Phishing

YOU, the employee, are the best line of defense

 

PHISHING | an attempt by cybercriminals posing as legitimate institutions, usually via email, to obtain sensitive information from targeted individuals.

 

What to do

  • When in doubt about an email, call the supposed sender at a trusted phone number to verify.
  • To report a suspicious email, click the Phishing Alert Button (top right) if you have it in your Outlook client:
    report phish button
    ...OR alternatively, forward the entire suspicious email to OTSsecurity@tnstate.edu.
  • Read the tips below and stay alert for regular emails about cybersecurity threats at TSU.

Tips for safe email use

  • Never click on links sent to you in an unexpected email or with strange links.
  • Never click on file attachments sent to you in an email unless you know the sender and verify with him/her by phone.
  • Beware of emails that contain a generic greeting such as “Dear Member” or “Dear Customer”.
  • Always verify the senders and recipients email addresses before responding to content involving sensitive information. For instance, discussing private information, payments, or a legal matter.
  • Never respond to emails whereby the sender is pushing you to panic, to take an urgent action, or to provide some information.
  • Never respond immediately to demands made from a supposed authority such as an IT administrator or manager, a department chair, or the university president, … etc. Slow down and verify whether this demand is expected or reasonable. Call someone to verify if it involves money or sensitive data.

Tactics used by hackers to deceive you

  • Using a sending address that looks very close to one of the legitimate addresses the user is familiar with.
  • Using a fake sending address from someone claiming to be an authority such as an IT administrator or manager, a department chair, or the university president, … etc.
  • Use of alarming language, a financial lure, or otherwise an attractive situation, with the intention to get the recipient to panic, to take an action, or to provide the requested information.
  • Sending the email from an email using a legitimate account holder’s software or credentials, typically using a bot that has taken control of the email client or malware that has stolen the user’s credentials.

 

Be a human firewall