Received a suspicious message?

Report a phish

Appointed faculty to be automatically enrolled in UTORMFA

May 14, 2022

All appointed faculty who have not already self-enrolled in the University of Toronto’s (U of T) multi-factor authentication (UTORMFA) will be automatically enrolled by June 15, 2022. Once enrolled, UTORMFA will be used to access all University systems.

Last year, U of T introduced UTORMFA as part of its continuing effort to protect the U of T community, their personal data and the University at large. Over the past year, more than 95 per cent of appointed staff and 88 per cent of appointed faculty members have enrolled.

Why enroll?

UTORMFA adds an extra layer of security to your login, enabling you to work remotely with confidence. Using UTORMFA to access University systems significantly enhances the security of your data and that of the University.

What you need to do:

If you have not already done so, please enroll in UTORMFA by visiting the UTORMFA enrollment and device management portal to ensure your access to University systems is not interrupted. It only takes 10 minutes!

If you have any difficulties enrolling or using UTORMFA, please contact the help desk for assistance:

 

For more information, please visit the UTORMFA faculty webpage.

Information security news roundup: Ransomware attacks, text message scams and cyber security training

April 19, 2022

In recent years, headlines about information security incidents have become increasingly common both nationally and internationally. Cyber criminals steal passwords, personal information and other sensitive data through various types of cyber attacks. Staying up to date with cyber security news and knowing how to stay safe online will help protect your personal information.

Take a look at some interesting information security related news in the recent months.

Making ransom payment no assurance of getting data back: Telus

Ransomware attacks have been making headlines almost daily around the world. According to a recent study by Telus, almost half of surveyed Canadian organizations that suffered a recent ransomware attack paid the attacker in hopes of getting their data back, however, most did not get access back to their data.

Ransomware attacks can have significant impact – in the worst cases, shutting down operations entirely and risking loss of critical information. Learn how you can protect yourself from ransomware.

Winnipeg Regional Health Authority warns public of text message scam

The Winnipeg Regional Health Authority (WRHA) reported that people are receiving text messages claiming to be from the WRHA, asking recipients to click on an e-transfer link. This scam was reported to the Canadian Centre for Cyber Security.

This form of phishing that uses fraudulent text messages is called “smishing”. Learn more about the types of scams and frauds and how to protect yourself.

Panasonic Canada acknowledges cyber attack

Japanese electronics conglomerate Panasonic has reported that its Canadian operations were struck by a cyber attack in February after ransomware-as-a-service (RaaS) gang Conti leaked its data to the dark web. The company confirmed that action was taken to address the issue with assistance from their cyber security experts and service providers.

Check out the educational resources on the Security Matters website to learn how to stay safe online.

Cyberbreach at Rideau Hall was ‘sophisticated’ intrusion, internal documents reveal

In December 2021, Rideau Hall reported a breach of internal networks in the office that supports the governor general. Now, new documents have revealed the breach was a sophisticated cyber incident, although the office was unable to confirm the extent of the information that was accessed.

Cyber breaches can lead to loss of sensitive data and reputational damage. Timely reporting of incidents can help mitigate their impact.

University of Calgary and Raytheon Canada partner to open new cybersecurity training centre

The new Canadian Cyber Assessment, Training and Experimentation Centre (CATE) will support students in building their skills in cyber security.

At U of T, building a security aware culture is critical for protecting individuals and the university against security threats. Recently, the University partnered with the Canadian Internet Registration Authority and ORION to pilot an Information Security Awareness platform as part of building a security aware culture at U of T.

For more tips on staying safe online, visit the Security Matters website.

Guidance to prevent Zoom bombing

March 19, 2022

The University of Toronto (U of T) community has reported an increase in Zoom bombing instances, where unwanted intruders take over and disrupt video-conference calls. We encourage all staff, faculty and students to adjust their settings and take precautions to avoid these situations. Here are some best practices you can incorporate when organizing and attending Zoom meetings:

Set up authentication security options
Within your U of T licensed Zoom account, hosts can limit registrations to only allow U of T users to register. This helps avoid any external intruders.

Use Zoom webinar to limit interaction options
If you are hosting a virtual gathering that is open to people outside the U of T community, consider hosting a Zoom webinar instead. This limits participants’ interactions to the chat function.

Password-protect your meeting
Once the registration period has closed, the host can create a meeting password and provide it only to registered participants. However, keep in mind that if this email is forwarded, anyone with the password can access your meeting.

Enable the waiting room
This function allows the host to control who can enter the meeting. Hosts can also customize who can automatically pass through the waiting room, such as users in your account or co-hosts.

Suspend participant activities where needed
Hosts can enable or disable participant audio, video and screen sharing settings, both in-meeting and when initially scheduling. More drastically, hosts can click “Suspend Participant Activities” to disable all video, audio, in-meeting chat, annotation, screen sharing and recording.

