Cyber Security Awareness Month

The impact of phishing emails

They can be significant and affect us on both a personal and institutional level.  They could also affect relationships with friends and family. 

Have you fallen victim to a malicious email and phishing attempt? Have no shame, it can happen to any of us, but you must act urgently!  

Follow these steps as soon as possible. 

1. Contact the organization or service provider that owns the platform. For example, contact: 
   • your bank for a credit card 
   • Service Canada if your Security Insurance Number (SIN) was stolen  
2. Send a self-service requestif your uOttawa information was shared with unauthorized people or if you entered them on a malicious website.  
3. If you are a victim of financial fraud, contact Protection Services. 
4. Change your password! Use secure tools to create a stronger and more complex password that includes capital and small letters, numbers, special characters. Also, preferably choose a passphrase instead of a password.  
5. Report the suspicious email using the Report Message button in MS Outlook before deleting it. IT Security will analyze the email and take proactive steps to limit any potential damage or adverse effects.  

Given the potential damage phishing attacks can cause, we are reminding everyone to be diligent when dealing with unsolicited electronic communications, links and attachments.   

Get familiar with the tricks and traps used by cyber criminals during cyberattacks to prevent damaging impacts.

Phishing trends 

Stealing credit card information and selling organizational credentials have consistently topped the list. However, cyber criminals also use recent events (like the war in Ukraine or a major internet outage) and seasonal activities (like tax filing or tuition fee payment deadlines).  

Cyber criminals also use persuasive messages such as romance scams, payment requests, refund messages, or even security alert messages from your bank, Canada Post or Amazon account to redirect us to a copy of the website that is almost identical to the legitimate provider’s website.  

Social engineering 

Cyber criminals use a broad range of human interactions to trick us into making security mistakes. They can start by building trust, showing empathy, sending fictitious threats or providing fake incentives like limited-time or discount codes.  

The goal of social engineering is to unconsciously force us to compromise our privacy and security, which can impact our surroundings and put ourselves and our organization at risk. Let’s be cautious and analyze tempting messages thoroughly. When in doubt, verify what is being asked by a person on a different communication channel. Ex: if you receive a request by email from your professor to buy gift cards, validate with them in person if this email comes from them).  

Malware and Ransomware 

Any malicious software that wants to use our information without our consent is generally known as malware. Ransomware is a type of malware that infects computers and prevents access to our data. Cybercriminals usually ask for non-traceable cryptocurrencies to unlock (or decrypt) our data. Prevention is much easier and has a lower cost than the cure. We should not click on links that we do not fully trust. Install an antivirus on your computer, and always do backup of your important information (including your pictures).  

These tips and tools will help prevent phishing traps:    

• Password complexity: Simple passwords, especially words that can be found in a dictionary, are easy to uncover. Choosing a password and preferably a passphrase will make it more secure.  
• Password manager: Use free or paid tools to generate complex passwords and store them in an encrypted environment. Also, automatically fill-in credentials on websites without disclosing your password.   
• Multi-factor authentication (MFA): Adding an extra security layer to ensure no one can access our data even if our credentials are compromised, is also preferable. MFA serves that exact purpose!  Enabling its features while logging into uOttawa online services will increase protection of personal and account information significantly. Follow instructions on how to enable MFA for uOttawa accounts.  
• Regular backups: It would be terrifying to lose a draft of an important document we’ve been working on for weeks, or a year’s worth of reports from work or personal photos with family and friends. Doing a proper backup will prevent accidentally losing data or having them encrypted by a ransomware attack. The best way to securely back up your uOttawa data is to transfer it either to different hard drive or to a cloud storage option like Microsoft OneDrive, which is free to uOttawa staff and students.   
• Safe Links and Safe Attachments security features are in place at the University of Ottawa to offer additional safety. These features are applied to your account automatically to safeguard against threats in attachments and links in documents.    

To prevent identity theft, we also recommend: 

• Keeping all software up to date, especially OS and antivirus, as well as turning on automatic updates feature on personal computers. This feature is active on all university-owned computers. 
• Installing an antivirus software immediately if our computer doesn’t already have one to protect it against malicious programs. uOttawa students and staff members can download Sophos antivirus for free. 
• Consider encrypting your documents will restrict access to them even if it was stolen by an unauthorized user since they cannot access it without knowing your encryption key. There are many free and paid data encrypting tools online.    

For more tips, consult Information Technology security awareness suggestions.