NC State is celebrating its annual Data Privacy Month from Jan. 28 to Feb. 28, and is using this time to bring awareness and to educate members of the university on topics of digital security and privacy.

Katie Mclnerney, the Office of Information Technology (OIT) training coordinator and chair of the cybersecurity awareness team, explained some of what her office does during Data Privacy Month.

“Data Privacy Month is an attempt to increase user awareness about protecting personal and university data,” McInerney said. “We are promoting three programs this year, we rolled out a newly required data security training module for all our employees. All current employees need to take the 20 minute online training module covering basic cyber security topics.”

Events regarding mobile security have been scheduled, McInerney added.

”We have two other events on February 27,” McInerney said. “The first is a mobile device security checkpoint. Between 10 a.m. and 2 p.m. in the main lobby of Talley, we will have subject matter experts on iOS and Android devices who will be present to talk to users and making sure that their devices are secure. We also have a formal presentation from noon to 1 p.m. in Talley [Room 3285] on general mobile device security for protecting both personal and university data.”

Mclnerney strongly encourages students to enroll in two-factor authentication through the Duo program.

“We use Duo security for any interface that uses Shibboleth login,” McInerney said. “We encourage students to use two-factor authentication for all their accounts. The great thing about two-factor authentication is that it can prevent about 98% of compromised accounts.”

Andy Raynor, an information security specialist at OIT, explained the importance of data privacy for students.

“Graduate students work on research projects and grants, which makes them custodians of university data,” Raynor said. “Undergraduate students have a concern of protecting their personal data to prevent identity theft or financial fraud. These factors make data privacy extremely important for students.”

Fake job offers are among the most common phishing attacks, Raynor explained.

“The most common phishing attacks we see are the fake job ads which request personal information to compromise the accounts of students,” Raynor said.

According to Raynor, one of the best ways to counter such fake job attacks is to use the Gmail tool to report phishing directly to Google.

“As more people report the email, Google blocks phishing emails of that kind, which is beneficial for all the users, student or otherwise,” Raynor explained.

Sarah Ward, security incident response analyst at OIT, said that NC State faced 1774 total attacks in 2018 which is approximately five attacks per day, and the team is working hard to protect students’ data against such phishing attacks.

“We are trying to check messages to build content rules so that we can identify phishing messages before they hit student inboxes,” Ward said.

Raynor says that the largest phishing attacks are related to fake job offers, followed by scams involving purchasing gift cards.

“A few days back we got 500 to 600 messages of fake job offers that made it through Google’s first security pass and then got caught,” Raynor said. “These usually revolve around titles of personal assistant, virtual job assistant, remote worker etc.”

An obvious tell of a scam is asking for personal information right off the bat, like social security numbers or credit card details, McInerney said. Additionally, she said that locking personal devices and having strong passwords are good security measures in general.

Ward noted that some attackers seek alternative routes of contact in their scams.

“Since many such attackers know that they are contacting a student through the university, they ask for an alternate means of communication so that the information can be taken off the university’s channels,” Ward said.

Mclnerney explained that awareness of threats is the most crucial part of personal security.

“We can have all the checks we want, but ultimately it’s the human awareness that is the most crucial element of data privacy,” McInerney said.

More information about the Data Privacy Month can be found here.