|
GREGORY W. WALLACE |
|||||||||
|
|||||||||
|
THE SAINT ANSELM CRIER
Information Technology Addresses Security Issues Including Phishing, Other Dangers
A symbol of status in today’s technology-oriented world is touting the number of emails one receives, and Saint Anselm College has nothing of which to be ashamed; last Friday, the college email system received over 133,000 messages for students and staff. But the college also has something to be worried about: over 90 percent of those emails -- 122,000 -- were spam. Considerable attention has been devoted to the email-based scam, pronounced as is the popular sport and leisure activity of anglers, where schemers pose as a legitimate organization -- a bank, a governmental agency, and even the college’s Information Technology help desk service -- and “phish” for personal identifying information, such as a user name, password, or credit card number. Recently, the New York Times has reported on a scam involving Google’s email service, GMail; the Baltimore Sun reports on an iTunes store fraud; and USA Today writes that Trojan programs, a malicious bit of computer code essentially similar to viruses, are employed by hackers to phish information from online banking websites. In many cases, the email messages ask users to confirm, update, or change personal information, either by replying to the email, visiting a website via a link within the email, or calling a telephone number. In all of these cases, the email, as well as the corresponding website or phone answering service, appear legitimate in graphics and words. But Jacques Plante, customer service manager for the college’s Office of Information Technology, says the message itself, not the appearance, should raise flags. “We don't ask you for your password,” he said. “Usually an agency won't ask you for your sensitive information.” Mr. Plante’s office, centered around three computers, four monitors, and a futuristic-looking telephone, appears to be the cockpit of the college’s computer network. But he says IT -- and no one besides the individual user -- knows a student or faculty member’s password, and that there is no reason to give it out. “People are too trusting,” he thinks. Rarely do students or staff contact Information Technology as victims of phishing in their college email account, but he stresses the importance of vigilance. He says it is easy to trust one’s business or school account more than a personal account, but phishing schemes are targeting the college, too. The Federal Trade Commission, responsible for consumer protection and business regulation, has several suggestions for avoiding the pitfalls of phishing expeditions. “If you get an email or pop-up message that asks for personal or financial information, do not reply,” the FTC advises. “And don’t click on the link in the message, either. Legitimate companies don’t ask for this information via email.” In general, the commission advises a personal policy against using email to send “personal or financial information.” Attached files or documents can also be malicious, as can links within the message itself. Mr. Plante has a considerable quantity of email coming to his inbox. In addition to the correspondence one would naturally associate with a customer service professional, he is responsible for a level of purchasing and product research. His email address, he says, is in many company databases and on numerous mailing lists, and his junk email summary reflects the fact. Email users on the college network are likely familiar with the college’s junk email protection, although he says they might not be aware. College-owned anti-spam software checks every incoming email message against an algorithm that looks at the subject line, content, and who the message is from. “It actually works in the background all the time,” Mr. Plante said. “We try to buy a product for campuses like ours with thousands of mailboxes.” Finding a product that works campus-wide is a challenge. Messages sent to various academic disciplines, students, and administrators range run the gamut in content, and a blanket algorithm, or set of rules applicable to all campus inboxes, is a challenge to master. Although a hundred thousand plus messages may be stopped in a single day, Mr. Plante says that messages inevitably get through the wall, and that legitimate messages may be mistakenly caught by the system. The filtering program has been known to catch email notifications from the popular social networking site Facebook, as well as bulk email newsletters. It also stops all “spoofed” emails, those purporting to be from a college account, but actually sent by ill-meaning people off campus -- and their robotic computer coding -- with too much time on their hands. “There is nothing that is hidden,” Mr. Plante said. The anti-spam software regularly sends each user with blocked messages a notification email, and users can log on to http://nospam.anselm.edu to work with the program itself. Students using the WebMail system can “right-click” on a particular message and designate it as junk. Junked emails are categorized within the anti-spam system by potential for legitimacy; as one reaches the lowest echelons of the spam summary, the messages are increasingly unlikely to be relevant. Mr. Plante says the best practice to avoid falling victim to a phishing scam is “be skeptical. Be a little bit suspicious.” The Information Technology help desk service receives questions about fishing regularly, and is a resource. “Start by calling the help desk. If you're pretty sure its junk, delete it,” he said. No one predicts that spam and phishing email will go away soon, and Mr. Plante says IT will continue to notify the campus of common email scams reported to the help desk. “We're trying to be more proactive to get the information out to people.” He says that sometimes he questions, “ ‘Who is going to look at these stupid things’ -- but then people do.” |
|
||||||||