Cybersecurity Awareness Month

Basic Hygiene

What is Cyber Hygiene?

Cyber hygiene refers to the everyday practices and habits that individuals and organisations adopt to protect their digital systems, devices, networks and data.

Cyber hygiene is an ongoing, preventative routine that helps keep you safe from a range of digital threats. The main goal is to reduce the risk of cyberattacks, data breaches and other security incidents.

By making good cybersecurity practices part of your everyday routine, you can significantly reduce your vulnerability to cyber threats.

Good Cyber Hygiene Practices

Be Wary of QR Codes

QR codes provide a quick and convenient way to access information, but they can also pose a security risk. Cybercriminals may use QR codes to direct you to fake websites designed to steal your information or install malware on your device.

Only scan QR codes from sources you know and trust. If a QR code takes you to a website, check the web address carefully before entering any personal or login information.

Practise Strong Password Management

Weak or reused passwords can provide cybercriminals with an easy way to access your accounts.

Create a strong, unique password for every account. Consider using a passphrase made up of three random words, combined with a mixture of uppercase and lowercase letters, numbers and symbols. This can create a password that is both strong and memorable.

Never store your passwords in an unsecured document on your computer or write them on a Post-it note or other easily accessible location. Doing so could result in your password being compromised.

Always Use Multi-Factor Authentication (MFA)

Even if your password is stolen, Multi-Factor Authentication (MFA) can provide an additional layer of protection by requiring you to verify your identity using another device or authentication method.

Enable MFA on all accounts whenever it is available.

Your UHI account has MFA enabled by default. This keeps your account secure and allows you to use the Self-Service Password Reset service if required.

We recommend using the Microsoft Authenticator app (others are available) as your default authentication method.

Never approve an MFA request that you did not initiate. Doing so could give a cybercriminal access to your account if they have attempted to sign in using your credentials.

If you repeatedly receive unauthorised MFA requests, report them as fraudulent through the Authenticator app, change your password. and advise the UHI IT ServiceDesk.

Protect Your University Email Address

Your UHI email account provides access to university systems and services, making it an important part of our overall security.

Avoid using your university email address to sign up for personal services, newsletters or third-party websites. Where possible, use your personal email address for these services to keep your university account separate and reduce the risk of it being affected by external data breaches.

Report Security Incidents Immediately

We have systems in place to monitor activity and identify potential security incidents. However, there can be a delay between an incident occurring, an alert reaching us, and action being taken.

That's why it is important to report any suspected security incident to the UHI IT ServiceDesk immediately.

Reporting an incident quickly can help us investigate the issue, limit its impact and protect other users and university systems.

Lock Your Computer Screen

It may seem simple, but locking your computer whenever you step away is one of the easiest and most effective ways to prevent unauthorised access.

An unlocked computer could allow someone to view, copy or tamper with your files and access information available through your account.

Make it a habit to lock your screen whenever you leave your desk, even for a moment.

Online Safety

What is Online Safety?

Online safety is about understanding the risks that exist in the digital world and knowing how to protect yourself, your information and the University from them.

By staying vigilant and following a few simple security practices, you can significantly reduce your exposure to online cyber threats.

1. Be Wary of Search Engine Ads

The Problem:
The first results displayed on Google and other search engines may be sponsored advertisements. Cybercriminals can use these adverts to promote malicious websites that are designed to look like legitimate businesses or services.

The Risk:
Clicking on a malicious advert could take you to a fake website designed to steal your login credentials, install malware or trick you into providing personal information. These websites can look very convincing, making them difficult to identify as fraudulent.

The Guidance:
Be cautious when clicking on search engine advertisements. Look for the "Sponsored" or "Ad" label and, where possible, scroll past advertisements and select the official website from the organic search results.

2. Be Careful with Free Browser Extensions and Plugins

The Problem:
Browser extensions and plugins are small pieces of software that add functionality to your web browser. However, installing unapproved or untrusted extensions can introduce significant security risks.

The Risk:
Some free extensions may contain hidden malware or request excessive permissions, such as the ability to "read and change all your data on the websites you visit."

These permissions could allow an extension to monitor your browsing activity, access sensitive information, steal passwords, display malicious adverts or compromise your accounts.

