Cybersecurity
Do you lock your car after parking it at the mall? Do you lock your house when you leave in the morning? What about jewellery and valuables: Do you keep them in a safe at home? You probably answered yes to all of the above.
Why, then, would you leave all your personal and work data up for grabs? After all, it is your job that pays for your car, house, and bling. You need a super-secure fence around your cyber-stuff, and we will help you to set it up and keep it locked.
Equipment ownership
You MUST inform ICT Services when you lose or dispose of any equipment. Even if you delete all the data on your device, there is still a way to access some of it. Disposing of equipment is dangerous; let us take care of that.
Information Security Principles
To make sure that all our data and information is safe, we adhere to the following principles:
- Confidentiality: All information is not for all eyes.
- Integrity: Information is only valuable if it is correct.
- Availability: You can only use information if it is available.
- Regulatory compliance: We adhere to data-protection legislation.
Information Security Standards
We adopted the ISO 27000 standard as the guiding principle for information security. It helps us to maintain the appropriate level of information security required to protect our information, information systems, equipment, and processes. However, we cannot do it alone; each information user (including you) is responsible for information security, and together we make a great team!
Internet Risk
Unfortunately, the Internet provides the ideal platform for bogus messages, phishing, and other risks. The ability to keep your wits about you and separate the wheat from the chaff is of the utmost importance.
Remember that:
- Nothing will happen if you don’t forward a threatening chain letter.
- It is not possible that you have a twice-removed uncle, unknown to your entire family, who died and left you his estate.
- You did not win a huge prize in a competition you did not enter, and the cheque is not attached.
- If it sounds too good to be true, it probably is.
Phishing warning signs
-
You don’t know the sender, or a familiar email address looks slightly different.
- The sender does not really know who you are: You are addressed as “Dear Sir/Madam”, the message was sent to many people or to irrelevant people, or your email address was in the Bcc field.
- The date and/or time does not make sense: late at night, in the early-morning hours, over a weekend, etc.
- The email subject is unusual (coming from someone you know), and demands urgent attention. The subject may also be generic, or presented as a reply to a message you never sent.
- The content is unusual, with grammar and spelling errors, or it makes you uneasy or confused; if it does not make any sense, ignore and delete it.
- Don’t open a suspect attachment. If you are concerned about the email, the attachment may compromise your machine.
- Hyperlinks may lead you into unsafe territory; don’t open links if they do not have proper descriptions or contain spelling errors, or if you did not expect to be sent that type of information.
- Be cautious of websites that request any personal information or have misspelled URLs.
Here is an example of a NO-GO email:
From:
winner@micosoft.com
To: you@ufs.ac.za
Date:
Thursday December 16, 2017 2:17 am
Subject:
Urgent response required
We are pleased to announce that you are a
winner in the
lucky annual Microsoft sweepstakes since your e-mail address was selected. To
claim your reward of $1 000 000 (one million US dollars)
click on the link below and complete the required information within the next 24 hours.
http://www.micosoft.com
We are looking forward to make you the next millionaire.
Sincerely,
David Sharp
Microsoft Manager
|
Protecting your data, devices, and identity
Password. Password. Password. That is the key to cyber-protection for users. We run superior antivirus programmes to keep the big bugs at bay; but we need you to select and guard your password appropriately.
Your UFS password
- A single username and password are used for all systems.
- An easy way to remember a complex password is to construct it from a sentence, such as “Roses are red, violets are blue”, which might become “RaR,vaB5”. Another example could be to use a line from a song like “Wake Me Up Before You Go-Go”, which might become “Wm^b4uGoGo!”. Please DO NOT use either of these two examples as your password.
- Ensure that the correct antivirus programme is installed and always updated to reduce the risk of malware that can record credentials.
- Change your password immediately by visiting the Password Self-service System if you suspect that someone might have gotten hold of your credentials. Please report any security incidents to the Service Desk at ICT Services by phoning +27 51 401 2000, sending an email to servicedesk@ufs.ac.za, or logging the problem on SolveIT.
DO NOT:
- Use numbers such as your date of birth or other numbers that could be easily guessed. If you use numbers that have a specific meaning to you, the connection should not be obvious to others.
- Use dictionary words as the main part of your password.
- Use the names of loved ones or your name as part of your password.
- Save your password in your browser, since hackers or malware can exploit this.
- Give your password to ANY person; including your spouse, children, colleagues, or ICT Services staff members.
- Use the same password on UFS systems and external systems.
- Enter your password by following a link in an email to a foreign website. We will inform you about all external official systems that integrate into the UFS password system.
- Allow unauthorised people to use your computer, since they can install malware such as a keyboard logger, which records all keystrokes (including passwords).
- Write your password down. Use the tips given under the first section to generate a complex password that can be remembered easily.
Password Policy:
Our requirements for a secure password are:
- Minimum password length of 8 characters.
- Minimum password history of 12 times.
- Maximum password expiry of 90 days.
- Enforcement of password complexity by using alphanumeric, numeric, and special characters.
- Account lockout threshold of a maximum of 5 failed login attempts.
Related security topics
Request a security report
To reduce the risk of exploitation, your devices constantly need to be updated. We automatically update computers; you can also request a security report for your devices by logging a request with the ICT Service Desk. Have your contact information and computer host name (as displayed on your desktop) available.
What is ransomware?
This type of malicious software (malware) wants to infect and control your computer, and encrypt files and documents stored locally and on network shares. The ransomware may lock your computer, and demand a ransom ranging from £20 to more than £5 000 (GBP) to unlock your device. If your computer received ransomware, kill the power immediately! Unplug your machine, and call the ICT Service Desk at +27 51 401 3000.
Protect yourself from ransomware at work:
- DO NOT open suspicious emails and/or attachments.
- Store your files in a UFS-managed location so that you will have backups. Ensure that the Druva backup system is working correctly by regularly logging into the system and verifying that your data is backed up.
And at home:
- Be sure to back up your most important files on a regular basis, ideally to a separate drive which isn't connected to your computer except when a backup is being made.
- If you notice a suspicious process on your computer, turn off the power immediately and seek assistance.
- Avoid giving out your email address where possible.
Sensitive Information
Please don’t share sensitive UFS information with unauthorised personnel or external parties. If you lose sensitive information, the owner of the information must be notified immediately. Lock offices and cabinets where sensitive information is stored. When you dispose of sensitive information, use a shredder or other acceptable method (see Information Security Policy).
Who is responsible for Information Security?
The UFS acknowledges an obligation to ensure the security of all its information, information systems, equipment, and processes within its domain of ownership and control. This obligation is shared by every member of the university, including staff, students, contractors, and visitors.
Why is Information Security Important?
We own information that is sensitive and valuable, including (but not limited to) personally identifiable information, financial data, research, etc.
Some of the information is protected by government laws or contractual obligations that prohibit its unauthorised use or disclosure.
The exposure of sensitive information to unauthorised individuals could cause irreparable damage to the UFS or members of the UFS community, and could also subject the university to fines or other government sanctions.
If our information is tampered with or becomes unavailable, it could impair the university’s ability to do business.