October is National CyberSecurity Awareness Month!

In support of this annual cybersecurity event, ITS Information Security in concert with Professional Development will be hosting a webinar on Thursday, October, 22 from 10:00am – 11:00am titled “BeCyberSmart | Securing your “Smart” Home”. 

Follow this link for additional information about this event including how to sign up please.   We encourage you to share this awareness opportunity with all of your staff. 

Thank you

ITS Information Security

Celebrate CyberSecyruity Awareness Month.  Do Your Part, be #BeCyberSmart.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

• Any messages that communicates a tremendous sense of urgency. The bad guys are trying to rush you into making a mistake.
• Any message that pressures you into bypassing or ignoring our security policies and procedures.
• Any message that promotes miracle cures, such as vaccines or medicine that will protect you. If it sounds too good to be true, it probably is.
• Be very suspicious of any phone call or message that pretends to be an official or government organization urging you to take immediate action. 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Dear Colleagues,

Over the past months CI has been in the process of rolling out DUO’s 2-factor authentication solution to increase CI’s overall security posture and to better protect your myCI accounts. 2-factor (which is sometimes called 2-step or multi-factor) authentication or 2FA/MFA, is the process by which a user accesses a computer system or software application using two (or more) forms of authentication to log in to that system or application. The forms of authentication are often described as using, “something you know”, “something you have” and “something you are”. One factor is typically a username and password (something you know). A second factor can be the use of a mobile app, a phone call or text message, or hardware token (something you have) or, in some cases, the use of a fingerprint or retinal scan (something you are). Without at least two forms of verification, the login will fail.

CI is continuing its rollout to the faculty and staff community during the month of November with an anticipated completion date of November 30, 2019.

What to Expect:

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Dear Campus Community,

Agenda

Tuesday 10/29/2019

09:30 AM - 10:30 AM Cybersecurity Education at CI
11:00 AM - 12:00 PM Nation State Attacks: You are a Target!
12:00 PM - 01:00 PM Scams Targeting CI Students
01:00 PM - 02:30 PM Diversity in Cybersecurity Panel
02:30 PM - 03:30 PM Securing your Home Router
03:30 PM - 04:30 PM Multi-Factor Authentication is Coming…
04:30 PM - 05:30 PM CI Cyber Security Club

Thursday 10/31/2019

09:00 AM - 10:00 AM How Secure is the Internet: Developing Secure Elliptical Curve Cryptography
10:00 AM - 11:00 AM Using a Raspberry Pi for Home Security
11:30 AM - 12:30 PM Cyber Security Jeopardy
12:30 PM - 01:30 PM The Cyber Threat Landscape and You…
01:30 PM - 02:30 PM The DARK Web…

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

On Monday March 26th CI Records will split into two systems, CI Records and CI Personnel. CI Records will remain as CI’s Student Information System, and CI Personnel will become CI’s Human Resources Information System. This change, which originated from our software vendor (Oracle) and which is now being implemented across all CSU campuses, will separate the one information system into two.

On Thursday March 22nd, CI Records will be shut down at 4:00 pm to prepare, upgrade and convert it into the two new information systems, CI Records and CI Personnel.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

To provide the best possible service, the Division of Technology & Innovation T&I must regularly update and perform routine maintenance on its systems and networks. Some of these activities require that the affected systems and networks be shut down. While this work is essential, we also recognize that it presents an inconvenience. To enable those who use these systems to better plan for maintenance, we are establishing a new monthly maintenance plan and schedule for performing routine maintenance and upgrades to our services.

The Division of Technology & Innovation (T&I) will perform its scheduled monthly technology maintenance on the second Friday of each month starting at 6:00 PM and ending at 6:00 AM the following morning. The monthly maintenance program is a preventive measure that is essential to providing stable and secure systems to the University.

Visit the T&I Maintenance Schedule page for a complete list of scheduled maintenance dates and additional details about this updated practice. Please contact Deputy CIO Herb Aquino at herb.aquino@csuci.edu with any questions about the schedule or plan.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Google has released Chrome version 45.0.2454.85 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow an attacker to take control of an affected system.

US-CERT encourages users and administrators to review the Chrome Releases page and apply the necessary update.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Apple has packed patches for dozens of security flaws into the new versions of its iOS and OS X operating systems.

The company noted Tuesday in a security advisory that just-released version 8.4 of the iOS mobile operating system contains more than 20 fixes for vulnerabilities that could lead to remote code execution, application termination and the interception of encrypted traffic, among other issues.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

There are all sorts of days to celebrate during the year such as Mother's Day and Father's Day, and even some more off-the-wall days such as National Fried Chicken Day, Talk Like a Pirate Day, and a personal favorite, National Pancake Day.  But today is an extra special day that should be added to everyone's calendars.  Today is International Password Day!

International Password Day gives us all the opportunity to stop and reflect on what makes a good password, and how we can best protect our work and personal data by using strong password concepts.

To help you along, there's even a website dedicated too helping you figure out what makes a good password, how to deal with keeping track of the never ending list of passwords, mobile device passwords, and even some funny stories about password catastrophes!

Please take the time in joining your information security team in making every day a strong password day!

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

One of the hot identity theft scams is submission of false tax returns in order to receive unearned or earned refunds. The IRS has a process to try and detect these false returns. If they suspect a false return they will mail a letter to the address the taxpayer listed in their previous year return. The IRS letter directs the taxpayer to visit an IRS site to verify the tax return submitted. Legitimate letters should direct taxpayers to idverify.irs.gov. More details are contained in this link:http://www.irs.gov/uac/Newsroom/Taxpayers-Receiving-Identity-Verification-Letter-Should-Use-IDVerifyirsgov.

