SECURE IT - July 2023

Check Out WPI's Phishbowl

When a malicious phishing attempt is known to be hitting numerous WPI email or phone numbers, Information Security adds it to the Phishbowl. There you can find details about the message, and explanations of the dangerous elements it contains. Checking the Phishbowl when you receive a suspicious message can help prevent you from becoming a victim. If  you have received a message that matches the Phishbowl, do not click links or reply to the sender or caller; just DELETE! If you responded to a message matching the Phishbowl, use Get Support to contact Information Security.

Why is Higher Ed a Target?

Attacks by the numbers:

Ransomware attacks targeted the education sector more than any other industry in the last year.

Of surveyed higher education institutions across the world 79% report being hit by an attack.

Of the higher ed institutions that reported ransomware attacks, 59% said it resulted in major business and revenue loss. 

Compromised credentials caused 37% of attacks.

Malicious emails led to 12% of reported incidents.

Why and When:

Attackers see many higher ed institutions as ‘target-rich, resource-poor’ organizations that don’t necessarily have their own in-house resources for cybersecurity prevention, response, and recovery. In some cases, hackers are ramping up their efforts to get colleges to pay for the return of their data, such as a recent attack at Knox College.

The article notes that of late, the spring semester has been riddled with ransomware attempts. Here at WPI we have noticed that holidays are also a popular time for phishing, when fewer resources may be available to combat attempts and victims may have less time for caution and be more susceptible to fraudulent billing and shipping notices. WPI has also experienced increased phishing attempts at the start of the academic year, when many accounts are new and extremely busy community members may be less likely to recognize phishing.

Prevention

WPI Information Security regularly monitors and improves our security posture to keep pace with ongoing threats. We also rely on each member of the community to remain vigilant by regularly updating apps and devices, and recognizing and reporting attempts.

We congratulate the WPI community on completing a recent successful phishing simulation campaign. A few good news statistics:

• Over 2,000 participants.
• Only 3% clicked a link in the simulated phishing message.
• 100% did NOT supply credentials!
• 63% deleted the message or forwarded to phishing@wpi.edu, actions we have been encouraging and educating the community to take.

To enhance email protection, in our battle against attackers WPI has implemented an additional tool, Abnormal Security,. It complements Microsoft built-in security to provide protection against threats, unwanted mail, and improves risk posture of cloud email. 

More about higher ed metrics, what Knox College experienced when attacked, and additional details are in this Higher Ed Dive article.

Watch out for Summer Scams!

During the summer, these scams increase.

• Employment Scams: These target people who have the summers off. If the money, hours, and/or work sound too good to be true, it's most likely a scam.
• Travel Scams: Be wary if the price of the trip is significantly below the market rate. When using sites like Airbnb or Uber, stick to long established users.
• Moving Scams:  Watch out for hidden fees, estimates far below market rates, and companies that change their name frequently.
• Social Media Scams
  • Ignore accounts you don't recognize.
  • Don't give too many details about when and where you are on vacation.
  • A sign of a spoofed account is a friend request from someone you thought was already connected to you on that platform.
• Ticket Scams: Only purchase tickets from legitimate, online retailers. Scalpers and bogus sites collect your information and sell non-existent tickets.

More details about these scams are available from the Identity Theft Resource Center:

Learning with Laughter