Cybersecurity experts at Iowa State are warning students about phishing attacks and are urging for increased cybersecurity literacy, with October being cybersecurity awareness month.
“Hackers really want to get access to anyone’s email account at Iowa State, because once they get access, they can phish other Iowa State users, and it looks way more legitimate,” ISU Chief Information Security Officer Rich Tener said. “The best way to protect your email is to make sure you don’t get tricked into entering your password and your multifactor authentication into the wrong login site.”
Tener explained that safeguards are in place through ISU’s email service provider, Microsoft Exchange, to protect students and faculty from phishing attacks by stopping them before they reach the inbox.
“They catch somewhere around 99% of all phishing attacks that come in, and almost half a million phishing attacks every month,” Tener said.
The safeguards work by recognizing common phrases and words or unfamiliar links in potentially dangerous emails, and blocking them before anyone has a chance to open the email.
“If you click on a link that we know is malicious, Microsoft will actually block that, and when we find a phishing attack, if it has a link to a malicious website, we can put that into our Microsoft block list,” Tener said.
ISU prevents impersonation attacks by preventing anyone outside of the university from using an iastate.edu email unless authorized by the IT department.
“Most of the time they’ll [attackers] come along, they’ll have some really urgent email,” Ethan Ruchotzke, a graduate student studying computer engineering, said. “Like ‘You need to sign this immediately, or you’ll be expelled,’ or ‘Your paycheck won’t come through unless you open this link and go to this page and insert information.’”
Ruchotzke outlined attackers’ mindsets, explaining that they take advantage of human psychology by exploiting the trusting part of every individual to get the information they want.
“If you see an urgent email, don’t immediately click the link because it looks interesting,” Rochotzke said. “Take your time; if you see something suspicious, if you get an urgent email, chances are you have time to respond. So don’t feel time pressured.”
Electrical and Computer Engineering professor Doug Jacobson explained that attackers have made a push in the last three to four years in using AI language models to write emails that sound more human-like to draw individuals in.
“In cybersecurity, we’ve always had to adapt,” Jacobson said. “Every five years or so, there’s some brand new technology that shows up that our adversary can utilize. We’re always constantly changing our curriculum based on the new skills of our adversaries.”
“Everybody is a potential victim. So everybody needs to have background information,” Jacobson said.
CyberED at ISU works to teach everyone basic cybersecurity tricks to ensure email security. They do this by going out to businesses, conferences and schools, showing how people can actually protect themselves instead of relying on safeguards that don’t block everything.
“We have the goal of educating every Iowan in cybersecurity,” Jacobson, director of CyberED, said. “That is something that we take very seriously, and the education needs to be put in a way that it is understandable, actionable and does not rely on fear and other sorts of non-constructive motivators.”
For more information on email security and how ISU protects against attacks, visit Iowa State’s IT website. For more information on outreach programs, visit the CyberED website.
——————————————————-
Click Here For The Original Source.