The Guidance:
Never install unapproved browser extensions on University devices.

If you need a specific tool or extension for your work, request it through the UHI IT ServiceDesk. If an extension is approved and necessary for your role, make sure it comes from a trusted and official source and carefully review the permissions it requests before installing it.

3. Check for a Secure Connection (HTTPS)

The Problem:
When you visit a website, information is exchanged between your device and the website's server. If the connection is not properly secured, your information may be at greater risk of being intercepted.

The Risk:
An insecure connection could expose sensitive information, such as passwords, financial details or personal data, while it is being transmitted.

The Guidance:
Before entering sensitive information, check the website's address bar for "https://". The "s" indicates that the connection is encrypted.

You may also see a padlock icon next to the web address. However, remember that HTTPS only indicates that the connection is encrypted - it does not guarantee that the website itself is legitimate. Always check that you are visiting the correct website before entering any information.

Avoiding Phishing

What is Phishing?

Phishing is a type of scam used by hackers and cybercriminals to trick people into taking an action that benefits the attacker, such as revealing personal information, stealing login credentials or gaining access to an account.

Email is one of the most common methods used for phishing, but phishing attempts can also be delivered through text messages, phone calls and other communication platforms.

A phishing message may encourage you to:

• Visit a malicious or fraudulent website.
• Download malware onto your device.
• Provide your username, password or other personal information.
• Transfer money or provide financial information.
• Open a malicious attachment.

Phishing messages are often designed to look legitimate and may appear to come from a trusted organisation, colleague or service.

How to Spot a Phishing Email

There are several warning signs that can help you identify a potential phishing email:

• Check the sender's email address: Does the address look genuine? Be particularly cautious of addresses that contain unusual domains, spelling mistakes or unexpected variations of a legitimate organisation's address.

• Ask yourself whether you were expecting the email: If the message is unexpected or unusual, take a moment to verify it before taking any action.

• Be wary of urgency: Messages telling you to "Act now", "Verify your account immediately" or warning that your account will be suspended are common phishing tactics designed to make you act without thinking.

• Be cautious of offers that seem too good to be true: Scammers may use attractive deals, prizes or unexpected opportunities to encourage you to provide information or download malicious content.

• Look for unusual wording or spelling mistakes: Poor spelling and grammar can be warning signs. However, phishing emails are increasingly well-written, particularly with the use of generative AI, so a well-written message should not automatically be considered safe.

• Check links before clicking: Hover over links to see where they will take you. Make sure the destination matches what you would expect before clicking.

• Never enter your password after following an unexpected email link: If you are asked to sign in, navigate to the official website yourself rather than using the link in the email.

• Be cautious with attachments: Don't open unexpected attachments, even if they appear to come from someone you know. If you were not expecting the attachment, verify it with the sender through another method before opening it.

How to Report a Phishing Email

Reporting a phishing email is simple and can be done directly through Outlook.

1. Select or right-click the suspected phishing email.
2. Select Report and then choose Report phishing.

If you are unsure and would like an email checked, or you would like to report a phishing email, please contact UHI IT ServiceDesk or your local ICT team.

Already Interacted with a Phishing Email?

Don't panic. If you have interacted with a phishing email by:

• Replying to the message.
• Providing your personal or login information.
• Clicking a link.
• Opening an attachment.
• Downloading a file.

Contact the UHI IT ServiceDesk immediately.

Reporting the incident as soon as possible allows us to take steps to protect you, your account and the University. Even if you are unsure whether an email was malicious, it is better to report it so that it can be investigated.

Privacy & Protection

Privacy

Every user is responsible for protecting their personal data, as well as any data they access or handle as part of their work, studies or research.

Generative AI can be an incredibly useful tool, but it is important to consider privacy and security when using AI services. Understanding how your information may be processed and stored can help you make safer choices when using these tools.

Be Cautious with Artificial Intelligence (AI)

AI provides powerful capabilities and can be a valuable tool for learning, research and everyday tasks. However, the increasing use of AI also introduces privacy and security risks.

The information you provide to an AI service may be processed, stored or used in ways you may not be fully aware of. Always consider the type of information you are sharing before submitting a prompt.