Assign co-hosts
Assign trusted colleagues as co-hosts, with the responsibility to monitor the chat and video screens and remove unwanted participants from the meeting. Have a plan for your co-host to let the host know if the meeting needs to end immediately.

Remove unwanted participants
From the Participants menu, hosts can mouse over a participant’s name, and several options will appear, including Remove.

All the features above can be enabled/disabled through the Settings menu of your profile on the web client. Read these articles for more tips:

If you need clarification about this guidance or require technical assistance after experiencing Zoom bombing, please contact q.help@utoronto.ca.

If you have concerns for your personal safety following an incident of Zoom bombing, please contact the Community Safety Office.

Data privacy: A multi-faceted topic in higher education

February 23, 2022

To celebrate Data Privacy Day on Jan. 28, Information Technology Services (ITS) hosted a virtual panel event: Impact of evolving technology and privacy laws in higher education. The one-hour event opened a conversation about data privacy and protection and answered privacy questions from the University of Toronto (U of T) community.

Over 145 attendees including staff, faculty and students from the tri-campus community joined virtually to learn from legal, cybersecurity and privacy experts on how changes in technology and privacy laws impact higher education. The featured panelists were:

  • Ashley Langille, Information Privacy Analyst
  • Carlos Chalico, IT Risk and Privacy Consultant, EY & Instructor, School of Continuing Studies, U of T
  • Daniel Michaluk, Information Security and Privacy Lawyer & Partner, Borden Ladner Gervais LLP
  • Deyves Fonseca, Associate Director, Information Security Operations

The event was moderated by Rafael Eskenazi, Director, Freedom of Information and Protection of Privacy (FIPP) Office.

“The Data Privacy Day virtual panel event provided a great opportunity to engage with the U of T community, to answer their questions about privacy and to share University resources they can use to protect personal information,” said Kalyani Khati, Associate Director, Information Security Strategic Initiatives.

Highlights from the event

DPD panel event screenshot

From left to right: Deyves Fonseca (bottom left), Daniel Michaluk (top left), Rafael Eskenazi (top right), Carlos Chalico, Ashley Langille (bottom right)

Daniel Michaluk began the session by speaking about the Freedom of Information and Protection of Privacy Act (FIPPA) and observed how there hasn’t been an adverse regulatory finding about a university’s privacy practices since FIPPA was introduced in Ontario. Michaluk explained that this can be attributed to the good work done by the universities of Ontario, so there is no historical basis for additional regulation in the sector.

“Right from the start in 2006, all the Ontario universities took FIPPA and privacy protection very seriously, and from some good work early on by the Council of Ontario Universities, there’s been a continuous dialogue in the sector about privacy,” he said.

Speaking about the University’s digital transformation, Deyves Fonseca expressed that the pandemic brought significant changes with the move of data to the cloud. He said that the move to using the cloud is going to continue and accelerate as part of U of T’s digital transformation as we prepare to go back to in-person work and learning.

Collaboration was the keyword during Carlos Chalico’s presentation. “We need to think about collaboration across organizations to minimize cyber security risks,” said Chalico. “Alliances are necessary within organizations to protect information as a business issue, not just a tech issue.”

Ashley Langille remarked that the inclusion of stricter General Data Protection Regulation (GDPR) focused language in privacy policies has created issues with informed consent, as the language in these policies often only apply to data of European Union (EU) citizens and is often misinterpreted to apply to all users. Ashley noted that inclusion of a GDPR protection in policy does not necessarily translate to FIPPA compliance.

The presentations were followed by a Q&A session which consisted of pre-submitted and live questions from the audience. Some key highlights from the Q&A session:

Raffle winners

Two attendees were randomly selected to win a $50 U of T Bookstore gift card. Congratulations to the raffle winners:

  • Bismah Khalid, On Location Accessibility Advisor, University of Toronto Accessibility Services
  • Linda Ye, Senior Auditor – Information Systems, Internal Audit Department

Visit the Security Matters website to learn more about protecting yourself online and your data.

Safeguard your emails to help prevent privacy breaches

January 26, 2022

While email is one of the most efficient and prevalent forms of communication today, it brings with it the risk of privacy breaches when sharing sensitive data, such as personally identifiable information (PII) or personal health records.

In a recent blog post, the Information and Privacy Commissioner of Ontario (IPC) talks about how misdirected emails are a common source of privacy breaches due to unauthorized disclosure of personal information. Some common mistakes include emails sent to an unintended recipient or emails sent to a group of recipients without using the blind carbon copy (BCC) function.

Everyone who sends emails can make these mistakes, but they are preventable with a few simple steps:

  • Stop and double check the details of your email before sending. Ensure that you have the correct recipient. Always consider whether you need to BCC and do so when appropriate.
  • If the email has an attachment that contains personal information, make sure to encrypt the attachment using a password that you can provide to the recipient by phone. If possible, also restrict who can open the file. For example, if sharing a file using OneDrive, adjust the settings so that only the intended recipient can open the attachment.

