Category Archives: Higher Education

  • -

New Resources for Security Awareness

Category:Higher Education,Information Security,Infosec Communicator,Internet Safety,Uncategorized Tags : 

Having trouble with security awareness at your university or college? Need some new ideas? Trying to figure out what to do for National Cyber Security Awareness Month?

The members of the EDUCAUSE Higher Education Information Security Council (HEISC) Awareness and Training Working Group have created some wiki-based resources to help you with your security awareness initiatives.

We’ve created two main resources.

  • The Quick Start Guide (https://wiki.internet2.edu:443/confluence/x/sRpG) provides ideas and resources for launching a security awareness program. Topics range from establishing an Information Security Awareness Program to different techniques and vehicles for “getting the message out.” The Quick Start Guide is useful for both beginning and advanced security awareness programs.
  • The Detailed Instruction Manual (https://wiki.internet2.edu:443/confluence/x/yBpG) provides additional topics around selected security awareness initiatives including campus-specific efforts and tips on communicating specific issues.

Check out these resources. The A&T Working Group is delighted to share their ideas with you and they’re there to help you be successful. They have a wide range of expertise and they believe you’ll find these materials valuable.

Enhanced by Zemanta

  • 1

Having Fun with Security Awareness–Phishing

Category:Higher Education,Information Security,Infosec Communicator,Social Networking,Uncategorized Tags : 

Phishy

Phishy and Ritchie at RIT

The task of creating a culture of information security awareness in higher education can be a daunting one. You may feel as though your efforts are unnoticed and unrewarded. However, one of the really cool things about working in higher ed is that universities and colleges are often willing to share their best practices and even the materials they’ve created. This can ease the burden of coming up with new ideas to to help increase user awareness of information security threats.

Over the last couple of years, higher education has seen an increase in phishing attempts known in the industry as “spear phishing.” Spear phishing targets a specific group of individuals by crafting emails or other “bait” that appear to come from a known and trusted source, such as a school’s Information Technology department. In 2009, RIT saw a string of phishing attempts that had, from our view, a success rate that was unacceptable. (Much as we’d like to block all phishing attempts and train our community to recognize and not respond to password requests, someone will always fall for a well-crafted phish.)

Unsure of how to best combat the threat, we formed a team of our best information technology and information thinkers to address the issue. We chose a multi-pronged approach with both technology and people initiatives. We increased our email alerts and advisories to inform the community of the problem. Our Information Technology Services organization began prepending a warning message to all incoming emails that contained the word “password” in the text. However, we knew that this wouldn’t be enough to solve the problem.

One of our coop students had worked the previous summer at Yale University and showed us phishing awareness posters that they had created. We received permission from Yale to modify the posters for our own use and began a poster campaign on campus. We decided to go a step beyond.

What better way to draw attention to phishing than having a giant “phish” walk around campus! Phishy was an instant hit. Phishy visited offices around campus and greeted students with cards that reminded them to NEVER respond to requests for their passwords. Phishy hung around RIT for a week twice during 2009.

Gil Phish

Gil Phish at Yale

This fall, Yale leveraged our Phishy idea. They bought a fish costume and greeted new students at orientation. (They also created a Gil Phish Facebook page with pictures of Gil engaged in behavior that could only be described as sub-crustacean…

Building off of each others successes has enabled both universities to create innovative security awareness programs.

Enhanced by Zemanta

  • -

Higher Ed, Where’s the Mobile Content?

Category:Higher Education,Infosec Communicator,mobile device,Uncategorized Tags : 

In general, the pace of change far exceeds the ability of any large organization to adapt and adopt, be it a professional organization, an educational institution, or many companies. Mobile content is a good example. Although we’ve know that the rate of adoption is high, in a recent Chronicle of Higher Education Wired blog posting,  Kelly Truong stated that a research study at Ball State University found that about 90% of students were using their smartphones to access the internet.

At the Rochester Institute of Technology, we’re seeing some movement towards providing mobile content, including online coursework. The E. Philip Saunders College of Business has also designed a smartphone app for their students.

Do you use a smartphone to access the internet? Are you happy with the experience? Are any of your companies/colleges, etc. designing web pages for mobile users? Are you designing coursework for mobile users? Developing any corporate apps for iPhone, Android, Blackberry, etc.?

Enhanced by Zemanta

Categories