Guidance:

• Treat AI like a public forum. Don't share anything with an AI service that you would not feel comfortable posting publicly online. Before entering information, consider whether it is personal, sensitive or confidential.

• Check your privacy settings. Many AI services, including popular chatbots, provide settings that allow you to manage how your information is stored or used. Where available, review options such as Memory and settings that control whether your conversations can be used to train AI models.

• Review and delete stored conversations. Regularly check your chat and prompt history and delete information that is no longer required. Even when privacy controls are enabled, conversations may still be retained for a period of time. Keeping stored information to a minimum can help reduce the potential impact of a data breach.

• Check AI-generated information. AI-generated content is not always accurate and may contain errors, misleading information or bias. Always review and verify AI-generated output before relying on it, submitting it as part of your work or sharing it with others.

Protection

The University has a range of security measures in place to protect its systems, networks, accounts and data. Many of these protections operate in the background, so you may not interact with them unless something requires your attention.

These security controls are designed to help you complete your studies and research safely while protecting your accounts, personal information and University data.

University security measures are not designed to inconvenience you. They are in place to protect everyone and help keep the University network secure, reliable and accessible.

Please take security measures seriously and follow any guidance or requests from the University. By working together, we can help maintain a safe and secure digital environment for everyone.

Devices & Networks

Devices

The University has many devices across campus that are managed and maintained by the University. These devices have a range of security protections in place to help keep your accounts, data and the University network safe.

Personal devices may not have the same security protections unless you have configured them appropriately. Taking a few simple steps can significantly improve the security of your devices.

What You Can Do to Protect Your Devices

• Use a Secure Device Lock: Protect all your devices with a secure method such as a PIN, password, fingerprint or facial recognition. Avoid using simple or easily guessed PINs and passwords.

• Enable Automatic Updates: Turn on automatic updates for your operating system, web browser and applications. If updates are already enabled, remember to restart your device regularly so that updates can be installed.

• Enable Automatic Screen Lock: Configure your device to lock automatically after a period of inactivity. This helps prevent unauthorised access if you leave your device unattended.

• Enable Device Encryption: Where available, enable encryption such as BitLocker on Windows devices or FileVault on macOS. Encryption helps protect your data if your device is lost or stolen.

• Use Anti-Malware Protection: Make sure your device's built-in security software, such as Microsoft Defender, is enabled and kept up to date. You may also choose to use a reputable third-party antivirus solution.

• Use Secure File Storage: Avoid connecting unknown or untrusted USB devices to your computer, as they could contain malware. Store and share University files using approved University storage services, such as SharePoint.

• Review App Permissions: Regularly check which applications have access to your camera, microphone, location, contacts and files. Remove permissions that an application does not need.

• Install Software Safely: Only download and install software and applications from trusted sources and official app stores. Avoid downloading software from unknown websites or links.

• Enable Remote Device Protection: Where available, enable device tracking and remote lock or wipe features on your phones, tablets and laptops. These features can help protect your personal information if your device is lost or stolen.

Networks

Public Wi-Fi is convenient and is often available in places such as cafés, hotels, airports and on public transport. However, using an untrusted network can introduce additional security risks.

The University has no control over the security of public Wi-Fi networks. Some networks may be poorly secured or operated by malicious individuals, potentially putting your information and device at risk.

An unsecured or compromised network could expose your online activity or provide opportunities for attackers to target your device. Other users on the same network may also attempt to intercept information or exploit vulnerabilities.

Good Practices

• Avoid accessing sensitive accounts: Where possible, avoid using public Wi-Fi to access particularly sensitive services, such as online banking.

• Be cautious with file sharing: Never accept unexpected file-sharing requests or downloads from people you do not know.

• Disable automatic Wi-Fi connections: Turn off automatic connection to open or unknown Wi-Fi networks. This prevents your device from connecting to potentially unsafe networks without your knowledge.

• Use mobile data for sensitive activities: Where possible, use your mobile data connection rather than public Wi-Fi when carrying out sensitive activities.

Use Eduroam on Campus

When you are on campus, we recommend using Eduroam rather than public Wi-Fi.

Eduroam is a secure and reliable network that provides students and staff with protected access to the internet and University resources.

Always connect to the official eduroam network and follow University guidance when setting up your device.