Information Security Alert: Change your RIT Password and Heartbleed Follow Up

Information Security Alert: Change your RIT Password and Heartbleed Follow Up

Why am I receiving this message?

We wanted to provide an update on the Heartbleed situation and remind you to change your RIT passwords. The Heartbleed bug has been widely reported and will require action on your part.

  • Heartbleed bug background—there is a flaw in versions of OpenSSL that allows access to information that would normally be protected through secure connections. The Heartbleed bug allows anyone on the Internet access to see what's in the memory of systems protected by Open SSL, leaving no evidence that they’ve done so. Approximately 2/3 of all websites are affected. Researchers reported the bug on April 7, but the vulnerability has existed since 2011. Note that this is not a breach of a password databases. Website owners and vendors worldwide are in the process of updating/patching the servers hosting these websites.
  • Current Heartbleed status-there are a lot of varying recommendations on what computer users should do in response to the Heartbleed bug and which websites were affected, and you may find it confusing. You have been affected. Many of you have been contacted by the owners of various websites and services and have been asked to update your passwords. Popular websites such as Dropbox, Yahoo, Twitter, and others were affected and many of them are requesting password changes.
  • Android—there are reports circulating that older Android devices (4.1.1) may be vulnerable to the Heartbleed bug. Google has stated that less than 10% of devices run on vulnerable versions.

What You Need To Do

  • For RIT passwords, please change your passwords. Given the scale of this vulnerability, there is concern that passwords may be at risk.
  • For personal passwords, we recommend that you change your passwords. Priority should be given to sites accessing private information, financial accounts and email. Note that if the website is still vulnerable, you may need to change your password again after the site is patched.
  • Stop using the same password for multiple sites! Create a new unique password for each site. Yes, this is painful.
  • Be alert for phishing attempts leveraging the publicity around the OpenSSL bug.
  • Be patient. It may take several weeks (at least) for companies to fix the Heartbleed bug and there may be disruption to Internet services.

What RIT is Doing

  • RIT has successfully secured the vast majority of our computing infrastructure with patches and other mitigations. Some lower profile services have been taken offline until patches are released and mitigations applied. This is a necessary step to protect RIT.
  • RIT continues to work with vendors to implement patches and other mitigations.
  • The RIT Information Security Office continues to conduct vulnerability scanning of the RIT network until all vulnerabilities have been addressed.
  • RIT is quarantining the small number of systems currently affected until they are remediated.
  • Many thanks to the RIT information technology community that has been working around the clock to patch and protect RIT!

For More Information

Multi-Factor Authentication

Enabling multi-factor authentication is one of the best things you can do to make sure your account information is not compromised.  Passwords alone will not always protect you, but using two or more steps to verify you are the account holder will help keep your accounts secure.

Common actions that lead to your password being stolen are:

Protective Mobile Device Software

One in every five people in the world own a smartphone according to a 2013 report in Business Insider and with the significant growth of smartphone usage, the issues surrounding mobile security have also grown. 

Avoid Questionable Mobile Apps

One in every five people in the world own a smartphone according to a 2013 report in Business Insider and with the significant growth of smartphone usage, the issues surrounding mobile security have also grown. 

Using LinkedIn’s New Two-Factor Authentication

The growing trend in sites adding two-factor authentication to their log in process has many feeling more secure in their social media and other online interactions.

With passwords being easy to compromise with phishing attacks, many users have been hoping for something more secure.  Two-factor authentication gives a double protection on your account, requiring you to know something (your password), and have something in your possession (a token).  The token can be any number of devices, cards or other physical items, often generating unique codes as proof you have the object.  Think of ATMs.  You need to have the ATM card (the token) and know your PIN in order to access your account and do any transactions at the ATM.  One without the other and you can’t get in.

LinkedIn is using a single-use code sent via SMS to whatever mobile number is listed on the account.  Your mobile device serves as your token.  This code is entered into the site after you enter your password to complete the two-factor authentication.  The idea behind this is if your password happens to be cracked or phished, as long as you don’t lose or compromise your phone, you are still safe from attackers logging into your account (though you should change your passwords and do a virus scan to be safe if your password gets compromised!).  

Want to enable this security feature for your own LinkedIn account? LinkedIn provides some instructions here:  http://www.slideshare.net/linkedin/two-step-verification-on-linked-in.  

