P
rivacy and Security Developments
In March the COVID-19 novel coronavirus changed the way we all work, play, shop and interact. It also changed drastically the cybersecurity environment as our network perimeter moved from being mostly inside our school’s LAN and WAN to now existing everywhere at staff and students’ homes. ECNO will continue to pursue and collaborate on solutions to keep you and your board's security effective and efficient.
ECNO’s Security Corner – with Steve Payne, RISA for Eastern Ontario
COVID-19 themed phising schemes
Cybercriminals have taken advantage of the opportunities brought forward by the global coronavirus pandemic. Taking advantage of Government programs such as the Canada Emergency Response Benefit (CERB) and information to theme their landing pages to look like authentic Government agencies. They are going to great lengths to make Canadian content look legit by offering both English and French sites.
Messages can be through email or text message and may look to play on the fear created by the pandemic. You may be asked to provide personal information with the premise you have been in contact with someone else who tested positive for the virus. Other messages have been seen where fake health organizations are requesting funding and donations for emergency supplies and/or PPE .
Always check that the From: address whether by email or text is a reputable and known source. Watch for like domains where criminals will look to make the address of the website they want you to visit look similar to the real one. Be suspicious if you receive a message sent to your board email or cell phone when you have never provided that information to the entity asking the questions. Watch for Health Units asking for your personal information from a location where you do not reside. If you have concerns of the validity of a message always check with someone on your IT team. A lot of times they will know some of the indicators that a message is phishing and can help you to determine if you should respond or not.
Cybercriminals will always be opportunistic and try to take advantage of things that are in the news. Common trends emerge from topics that are getting the most media coverage.
IT teams need to protect school board staff by keeping them up to date on what themes are trending in Cyber Security. Are we posting tips on how they can protect themselves from new threats? Creating an awareness surrounding Cyber Security does not need to be formal training. Frequent tweets or posts about specific topics can create a culture of Cyber Security interest and awareness. Giving users the tool of knowledge to protect themselves online does double duty to protect the organization and the individual. “
Please let me know if you want me to make any changes or additions.
Thanks
Steve Payne, CISSP
Regional Information Security Analyst (Eastern Ontario)
Vetting of Application Security and Privacy Service
The OASBO Joint ICT-PIM Working Group has established and tested a process for conducting risk assessments on educational web applications. We are moving forward with our plans to conduct risk assessments centrally for the benefit of all boards. The outcome of each assessment includes a list of risk mitigation strategies that boards and schools can implement in order to use the application safely.
Please note, we are also looking for volunteers to assist in the review of applications! Shadow the experts as you gain skills during the review process. This is a great opportunity to build expertise in your board. Scheduling is flexible; your commitment can be as little as a couple of hours per week. We need people with Privacy, Security, or Risk Management expertise. If you are interested or want to learn more, submit your name, school board name, email address and area of expertise to Wayne Toms via email at
ed@ecnoconnect.org
.
We will be following up with further details soon regarding expanding this as an ECNO Shared Service for the 2020/21 school year.