The IRS also has a great website page detailing active tax scams: http://www.irs.gov/uac/Tax-Scams-Consumer-Alerts.

If taxpayers suspect they are a victim of tax fraud/identity theft, they should contact the Treasury Inspector General for Tax Administration at 1-800-366-4484 or via the web at:http://www.treasury.gov/tigta/contact_report_scam.shtml

Taxpayers can forward scam emails to phishing@irs.gov.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

After many months of planning, the campus is less than two weeks away from faster, stronger Internet access as the Technology Infrastructure team will be visiting each building over a span of 11 days to upgrade network connectivity.

During the planned upgrades, campus telephones, Internet access, wireless connectivity, and network connectivity for myCI, PeopleSoft, CI Learn, CI Records, CI Financials, CI Docs, CI Sync, etc. will not be available. Additionally, access to the campus wireless network from a different building than your own may not be available due to certain resources being bound to your location/workstation.

The upgrade process begins March 16 at Sage Hall and will continue through March 31. Installation in each building will take approximately four hours. You can review the planned schedule here to verify your building’s planned upgrade.

Ultimately, wireless access speeds will increase by 2 times, while wired access will increase by 10 times.

For more information, go to www.csuci.edu/tc or email questions to Herb Aquino, Manager of Technology Infrastructure at herb.aquino@csuci.edu

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Adobe is aware of reports that an exploit for CVE-2015-0310 exists in the wild, which is being used in attacks against older versions of Flash Player. Additionally, Adobe is investigating reports that a separate exploit for Flash Player 16.0.0.287 and earlier also exists in the wild. For the latest information, please refer to the PSIRT blog here.  You may find more information about the Adobe Security Bulletin here.

Mac

1. On the Firefox tool bar go to Tools 
2. Select Add-ons 
3. In the Plugins tab, set Shockwave Flash to Never Activate 

1. On the Safari tool bar go to Safari > Preferences… 
2. In the Security tab, ensure Allow Plug-ins is checked 
3. Click on the Manage Website Settings… button 
4. Select Adobe Flash Player 
5. In the dropdown, select When visiting other websites: Block 
6. Click on the Done button 
7. Close the Preferences dialog box 

1. Type chrome:plugins in the address bar to open the Plug-ins page 
2. On the Plug-ins page that appears, find Adobe Flash Player 
3. Click the Disable ​link under its name 

Windows

1. Go to the Firefox menu button 
2. Select Add-ons 
3. In the Plugins tab, set Shockwave Flash to Never Activate 

1. Click the Tools button, and then click Manage add-ons 
2. Under Show, click All add-ons, and then select Shockwave Flash Object 
3. Click Disable, and then click Close 

1. Type chrome:plugins in the address bar to open the Plug-ins page 
2. On the Plug-ins page that appears, find Adobe Flash Player 
3. Click the Disable ​link under its name

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

An email with the subject “important” tells recipients that they must sign into Dropbox in order to view a document too big to be sent via regular email, but clicking on the link included in the message brings people to a fake Dropbox login page that is actually hosted on Dropbox. 

Link to the rest of this SC Magazine article to find out more about this new scam.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

EBay is asking users to change their passwords after it was announced yesterday attackers gained unauthorized access to eBay's corporate network, compromising a database containing encrypted passwords and other personal data. Additional information may be found here or on eBay.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

There has been a lot of news recently regarding the Heartbleed Bug, a security threat that was erroneously introduced into the code of OpenSSL back in late 2011. T&C has determined its critical systems have not been affected by this threat and continue to perform evaluations of its other systems.

Additional information about public services such as Google, Yahoo, Facebook, etc. may be found here as well as at other sites on the internet:

• Which sites have patched the Heartbleed bug?
• The Heartbleed Bug Hitlist: The Passwords you need to Change Right Now.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Apple rushed to release iOS 7.0.6 on Friday and OS X 10.9.2 today with patches for a shockingly overlooked SSL encryption issue that leaves iPhone, iPad and Mac computer users open to a man-in-the-middle (MITM) attack.  All users of iOS 7 and Mac OS X Mavericks (10.9) should download and apply these patches.  The vulnerability is not present in versions of OS X prior to OS X 10.9 Mavericks or iOS prior to iOS 6.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Scammers, hackers, and identity thieves are looking to steal your personal information – and your money. But there are steps you can take to protect yourself, like keeping your computer software up-to-date and giving out your personal information only when you have a good reason.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

In a recent news release by US-CERT, the United States Computer Emergency Readiness Team, US-CERT stated they are aware of a malware campaign that surfaced in 2013 and is associated with an increasing number of ransomware infections. CryptoLocker, a new variant of ransomware, restricts access to infected computers and demands the victim provide a payment to the attackers in order to decrypt and recover their files.  As of this time the primary means of infection appears to be phishing emails containing malicious attachments.

Everyone who makes use of computer systems, including email, should be on guard for these types of malware infection attempts.  In many cases the email will appear to be legitimate and harmless but you need to ask yourself if you were expecting this communication, and if not, contact the sender to make sure it's legitimate.

To help mitigate any loss of data should you fall victim to this infection, you should take regular backups of your system and store your important files onto your file server which is backed up regularly.

To get more information about CryptoLocker, follow this link to the US_CERT website and think before you click!

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

A new video released by SANS.org this month titled "Data Destruction" will help you learn just how difficult it is to truly delete data, and that it actually requires a process called wiping.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest