Stay Informed: The Columbia College Chicago Cybersecurity Blog

A Brief Note on The Biden Administration’s Student Loan Debt Relief Plan and Scams

As the Biden Administration has recently announced that borrowers can apply for debt relief, borrowers may be targets of scams claiming to assist with debt forgiveness, cancellation, relief, or other student loan services.

The Federal Government states that “you never have to pay for help with your federal student aid. Make sure you work only with ED and our loan servicers, and never reveal your personal information or account password to anyone.”

All communications regarding federal loans sent to borrowers should come from noreply@studentaid.gov, noreply@debtrelief.studentaid.gov, and ed.gov@public.govdelivery.com.  Any emails you feel that may be a scam should be reported to the Federal Trade Commission by calling 1-877-382-4357 or by visiting reportfraud.ftc.gov. 

As always, please remember to scrutinize emails and phone calls, do your research, and think before clicking that link.

Previous Blog Posts:

• Staying Secure While Traveling

  The College has a Travel and Business Expense Policy that provides departments, managers and employees guidance regarding business travel and expense for both reimbursements and procurement card purchases. Travel may expose you to some special data security risks. Before you travel, please review the following helpful tips to avoid incidents while traveling.

  
  

  Before You Leave

  • Ensure that you remember your username and password for accessing all Columbia College resources.
  • Always enable a screen lock with either a biometric (e.g. fingerprint or face recognition) option or PIN number on all of your devices.
  • Minimize the number of devices you take with you. Extra laptops, tablets, or smartphones you will not need on your trip only increase the risk that something will be lost or stolen.
  • It's important to remove any confidential data you do not want anyone else to see. If you need any confidential data during your trip, its best to save it in the cloud storage.
  • Check with IT to ensure that you will have access to resources such as VPN and/or Horizon View (VDI). You can request access to the college's VPN while traveling abroad by submitting this TeamDynamix request.
  • Complete a full backup of all devices before you leave to make sure you will not lose important information if any devices are stolen or lost.
  • Make sure all of your devices are secured with a strong password and encryption.
  • Confirm that all your device operating systems, antivirus programs, and other software is up to date with the latest security patches.
  • Carry only essential identification documents and credit cards. Leave the rest in a secure location at home or locked in the office.
  • It’s best to inform your bank and credit card companies of your travel plans.

  
  

  While You Are Traveling

  • GlobalProtect VPN is required to access Columbia College Chicago resources such as Files Shares on Isilon, FEITH, Cognos, Aquity Reporting, MyC (Peoplesoft), and Jenzabar Client.
  • You should always consider Wi-Fi networks and computers in public places to be insecure, and always use a VPN when you use them.
  • If you are purchasing a new SIM card for your device, remember that this may affect how you receive Duo pushes/SMS for authentication. It is recommended that you use the Duo passcode option for authentication.
  • Disable the "auto-connect" feature on your devices to services such as Wi-Fi and Bluetooth to avoid automatically connecting to insecure networks and devices.
  • Use airplane mode to keep your device wi-fi connectivity suspended in public spaces unless you are actively working online.
  • Do not loan your device to anyone.
  • Do not leave your device unattended.
  • When using your device, stay aware of the people around you.
  • Do not click on suspicious links or system prompts while you are browsing the web or checking your email.
  • Report lost or stolen devices to local authorities and IT support as soon as possible.
• Be Aware of What You Plug into Your Device

  Be Aware of What You Plug into Your Device

  Recently, the cybersecurity company Red Canary released a new report on a piece of malware, dubbed “Raspberry Robin”, that infects computers using USB storage devices as a delivery method.  “Raspberry Robin” works automatically, i.e. when an infected device such as a flash drive or external hard drive is plugged into a computer, the malware automatically runs and infects the computer with a virus. 

  “Raspberry Robin” is nothing new.  Attack strategies such as this have been around for many decades and are a very effective way of infecting or infiltrating a computer system.  This presentation from The Black Hat Hacking Convention in 2016 showed that, in a study conducted with University of Michigan and University of Illinois, out of 297 usb devices dropped randomly on a college campus, 45% of them were successfully used to “exploit” a machine.  In other words, 45% of the devices were plugged in randomly to a computer and successfully phoned back to the servers they were connected to.

  While the usage of USB storage is on the decline due to new, cloud-based solutions like OneDrive, this new report is still a stark reminder that you should never plug a USB device into your computer unless you know where the device came from.  Even if you may be grabbing a device from a drawer in the workplace to erase/reformat and use like a new device, there may be malicious applications on the device leftover from another user who mistakenly or unknowingly allowed malware onto it.

  The best way to protect your computer and the college’s data is to use a new device or one that is known to you.  In the event you need to use an old device of unknown origin, ensure that the AutoPlay feature is disabled on a Windows computer, and, once the device is connected to your computer, do not click on or open any files on that device until it has been reformatted.

• DUO Multi-Factor Authentication

  DUO Multi-Factor Authentication

  DUO is one of many solutions that offer multi-factor authentication, or MFA.  MFA, according to the National Institute of Standards and Technology, “is a security enhancement that allows you to present two pieces of evidence – your credentials – when logging in to an account.”  MFA is not specific to just computing technology, for example, another way you may use MFA on a regular basis is when you access your bank account at an ATM.  Your debit card is one form of credentials, and your PIN is a second form. 

  Using two different forms of credentials when logging in has an incredibly large impact on the security of a system.  According to Microsoft, there are over 300 million fraudulent sign-in attempts to their cloud-based systems every day.  By enabling and utilizing MFA, 99.9% of those fraudulent attempts, which pose the potential for a massive cyberattack, are prevented.  Because of this, organizations seeking to protect their users and data from credential-based attacks i.e. attacks where stolen, or “compromised”, usernames and passwords are used to gain access to confidential and critical systems, will implement DUO wherever possible.

  For more information, please see the following Multi-Factor Authentication (Duo) intranet page.

  

• The Importance of Being Updated

  The Importance of Being Updated

  While the process of updating operating systems (such as Windows or MacOS) and other software can often seem like an inconvenience, keeping your devices up to date is increasingly more important as the amount of cyberattacks continues to rise.  As the Cybersecurity and Infrastructure Security Agency states, “new vulnerabilities are continually emerging, but the best defense against attackers exploiting patched vulnerabilities is simple: keep your software up to date.”

  While it can be cumbersome to go through the process of installing updates, or “patching” as it is referred to in the IT world, and restarting your device, doing so is one of the most important steps you can take to keep your devices secure.  New vulnerabilities in software are discovered every day, these vulnerabilities can be exploited by hackers and other threat actors to gain access to your computers, mobile phones, and other devices.  Once they have exploited a vulnerability to gain access, it is possible to steal sensitive data, install malware, or even destroy the device completely. 

  For most software developers it is one of the most important components of their operations that they actively, and continually, look to discover vulnerabilities in their software before threat actors do.  This is why there are regular updates for most of the devices and applications that you use, and why you must install software updates for your devices when they are released.