The University of Toronto (U of T) community works with many kinds of data, ranging from publicly available website material to confidential research material. This makes the University a target for various forms of cyber attacks. The IPC has posted a fact sheet about communicating personal health information by email that will help you learn more about the risk of sending sensitive data via email and how to mitigate the risk.

By taking simple steps to safeguard your email communications, you can help reduce the risk of privacy incidents at U of T.

How you can protect U of T data

This article is part of a series for Data Privacy Day 2022. To learn about how evolving technology and privacy laws impact higher education, register for the virtual panel event on Jan. 28.

Don’t fall for online job scams

January 26, 2022

Job offer scams are a form of phishing used to take advantage of students and new graduates who are seeking employment.

Job offer scams typically work like this—you receive an unsolicited email that invites you to apply for or start a job with a high-paying salary. In most cases, the hacker asks for various forms of information from personal information to banking information, which can be used for financial and identity theft.

This week, many members of the University of Toronto (U of T) community received a fake job offer email (image below), which asked recipients to provide personal and banking information. Let’s brush up on some of the common red flags to help you identify job offer scams:

Job scam email Jan 2022 feature image

View higher resolution image.

  • Generic emails: Hackers send mass emails in anticipation of getting responses from multiple recipients. Emails from legitimate and trusted sources will always address the recipient by name.
  • Poorly worded emails: Phishing emails can often be identified by poor grammar and spelling. Right from the subject line, this job scam email displayed these flaws. Always make sure to read the email carefully and check for spelling and grammatical mistakes, as well as awkwardly worded sentences.
  • Unsolicited emails: Most companies post job vacancies on their careers portal or legitimate job boards. One way to validate the legitimacy of a job posting is to check for the posting on the company’s official website or job boards. If you didn’t apply for the position and the person contacting you isn’t a recruiter from a reputable company or recruitment firm, the odds are it is a scam.
  • Emails from fake companies: Hackers also use advertising and job listing websites to “recruit” potential victims. Ensure that you do a search online for the company name and check if they have a legitimate physical address.
  • Emails from free email providers: Most companies have professional email addresses and do not use free email providers like Gmail. If you receive a job offer and the email address looks more like a personal email address than a business address, be suspicious.
  • The perfect job offer: If an email states extremely high compensation for a position that requires “no skills or experience, and few hours to work” and seems too good to be true, then it is likely a scam.
  • Asking for personal and financial information: While it is true that you have to provide your employer with some forms of identification and banking information before you start your job, if a company is asking you for this information before the interview or in the initial email, the job is likely a scam.

Visit the  Security Matters website for more information on identifying and reporting a phishing attempt.

Data Privacy Day 2022: How to protect your data

January 25, 2022

Data Privacy Day is an annual reminder to make safeguarding our personal information a priority. At the University of Toronto, data privacy is both a University matter and a personal matter. This means that we can all work together to build, practice and promote safe data privacy practices.

Review this infographic to learn how you can help protect sensitive information and refer to the resources below for more information.

How to protect your data

Download PDF

Resources

This article is part of a series for Data Privacy Day 2022. To learn about how evolving technology and privacy laws impact higher education, register for the virtual panel event on Jan. 28.

New phishing email impersonating Information Technology (IT) administration

January 20, 2022

Phishing emails are designed to trick recipients into taking an action, such as clicking a malicious link or opening a malicious attachment. Hackers may also use tactics like smishing, which attempt to trick the recipients through text messages or SMS.

This week, members of the University of Toronto (U of T) community received an email impersonating U of T’s IT administration that asked recipients to respond through SMS. Please note that any technology upgrades or updates will always be communicated by your division or department through official U of T channels prior to deployment.

Sense of urgency is a big factor that hackers use to get recipients to take action. You will be able to identify and report phishing by taking a moment to review your emails for common red flags.

The image below marks the red flags to look out for:

Smishing attack with red flags

Hackers are constantly adopting new techniques to steal information, so it is imperative that we stay alert and aware to better protect ourselves online.

What to do if you receive a suspicious email

  • Review the common red flags.
  • Do not act on any of the email prompts including clicking the link, providing personal information, opening the attachment or sending SMS.
  • Forward the email to report.phishing@utoronto.ca and then delete it from your inbox.
  • If you already engaged with the email, please contact security.response@utoronto.ca  immediately for assistance.

Visit the Security Matters website for more information.

[Phish] You have got an urgent message from the University of Toronto.

January 20, 2022

Details:

Subject: You have got an urgent message from the University of Toronto.

Text:

Dear User,
This is to let you know that our web-mail server will be upgraded and maintained soon.

If you don’t want your e-mail account to be terminated during the upgrade,

Send “UTORONTO–UPGRADE” to *malicious phone number inserted here*

You will receive instructions on how to upgrade your account via text message.

If you do not comply with the above, your email access will be disabled.
Please accept our apologies for any inconvenience this may cause.

 

Regards
System Administrator
The University of Toronto