A warm welcome to the Fall Semester for all new and returning Gulls!

As we settle into the new academic year and routines, it's the perfect time to focus on security. Cybercriminals love busy times like this because they know we're all distracted with new classes, new responsibilities, and new connections.

Our Information Security newsletter is designed to give you quick updates on campus security, the latest threats, and simple tips to keep your personal information and our campus safe.

Remember to Lock Your Screen

Leaving your computer unlocked when stepping away to grab coffee or pick up a document from the printer creates an opportunity for unauthorized access.

If someone steals your computer or plugs in a malicious USB drive while it's unlocked, they can get all of your data in a flash. 

Lock Shortcut: Use Win + L (Windows) or Ctrl + Cmd + Q (Mac) every single time you step away from your computer.

Set Short Screen Timeout: Configure your screen saver lock timeout to five minutes or less - and make sure it requires your password when you get back! 

Beware of Okta Bombing 

If you suddenly receive repeated Okta push notifications asking to approve a login you didn't initiate, do NOT tap 'Approve' to make them stop!

Hackers who obtain your password will bombard your phone with 2FA prompts late at night, hoping you will accidentally hit approve out of frustration or distraction.

Deny and Report: Always tap 'Deny' on unexpected push notifications and report the attempt to Endicott Campus Technology ASAP. (The button is right there in Okta!) 

Change Password: An unexpected 2FA prompt means someone already knows your password. Change it right now!

Customize your Canvas Dashboard

Students: You can now customize your Dashboard in Canvas! Instructions can be found at this link. Just click "Switch to new Dashboard View," and you can begin adding widgets related to your coursework, announcements, grades, and more! 

We use this section to highlight real Cybersecurity incidents in the news that are relevant to our daily lives as students, employees, and people living in the modern world. 

Hackers Spend Nearly $7M on Expired Domains - Cybercriminals have spent nearly $7 million buying up newly expired web domains to weaponize their established history & trust. Instead of hacking sites directly, scammers buy old, reputable links to bypass security filters and seamlessly redirect people to illegal gambling and malware. This highlights how online trust can be bought and repurposed, proving that even familiar or historically safe web addresses can be instantly hijacked to deliver scams.  

Fake VPN Extensions Steal Traffic - Security researchers discovered over 700 fake Chrome VPN extensions that quietly hijacked and redirected users' browser traffic through secret attacker-controlled servers. This campaign demonstrates how easy it is for bad actors to use familiar brand logos and storefront listings to build instant trust. For everyday users, downloading an untrusted extension just to get around a website's geo-block potentially hands attackers full visibility into your personal browsing data, unencrypted passwords, and online activity.