Graduate Student Technology News

This message was distributed to the Rice community on September 17, 2019.

Colleagues,

Recent headlines continue to show increased attacks designed to gain access to our accounts and internal resources, including the private information of members of our community.

As a reminder, University Policy 808, the Protection of University Data and Information, requires that all members of the community take appropriate precautions to protect the privacy of information entrusted to our care.

University Policy 808, Protection of University Data and Information
https://policy.rice.edu/808

We can reduce Rice’s risk of exposure by following a few simple guidelines:

• Only collect information needed to support the University.  Keep the information only as long as necessary and then purge the information safely.
• Only grant access to private information to those with a need to know.  Remove access when no longer needed.
• Develop and publish information handling procedures for your department.  Train staff on these procedures.  Review and update these procedures regularly.  Provide refresher training annually.
• Use technology-based solutions to help protect information:
  • Password protect devices storing private information.
  • Use encryption on all devices, especially laptops, tablets, and phones.
  • Only use Rice-approved cloud services like Rice’s Box.com and Google Drive to share files instead of sending them via email.
  • For help with these solutions, contact the OIT Helpdesk by calling 713-348-4357 (HELP) or by emailing helpdesk@rice.edu.

More information about how to safely use information technology resources can be found here:

Guidelines for the Use of Information Technology
https://vpit.rice.edu/guidelines-use-information-technology

Other general information on this topic is available on the Information Security Office Home page
https://vpit.rice.edu/information-security

Protecting the privacy and security of institutional data is your responsibility, and a responsibility we all share as members of this community.

If you think that data has been or may have been compromised (e.g. a hacking attack, or an unencrypted lost laptop), you must notify the Information Security Office immediately by calling 713-348-6754 or by emailing itso-l@rice.edu.

Thank you for your help.

Marc Scarborough
Chief Information Security Officer

This message was distributed to the Rice community on August 20, 2019.

Colleagues,

Recent news articles have reported a coordinated, crippling ransomware attack against over 20 Texas local government entities.  The goal of this attack is likely to hold information hostage and interrupt normal operations unless the attackers are paid.  While the sources of the attack and the methods used by the attacker are under investigation, these situations can often be traced back to someone responding to a malicious email.

While Rice has not been affected, this is a stark reminder of the importance of carefully evaluating emails, especially those that ask for private information, have unexpected attachments or provide links to unfamiliar places.  Here are some basic guidelines to follow:

• Do not download or open unexpected email attachments.  Call the original sender of the email to ensure they actually sent it and ask what it should contain.  If you are unsure, contact the Office of Information Technology (OIT) Help Desk.
• Do not click on links in unsolicited or unexpected emails.  If you are on a computer, you can use your mouse to hover over the link to see where it actually intends to send you.   If you are on a phone, long press (or hold) the link and the phone will show you the link before actually visiting the site.
• Never provide private information, even about yourself or your password via email.  If you need to share private information as part of your role at Rice, only use Rice’s Box.com or our Google Drive.  The OIT Help Desk can help you with this.

If you open an attachment or visit a link from a suspicious email please contact the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu immediately!

While our antispam Proofpoint system catches many of these email attacks, some may still make it through.  We need your continued help to catch these attacks.  If you receive an email that you have questions about, please ask the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu.

Thank you for your continued vigilance in protecting yourself and the Rice community.

Marc Scarborough
Chief Information Security Officer

This is a reposting of an email sent to Rice community on 4-10-19.

Dear colleagues,

As you may know, attackers were able to steal the usernames and passwords of employees with access to admissions portals at several higher education institutions.  The attackers took advantage of flaws in those institutions’ password recovery process.  Once they had access, the attackers were able to download private admissions data.

While our password recovery process does not have the same flaws and is not susceptible to the same type of attack, this incident illustrates that attackers are targeting our account passwords and the tools that manage them.

What we are doing to protect Rice

Two weeks ago, we enhanced our account portal, My NetID, to send email notifications when certain key changes are made.  This includes updates to your password, contact information, and email addresses.  The notifications will be sent to your Rice email address along with the external contact email address listed in the My NetID portal.  If you receive an email notification and you did not make any changes, you should contact the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu.

Additionally, on April 22nd, we will begin requiring Duo, our multi-factor authentication (MFA) system, to access the My NetID portal.  Anyone that has not already set up Duo will be required to do so upon login to https://mynetid.rice.edu.  This change will make it more difficult for attackers to use stolen usernames and passwords to access the account portal and make changes to our accounts.

This enhanced protection will soon be available on other services on campus, starting with those that store or process sensitive, confidential, or other private information, including Slate, our admissions portal, and general access to employee payroll and direct deposit information.

More Information

If you would like to enable this protection now, simply log into https://mynetid.rice.edu and click on “Two-Factor Authentication” in the left hand menu and then click on “Enable Two-Factor Authentication” to start the Duo setup process.

You can also set up or change your external contact address, the one that will receive account change notifications, while logged into the portal.  You can do this by clicking on the menu option titled “Contact Information” in the left hand menu of the page.

A full walk through of this process can be found here:
https://kb.rice.edu/duoguide

For information about managing your Duo devices visit:
https://kb.rice.edu/manageduo

For information about traveling with Duo visit:
https://kb.rice.edu/duotravel

For information about Multi-Factor Authentication visit:
https://kb.rice.edu/whatismfa

Thank you for helping us protect our resources and the privacy of our data.  If you have any questions, please contact the OIT Help Desk at 713-348-HELP or helpdesk@rice.edu.

Thank you,

Marc Scarborough
Chief Information Security Officer