Cybersecurity

Jump to:

Cybersecurity—the practice of protecting digital information and infrastructure—requires the diligence and attention of the whole Smith community. Approximately 90% of security breaches occur with human error. Increased awareness and regular training help prevent these incidents and maintain the security of both Smith and personal data.

Fraud Prevention with Duo

ITS provides two-factor authentication through Duo to help you protect your account information. Two-factor authentication requires you to verify your identity on a second device (such as your phone or other mobile device) before you finish logging into your account.

If you receive an alert from Duo (push notification, text, or phone call), when you are not in the process of logging into a Smith application, DO NOT approve the request. An uninitiated notification indicates that your password has been compromised.

If you did approve a notification but believe it was not initiated by you:

Change your password immediately.
Contact ithelp@smith.edu

If you ignore or deny the notification:

Change your password immediately. If you use the same password for other accounts, change those as well.
If you have selected "Deny" on a notification, you will be prompted to report the request as fraudulent and will receive a follow up communication from ITS.
If you receive a Duo phone call you did not initiate, press 9 to report the suspicious activity and then change your password immediately.

Phishing Prevention and Reporting

Google Email

Email phishing is a type of cyberattack where criminals send deceptive emails designed to trick you into revealing sensitive information, such as passwords, financial data, or personal details. These messages often appear to be from a trustworthy source, like a bank, a well-known company, or even Smith College.

Recognize Phishing Attempts

Phishing emails often contain one or more of the following:

Sense of Urgency or Threat: The message asks you to act immediately, often threatening consequences like account suspension, service interruption, or financial/legal trouble if you don't click a link right away.
Request for Sensitive Information: The sender asks you to reply with, or click a link to "verify," personal data like your password, Social Security Number, credit card number, or other credentials. Legitimate organizations rarely request this via email.
Suspicious Sender Address: The email address is slightly misspelled, uses an incorrect domain (e.g., a bank email coming from a @gmail.com address), or doesn't match the sender's name.
Generic Greetings: It uses a general salutation like "Dear Valued Customer," "Dear User," or "Dear Account Holder," rather than addressing you by your full name.
Unexpected Attachments or Links: You receive an attachment you weren't expecting (especially files like .zip, .exe, or documents you didn't request), or the email's entire purpose is to make you click a link.

Report a Phishing Email

If you suspect an email is phishing, promptly report it directly from the message. Once a phishing attempt is reported, ITS blocks the message from being forwarded to other users.

In the upper right corner of the message, select More (3 vertical dots) then select Report phishing from the menu.
After reporting a phishing message, immediately delete the message by selecting Delete this message or the Trash Can icon. Do not forward phishing messages with links to other users.

If You Respond to a Phishing Message

Take these steps if you provided your Smith username and password in response to a phishing scam, or if you believe your Smith email has been compromised for any reason:

Change your password immediately.
If you have used this same password for any other sites or services–especially financial sites–then change those passwords. (Reminder: do not use your Smith password on any other systems.)
Check your Smith email account and other Smith accounts that you have delegated access to. Check filters and rules to make sure there aren’t any new ones that you didn’t create. Check both Sent and Trash to see if there are messages that you don’t recognize.
Contact ITS User Support to request help and get additional instructions, which often depend on the situation. Include the email subject line and the date and time you responded.
Review Google security information. To review Google security settings and recommendations for your account, select the Google Apps grid (9-dot matrix), found in the upper right-hand corner of your Gmail screen, then select Account. (Alternatively, go to myaccount.google.com.) From the left sidebar menu, select Security and review the information, including any security issues found.

Google Calendar

Calendar invites can also be used for phishing attacks. Bad actors may send a fake calendar invitation that not only lands in your inbox, but also appears in your calendar automatically, making it seem more legitimate. Look for the same signs mentioned above in Recognize Phishing Attempts.

Report a Calendar Phishing Attempt

Report these calendar events as Spam.

Open the calendar event and select the three dots on the top right, then select Report Spam at the bottom of the list of options.
The event will be removed from your calendar.

Adjust Calendar Settings to Help Prevent Phishing

You can adjust the settings for which events appear automatically in your calendar.

From your Google calendar, select the Settings menu (gear icon) at the top of the screen.
Select Settings.
Select General from the left sidebar, then select Event Settings.
Select the dropdown under Add invitation to my calendar and choose an option:
- - From everyone (all calendar invites appear on your calendar)
  - Only if the sender is known (only invites from known senders, including your contacts and other people at Smith, will appear on your calendar)
  - When I respond to the invitation in email (calendar events are not added until you respond to an email invitation)

Visit the Google help article Manage Invitations in Calendar for more details about each option and a quick video of the process.

Training

Smith community members are required to take cybersecurity awareness training annually. This training provides an introduction to cybersecurity best practices and concepts, and aims to prepare the Smith community for the challenges and opportunities presented by an ever-changing technology. The training is necessary to help prevent cybersecurity breaches and maintain the security of both Smith and personal data. In addition, it is required for Smith’s cyber liability insurance coverage.

This task will be completed in the Workday app called Learning. You'll be notified by email when the training program is available.
For detailed instructions, see the help article: Learning: Required Cybersecurity Training and Acceptable Use Policy
Training must be completed within 30 days of receipt.
Community members will receive regular reminders when their training is due.

FAQs

What does the training include and how long will it take me to complete?

The program includes two courses. First, you'll watch a series of videos about cybersecurity awareness and answer questions at the end of each. Then, you'll read and acknowledge the college's Acceptable Use Policy. It should take between 15 to 20 minutes to complete the training.

How will Smith know that I have completed my cybersecurity training?

Workday will maintain records related to completion of the training.

What other security steps does Smith take?

ITS uses a layered approach to cybersecurity at Smith, in accordance with best practices established by security professionals and researchers. This includes:

The use of tools, such as firewalls, to prevent network intrusion
Email filters to prevent inbound phishing and spam messages from reaching Smith users
Identity management tools, such as Duo, to keep accounts secure
Risk management program to identify and mitigate risks to data and its infrastructure

By layering these approaches in tandem with a well-informed, regularly trained user community, Smith can enhance its security posture and drastically reduce the likelihood of a successful attack or breach.

Page updated

Report abuse