Research in information technology, such as "Scamming higher ed" in Computers in Human Behavior, shows that higher ed institutions are especially vulnerable to cyberattacks due to a culture of openness, use of personal devices, diverse user populations and heavy reliance on personally identifiable information. Phishing attempts are increasingly sophisticated due to use of artificial intelligence (AI).

We exist in the times of both innovative technology and, unfortunately, cybercriminal activity. The first one can be a wonderful gift that provides numerous benefits to make employees’ and students’ daily lives easier. Just be careful, as bad actors take advantage of the simplicity of technology to hack in and steal the college’s or your work files and data.

The Office of Information Technology and Services (ITS) is here to assist you in making good decisions related to only using vetted and supported technologies, along with the process to find approved technology and request something new, and following best practices when you receive suspicious emails.

Approved technology

For some time, ITS has followed college policies by vetting software, hardware and other technology products prior to use at the college. What has been challenging at times is when it is identified that unsupported software and web-based applications are being used for in-person and online learning as well as on the administrative end. Some recent examples of this are the use of unsupported products for online proctoring, virtual meetings and class sessions and a learning management system (LMS) that is not sanctioned by the college.

Lists for vetted and approved products that fall under classifications of installed software, web-based applications and LMS integrations have been published in Suffolk Help’s Knowledge Base. To review these lists, click Find Answers on the home page. These lists are still being populated and provide details on what function each is used for, the populations they are available to, if there is a cost and more.

If you do not see technology functionality that you require your area to meet work requirements, you can engage ITS by submitting a Technical Review form in Suffolk Help.

Phishing emails

Cybercriminals use social engineering methods such as phishing to access college confidential or sensitive data and steal your identity, among other malicious actions. Phishing campaigns can also lead to malware infection and ransomware attacks, the latter of which leads to college files being encrypted and leaving the college unable to access key data. Those files then remain unavailable unless terms requested by a bad actor or cybercriminal organization are met and, if malware is installed, your computer may be infected or an attempt then to reach and disrupt other computers at work may occur.

Here are some tips and tricks to identify malicious emails and the process to report them:

• Do not click links in suspicious messages: If you are not entirely sure an email is legitimate, do not trust the links in it. Beware of links that are hidden by URL shorteners or text such as click here. This may send you to a phishing site or a form designed to steal your credentials.
• Take your time: If a message states that you must act right away or you will lose access or be charged a fee, do not comply. Cybercriminals want you to react by using scare tactics to pressure you to react without thinking.
• Beware of attachments: Email attachments are the most common vector for malicious software. Unless you are absolutely certain the attachment is legitimate, delete it right away.
• Confirm identities: Phishing messages often look like the real thing. You may receive an email that appears to be from a colleague or known business partner or vendor. Logos and URLs may look similar to what you normally receive. It is important to take the time to investigate. Call the colleague or other person to verify that these communications are valid.
• Check the sender: Any official communication from Suffolk County Community College, for example, will not come from an outside email service such as Google or Yahoo.

Bottom line is to always verify before trusting that any email you receive that seems suspicious in nature is safe.

If you believe an email you’ve received is or even might be malicious in nature, please report it by emailing the Help Desk, including the suspicious email as an attachment. ITS will then investigate and take action when required. If you have a question on the email address to send to, or are not sure how to include an attachment, contact the Suffolk Help Desk.

Following the guidance above about only using vetted and approved technology products and following best practices to spot suspicious emails is vital to minimize risk within today’s tech culture.

Thank you for doing your part!