Security Matters

Almost every home network starts with a wireless (often called Wi-Fi) network. This means securing your wireless network is a key part of protecting your home. We recommend the following steps to secure it:

• Change the default administrator password on the device controlling your wireless network. The administrator account is what allows you to configure the settings for your wireless network.
• Ensure that only people you trust can connect to your wireless network. Do this by enabling strong security including requiring a password for people to connect to your wireless network. Once connected, their online activities are then encrypted.
• Make sure the password you provide to people using your wireless network is a strong password that is different from both the administrator password and the network name.
• Remember you only need to enter the administrative password once for each of your devices, as they store and remember the password.

Not sure how to perform these steps? Ask your Internet service provider, check their website, check the documentation that came with your wireless access point, refer to the vendor’s website, review the first 80 seconds of this video:

• Creating a Cyber Secure Home (English)

Other tips to protect your home are:

• Know and secure other network devices in your home
• Keep your home systems up to date
• Use two-step verification for your online accounts
• Back-up your data

Details are also shown in the fact sheet on “Creating a Cyber Secure Home.”

When a site prompts you to create a password: create a strong one — the more characters it has, the stronger it is. Using a passphrase is one of the simplest ways to ensure your password is strong. A passphrase is a password made up of multiple words such as “beehoneybourbon.” We recommend you also use a unique passphrase for each device or online account. This way, if one passphrase is compromised, all of your other accounts and devices are still safe.

Can’t remember all your passphrases? Use a password manager, which is a specialised program that securely stores all your passphrases in an encrypted format (and has lots of other great features too!).

Finally, enable two-step verification (also called two-factor or multi-factor authentication) whenever possible. It uses your password, but also adds a second step, such as a code sent to your smartphone or an app that generates the code for you. Two-step verification is probably the most important step you can take to protect your online accounts and it’s much easier than you may think.

See more detail in this document.

Additional Security Matters articles about passwords:

Cyber attackers are constantly looking for new vulnerabilities in the software your devices use. When they discover vulnerabilities, they use special programs to exploit them and hack into the devices. Meanwhile, the companies that created the software are hard at work fixing them by releasing updates.

Here are some tips and resources to help protect your devices against malware while working remotely:

1. Enable automatic updates on your devices. By ensuring your computers and mobile devices install these updates promptly, you make it much harder for someone to hack you. This rule applies to almost any technology connected to a network, including not only your work devices but Internet-connected TVs, baby monitors, security cameras, home routers, gaming consoles or even your car.  If your computer is managed by your department, automatic updates may already be enabled.
2. Install Microsoft System Center Endpoint Protection (anti-virus for Windows); it is available for no charge on University owned or leased equipment. See microsoft.utoronto.ca for more information.
3. If you are using a work-provided computer remotely, be sure to only download and use products and software that are approved by your department.
4. See this tip sheet on how to protect yourself from phishing attacks.
5. Promptly report incidents to your IT personnel. See this list of contacts for details.

See more detail in this document.

Additional Security Matters articles about malware:

• Ransomware Risk page
• Protect Your Passwords
• Enroll in UTORMFA
• Tips for identifying and reporting a phishing attempt

During this time of change and confusion, personalized cyber attacks are more common and have a greater success rate.

Here are some tips and resources to help you stay safe when working remotely:

1.  Get familiar with the different types of social engineering.
2.  Learn how to spot a phish! The best offence is a good defence!
3.  Learn about the anatomy of a phish.

If you suspect a social engineering attempt, follow this checklist:

• Resist the rush: If someone pressures you to act quickly under pressure, it is most likely an attack.
• Recognize the ‘bag of tricks’: If something sounds suspicious or too good to be true, it probably is.
• Think before you click: Be cautious: One wrong move could infect your device and spread it to others.
• If you are not sure, ask: Ask your manager or your administrator if what you are being asked to do is unusual; ask through your normal methods.
• Do not respond unless you are certain: do not provide your phone number or respond to emails. Hang up the phone if you feel threatened.
• React quickly if you think your account / computer was compromised: change your password and contact your local IT department.

See more detail in this document.

Want to learn more about malware and its effect on the U of T community?

Here are some Security Matters articles on previous incidents that involve social engineering

• CRA Scam Targets U of T University Community
• Canadian Revenue Agency Impersonation Scams on the Rise
• Phishing Attacks Targeting Administration on the Rise

Terminology can be confusing. Social Engineering is the art of human manipulation — see the fact sheet below for details on how to spot them.