The NCSC recently issued an advisory on password spray attacks. The attacks are aimed at health care organisations involved in the coronavirus response, including research. The University is a potential target. In password spray attacks, attackers use a few easy to guess passwords and try them against multiple accounts. Attacking in this way does not … Continue reading “Password Spray Attacks”
Covid variation of Gift Card Scam
Earlier this year we published an article on the Gift Card Scam. We have had a few reports of variations in this scam, tailored for the current Covid-19 crisis. One example email started with the following. “Good morning Peter, I’m planning to surprise some of the staffs with gifts during this unprecedented health crises, your … Continue reading “Covid variation of Gift Card Scam”
Gift Card Scam
Quite a few people have reported a scam that is becoming common on campus and some have reported losing hundreds of pounds of their own money to scammers. Scammers are sending email from various external email accounts claiming to be from senior members of departments. These are often highly targeted so that the person they … Continue reading “Gift Card Scam”
New Password Expiry Notice
IT security policy requires password changes every 180 days. In order to achieve this, passwords are set to expire approximately every 180 days. Warnings and reminders are sent in the period running up to password expiry times. The password expiry noticed issued by IT Services has changed recently. The new notice looks like this. If … Continue reading “New Password Expiry Notice”
Blackmail Scam
We have been getting quite a few calls recently about messages trying to blackmail people. They allege that the recipient has been viewing pornographic sites, malware has been installed on the recipient’s computer and they have compromising recordings of the recipient that will be sent to friends and colleagues. For example: To make the message … Continue reading “Blackmail Scam”
GDPR and Cloud-based Services
Formstack Security If you are using Formstack to collect and process personal data then you must ensure that the security options are enabled for each of your forms. This includes all three of: SSL – Secure Sockets Layer for the website. If enabled, the URL starts with “https://” and the browser displays a padlock symbol. … Continue reading “GDPR and Cloud-based Services”
URL Shorteners
URL shortening is when you use a service such as bit.ly or tinyurl.com to take a very long URL and condense it into a very short URL. This is very useful for when you need a short URLs, when you have to read a URL over the phone, or for a .pdf document. Below is … Continue reading “URL Shorteners”
Required Information Security Awareness Training
Announcement You have all seen the flood of recent phishing emails (as in fishing for passwords and other sensitive information) and other social engineering attacks aimed at people. These generally try to trick you into typing your password into some sort of false sign-on screen or download malicious software. Automated controls such as SPAM filters … Continue reading “Required Information Security Awareness Training”
Meltdown and Spectre – time to panic?
We have had a number of queries about the well-publicised processor vulnerabilities, Meltdown and Spectre. There are no reports of actual exploits being used at this stage and certainly with meltdown an attacker would need access to the systems concerned in order to exploit the vulnerabilities. Suppliers of operating systems, anti-virus and other relevant software … Continue reading “Meltdown and Spectre – time to panic?”
Student Password Change Notices
We have had a lot of queries recently about password change reminders and whether or not they are a phishing attack. We have previously published an example password change notice highlighting its characteristics and how it differs from an attack. Some students have been asking why there has been a change in policy. The policy … Continue reading “Student Password Change Notices”