Category: Information Security

In these unusual times, with many of us getting to grips with blended working or studying, we need to be even more vigilant and aware of our cyber-security.  In particular, look out for ‘spear phishing’ campaigns that attempt to steal valuable information and plant malicious software.

Spear phishing emails and media posts can be highly sophisticated and difficult to spot. They are carefully drafted and often appear to be sent by a friend or company you know, a colleague or even a senior member of the University. You may be asked to share sensitive information or to access a file or document which contains malicious software.

What should I do?

• If you are unsure the request is genuine, simply delete it
• Don’t respond, open any attachments or click any links
• If the request seems unusual or unexpected, check directly with the sender (preferably by telephone)

Please remember:

• These requests are not genuine and should just be deleted
• The University will never ask for your password
• If you receive an email asking for your password or sensitive details, it’s a scam

If you would like further guidance or if you have clicked on a link and provided any details, please contact the IT Service Desk on 0191 208 5999.

There’s a few steps you can take to make sure unwanted guests don’t hijack your Zoom meetings:

Use a unique meeting ID

Don’t use your Personal Meeting ID (PMI) to schedule meetings as this may allow users that have joined a previous meeting to rejoin. Your PMI is best kept for instant meetings with people you chat with regularly.

Schedule meetings with a Unique Meeting ID, especially for large or public sessions.

Add a meeting password

It’s recommended you set a password for all meetings and webinars. You can add ‘require meeting password’ when scheduling your meeting. Invitees will be asked for the password in order to join.

Make sure you send the meeting password in a separate email (not in the meeting invite in case calendars are public). For attendees joining by phone, pick a numeric password (6 digits is good).

Create a Waiting Room

You can create a virtual waiting room when scheduling your meeting and, as a host, decide who you will or won’t allow into your call.

Lock your meeting

Once a meeting has started you, as a host, you can lock the meeting to stop anyone else joining (at the bottom of the screen choose More > Lock Meeting).

Limit screen sharing to the Host

Zoom screen sharing settings can be configured either in advance or during a meeting to allow only the host to share their screen:

1. Click the up-arrow next to Share Screen.
2. Select Advanced Sharing Options.
3. Under Who can share, click Only Host.

Meetings in your Outlook calendar

Remember, Zoom meetings in your Outlook calendar may include the Zoom meeting password – exposing it to anyone who views your calendar. Try making the calendar entry private or editing the entry to remove the Zoom meeting password.

Remove an unwanted guest

If you need to give an unwanted attendee the boot:

1. Click Manage Participants at the bottom of the window.
2. Next to the person you want to remove, select More.
3. Click Remove.

Unsettling times of crisis and confusion provide an ideal opportunity for email scammers to catch people off-guard.

Criminal organisations are targeting medical research facilities with Covid-19 themed phishing emails, fake mobile apps, and fake web advertising.

We’re also aware of a phishing email which suggests ‘you have a new document from OneDrive’.  It appears to be sent by a member of the University or someone you know, but it’s not a genuine email and should just be deleted. 

We’ve created a short cyber-security refresher quiz to help you spot the scammers. It covers the following topics:

• Understand why we need to keep certain types of information secure
• Identify the types of information we need to protect
• Understand the potential impact of a data breach
• Remember practical steps we can take to keep information secure

Take the cyber-security quiz now.

Criminal organisations are targeting medical research facilities with Covid-19 themed phishing emails, fake mobile apps, and fake web advertising.

Common themes include world outbreak maps, where to buy N-95 face masks, and communications fraudulently claiming to come from the World Health Organisation.

These emails, fake apps, and adverts contain ransomware that destroys critical research data, while also uploading that data to the dark web.

A UK medical research facility has already been hit by such an attack.

In our case, criminals are targeting home workers, who are no longer protected by the University’s firewall, and are using devices that may not provide the same level of protection as University devices.

We’ve published some guidance on how to protect yourself, and your important work, against these social engineering attacks and malicious software.