Many other sites have similar security features so check out your account settings and give yourself an extra layer of protection.

SECURITY NOTES:

As with any security chain, there are ways this could possibly be compromised.  The easy way is if an attacker knows your password and stole your phone.  A more sophisticated way is if you get phished for both your password and the code just sent to you, and the attacker users both before the code expires.  How likely could these happen?  Well that’s up to your security prowess.  Read more on our website about creating secure passwords (https://www.rit.edu/security/content/password), avoiding phishing attempts (https://www.rit.edu/security/content/phishing) and best practices when it comes to mobile device security (https://www.rit.edu/security/content/mobile-devices). 

Data Privacy Month--Private Information Disposal

This article was also published in the Quaestor newsletter of RIT's Institute Audit, Compliance, and Advisement.

Did you know that January is Data Privacy Month? 

For the last two years, we’ve focused on remediation and disposal of Private Information resident on RIT computers and we’ve made great progress. Have you thought about disposing of Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) that’s not on your computer? We encourage you to review paper filed, disks, CD/DVDs, video tapes, and any other type of storage media containing Private Information and dispose of those containing unnecessary Private Information appropriately.  Don’t forget that retention of RIT information is also governed by the Records Management Policy (C22.0).

Paper files containing Private Information pose a risk both to RIT and to the individuals whose information if in the materials. For example, on April 14th, 2011, Central Ohio Technical College found that course information had been left in a filing cabinet at an off campus storage facility, compromising the Social Security Numbers of over 600 registered students. RIT used a similar system with Social Security numbers until June 2006, when University IDs became the main means of registration and identification on campus. DataLoss DB (https://datalossdb.org/statistics) indicates that almost 25% of breaches have been due to the inadvertent loss of private information, in both paper and digital formats. Disposing of unnecessary Private Information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) will help ensure RIT complies with Private information laws, policies, and procedures. 

 New York State defines private information (PI) as:

any personal information concerning a natural person combined with one or more of the following data elements: Social Security number (SSN), driver's license number, account number, or credit or debit card number in combination with any required security code. These combinations of information are often used in identity theft.

The New York State Information Security Breach and Notification Act requires that RIT notify affected consumers if their Private information is compromised.

If you’re not sure of whether or not to dispose of Private Information on your computer,  check with your manager or consult the Private Information Decision Tree here https://www.rit.edu/security/content/private-information-decision-tree

For more information about the Private Information Management Initiative, check out our PIMI FAQ page https://www.rit.edu/security/content/private-information-management-initiative-pimi-faq and our Document Destruction page https://www.rit.edu/security/content/document-destruction

Data Privacy Month: Are You Smarter Than Your Phone?

Data Privacy Month: Are You Smarter Than Your Phone?

 

Did you know, “Smartphones can predict a user's gender with 71% accuracy, & can distinguish between ‘tall’ and ‘short’ people and ‘heavy’ and ‘light’ people, with about 80% accuracy?” Take a look at this recorded webinar from the January 9 EDUCAUSE Live! Data Privacy Month kickoff event with special guest, Rebecca Herold (the Privacy Professor) to find out just exactly how smart your Smartphone is.

Nearly everyone on a college campus today has a mobile phone, capable of accomplishing amazing tasks while on the go. But, how SHOULD you make use of your smartphone? You are smarter than your phone if you know that you need to make careful choices about using your geo-location feature. You might post a picture to Facebook while on your European trip if there are other people still living at your address back home. But, if your house is empty while you travel, you would be smarter to wait to post until you get home. Do you really want everyone to know you are out alone at midnight by "checking in" at your local donut shop? You are smarter than your phone if you use sound judgment about revealing your location. You’re smarter than your phone if you know you need to think critically about the sensitivity of the data you put on or access through your phone. Do you use your phone for banking, without password protecting the device? Your phone is happy to do it. But you are smarter than your phone if you protect it with a password. If you’re not thinking critically about what you do with your phone, we’ll help you think again!

The webinar covers fun facts as well as 16 ways to mitigate Smartphone security and privacy risks. Topics include tracking, info access, malware, breaches, loss, theft, ID theft, physical security, social media, and apps.

Webinar recording, slides, and chat transcript are available here http://www.educause.edu/library/resources/data-privacy-month-are-you-smarter-your-phone