliance (NCSA) to be a collaborative effort between government and industry to make sure Americans have the necessary resources to stay safer and more secure online. This year Cybersecurity Awareness Month is co-led by NCSA and the Cybersecurity and Infrastructure Agency (CISA), a fairly new division of DHS.

Week 2 – Fight the Phish

This week we focus on the importance of being wary of emails, text messages, or chat boxes that come from a stranger or someone you were not expecting. The pandemic has certainly let to an incredible increase in phishing scams, including spear phishing, over most of the last two years. This increase also accounts, in part, for the increase in ransomware. The criminals, also known as bad actors, are literally banking on people not using secure networks or computers while working from home, as well as not being cautious when clicking on links and attachments.

Did you know???

• Malware increased by a massive 358% in 2020. (Help Net Security)
• According to the FBI, phishing was the most common type of cybercrime in 2020, with the bureau receiving 241,342 complaints in 2020, with adjusted losses of $54 million. That is up from 114,702 complaints in 2019 and only 19,465 complaints in 2016! (FBI)
• Phishing attacks account for more than 80 percent of reported security incidents. (Verizon Data Breach Investigations Report)

Sometimes dealing with email seems like a mundane task. However, we need to always be alert when checking our emails and think of these things:

• While it’s easier to dismiss emails from strangers, think of the emails you get from someone you know.
  • Does the message seem out of context for what they would normally send?
  • Are they asking you to do something that seems out of the ordinary?
• Recognize the common red flags with phishing.
  • Sense of urgency
  • Unfamiliar or unusual senders or recipients
  • If you happen to click “Reply,” most often the email address of the sender will change!
  • Spelling or grammatical errors
  • These kinds of spelling and grammatical errors really stand out.
  • Strange or unusual formatting (e.g., “Utia” instead of “UTIA”)
  • Request for money, gift cards, and/or personal information
  • Call to action, such as clicking on a link or downloading an attachment
• Always think before you click on any suspicious emails, links, or attachments and make sure you report any suspicious emails.
  • Clicking on the wrong thing can lead to ransomware more than ever in the past.
  • You can email me at any time if you are unsure of the validity of an email.
  • To officially report a phishing attempt, please forward the email and its Internet headers using Reporting Phishing Attempts.
• Go to https://UTIAsecurity.tennessee.edu to find the latest information on phishing scams.
  • Items pertaining to current threats are found on the home page under “Keeping You Safe.”
  • Items such as newsletters tagged as phishing or spear phishing are easily found here.
• Do not reply to an email when you are unsure of its legitimacy.
  • Often a reply will only confirm who you are and that your email address is valid.
  • A stinging reply may cause a worse attack for you in the future.
  • If you get an email that looks to be from your supervisor saying they need you to do them a favor, but to reply back to the email if you have questions because they are unable to take calls, do NOT reply back to the email and DO call the supervisor if you have questions! The bad actor is hoping you won’t notice that the return address changes when you click on “Reply.”
• And remember that phishing attacks happen over the phone, as well.
  • Known as vishing, these kinds of attacks ask for personal information over the phone.
  • These calls also may ask for specific information about the Institute.
  • A good example would be someone claiming to be an IT security vendor calling the CISO to ask very specific questions about our security program or our network policies, etc. If I have never asked for information from that vendor company, why would I give them our configurations, contacts, or our specific information like how we store backups? It is best to keep that kind of information out of any conversation unless you initiate the contact and the conversation with a known party.

I leave you with this thought. If it looks phishy, it probably is so please report it. And if you ever have any questions, please don’t hesitate to ask me!

Thank you all for all that you do!

Sandy