The U’s phishing and cybersecurity awareness efforts - Information Security Office

Criminals are becoming increasingly brazen in their cyberattacks on higher education institutions and health care systems. Often, these attacks target students, faculty, staff, and patients using phishing schemes.

Phishing takes many forms — such as a fraudulent email that impersonates a university official — and often asks people to respond by selecting an infected link or visiting a compromised website. They all share a common goal: getting people to share sensitive information, such as login credentials, credit card information, or other restricted and/or sensitive information.

The University of Utah and the U’s Information Security Office (ISO) is doing as much as possible to prepare, protect, and educate our students, faculty, and staff about this growing risk. You are the first line of defense against phishing, social engineering, and other online threats.

To accomplish this objective, the university has enlisted the help of KnowBe4, a well-known cybersecurity and phishing awareness company. In February 2022, the ISO kicked off an awareness campaign for the entire organization, starting with faculty and staff. Students will participate later.

These efforts consist of simulated phishing emails, brief online awareness learning exercises, and a variety of fliers and handouts. Simulated phishing campaigns and awareness efforts are a standard practice for most large organizations today, and U students, faculty, and staff should expect them as a regular and routine activity of the university’s cybersecurity program.

This awareness effort complies with University of Utah Information Security Policy 4-004, requirements in numerous grants and contracts, and various local, state, federal, international, and industry regulations.

Objective

The purpose of simulated phishing campaigns and awareness efforts is to prepare, protect, and educate the U community. The simulations, deployed in a safe practice environment, test whether users identify or fall victim to a fake phishing email. Additionally, the effort will provide training on how to recognize, avoid, and report phishing attacks in order to protect faculty and staff, their departments, and the campus and hospital from cyberthreats.

Scope

The current scope includes all university employees. Students will participate at a later date.

Strategy

The ISO will periodically send emails that resemble a phishing attack. If a user opens the link in the email and attempts to log in with or without entering their credentials, the user will be taken to a University of Utah and KnowBe4 webpage that indicates they have fallen for a mock phishing attempt. The user will then receive an email that they have been enrolled into KnowBe4’s phishing awareness.

Participation

Participation is mandatory as it builds awareness about phishing attacks and assists the U community in better identifying and avoiding malicious emails. You will receive an email from KnowBe4 with a link to the phishing awareness module, which takes about 15 minutes to complete.

FAQ

If you receive a phishing attempt through a university email account or cannot tell whether an email is legitimate, the Information Security Office (ISO) asks that you immediately report it using the Phish Alert Button. The Phish Alert Button is the simplest and fastest way to report suspicious emails.

Open or select the suspicious message, then select the Phish Alert Button to send it to the ISO for review.
If your email client does not have the Phish Alert Button, forward the email as an attachment to phish@utah.edu.
For more information on how to report suspicious emails, please visit this IT Knowledge Base article.

After reviewing the suspicious email, the ISO will notify you whether it is a phishing attack. If the message is malicious, the ISO will remove it from your inbox.

If, by accident, you click on a questionable link and enter login credentials, immediately go to the CIS website — https://cis.utah.edu/ — and change your password. In addition, contact the ISO's Security Operations Center at soc@utah.edu to notify information security staff.

If you need further assistance, please contact your respective IT help desk:

UIT Campus Help Desk: 801-581-4000
University of Utah Health ITS Service Desk: 801-587-6000

If you have questions or concerns about the please contact the ISO Governance, Risk & Compliance team at ISO-GRC@utah.edu.

Resources

IT Knowledge Base articles: