Information technology was developed rapidly in recent year. With the development of artificial intelligence and 5G networks, some technologies that seemed to be impossible before have gradually entered the lives of everyone, which also show the importance of information technology services. Especially during the anti‑epidemic period in recent months, public’s dependence on IT services has become more obvious, and information security has become a topic of discussion. Hence, the requirements on information security will become higher.

With the effective of the Macao Cybersecurity Law, in accordance with the relevant regulation, the University must ensure that information networks, computer systems and data are protected properly, and strengthen the alert and response towards information security incidents. ICTO will continue to safeguard the information security for our campus network, and cooperate with the Cybersecurity Incident Alert and Response Centre in order to fulfill the reporting obligations, including reporting information security incidents and providing updated Internet service information (such as the account name for connecting to the Internet service provider, IP address, domain name and other related information.)

In addition, if you need to setup IT facilities or providing IT services in UM, you are obliged to ensure that the provided services are secure and reliable. Therefore, please note the following:

• Make sure the operating system and application are updated to the latest version to ensure the maximum protection;
• Pay attention to the system default setting whether it is secure or not, including initial passwords, permission and system services;
• Enable any information security measures, system logging and perform backup for important data;
• For outsourced IT services, you must also ensure that their provided services meet the relevant requirements ofthe Cybersecurity Law ;
• If you need to change the network architecture or encounter an information security incident, you must inform ICTO*.

* Note: ICTO will be responsible for implementing the above reporting obligations for UM in accordance with the Cybersecurity Law. The detail information will be announced in due course.

Besides service providers must pay attention to information security. In fact, it is also the responsibility of each user. Users must always maintain security awareness in order to build a secure IT environment.

Reference:

• The Cybersecurity Law (Chinese) | (Portuguese)
• The Cybersecurity Law – Relevant attachments (Chinese) | (Portuguese)
• Other laws, regulations and policies
• ICTO Information Security Services

In recent years, Advanced Persistent Threat (APT) is a common threat on the Internet. Intruders will try to break into a target network. They often lurk in the network for months to collect cues until they obtained any valuable information, and some would even stay hidden in the network for long-term monitoring. Usually, an intruder would try to enter the target network in the first step, no matter you are handling important information or not, you may become the next target of the intruder.

Actually, information security is everyone’s responsibility. Even though IT personnel have tried the best to take any necessary measures for reducing risk of intrusion, including network security technology, network monitoring and regular maintenance, etc., the intruder can still attack the network through phishing scams. Therefore, users must have good awareness of information security. How much do you know about Information Security? Take our “Information Security Awareness Quiz” immediately and challenge yourself!

* Remark:

• 1. Click the URL Information Security Awareness Quiz and login with your UMPASS;
  2. Click “Enrol me”;
  3. Choose to answer in Chinese or English;
  4. There are 6 groups of questions and each group contains 5 multiple choice questions. You can have unlimited trials and the quiz result is for your reference only.

Reference

• Don’t Let a Phishing Scam Reel You In
• How can I identify a phishing, fake email and websites?
• Beware of Phishing Trap
• Other Information Security Tips

In recent years, mobile payment has become so popular that you can simply pay with your mobile phone, which makes shopping easier and more convenient! However, at the same time, did you recognize the safety when using mobile payment? Here are some tips:

• Be careful with your belongings and mobile phone. In addition to money loss, your bank card or mobile phone wallet may also be stolen. If your ID card is lost, your personal data may also be misused;
• DO NOT overcharge your mobile phone wallet and avoid linking a bank account with large amount to your mobile phone wallet. DO set an appropriate transaction limit, check the transaction records regularly, and change account and transaction passwords regularly;
• Avoid using public, unknown or unsecured networks for mobile payment transactions, and avoid exposing the screen with payment QR code;
• Beware of phishing messages, especially those involving red-pocket, special offers, money transfer requests, passwords or personal information, you must confirm the authenticity of the sender in order to avoid any loss;
• Protect mobile devices:
  • Protect your devices with password or fingerprint;
  • Turn on the “Find Me” function and wipe feature, to avoid data loss or being stolen;
  • Make sure the operating system and application, including anti-virus protection, are updated to the latest version;
  • Do not crack your mobile phone system and avoid downloading and installing software from untrusted sites;
• Enable SIM pin. For most mobile payment account registration, password recovery, or some online transactions, you may need to use SMS for identity verification. Using SIM pin can reduce the probability of identity theft due to SIM card loss;
• Use the licensed mobile payment service, carefully read the terms and conditions, understand the reporting loss procedure and stolen protection policy, etc.

In case you lose your phone, please stay calm and try to use the “Find Me” function and wipe feature to locate your phone, or remotely erase your data. In addition, if necessary, please report the loss to the related bank or service provider, for example, report the loss of bank card, SIM card, and suspend the mobile phone wallet account, etc.

Did you know? In the recent years, there were different types of industry occurred data breach in the world, involving education institutions, airline companies, government departments, banking and financial institutions, e-commerce corporations, web service providers, etc. More than half of the breaches were caused by activities directly attributable to human errors, including lost devices, physical loss and unintended disclosure. These breaches were arguably preventable through basic information security protection safeguards.

• What can you do everyday to protect data? No matter what types of industry you are working in, you may need to transmit, process, access, and share such varying data elements. There is not a “one size fits all” blueprint for information security controls that all industries can follow. Yet all members have a responsibility to know basic information security protections to safeguard data and prevent those data from being mishandled.
• Understand where, how, and to whom you are sending data: Many breaches occur because of our careless where we accidentally post confidential information publicly, mishandle or send confidential information to the wrong party. Taking care to know how you are transmitting or posting data is critical.
• Create complex and unique passwords: Use different passwords for different accounts, in particular those for handling confidential data.
  Enable two-factor authentication: Two-factor authentication can prevent unauthorized access even if your login credentials are stolen or lost.
• Protect your devices: Besides using password lock, it is also recommended to use some biometric technologies to protect your smartphone and tablet. It is critical to keep curious minds from accessing personal information, work email, or retail/banking applications. It also helps to protect your device in case you lost or misplaced it.
• Update your computing devices: Ensure the operating system, web browser, and applications on all your electronic devices are updated to the latest version.
• Getting ready to send data to a vendor or sign a contract? In daily work, we are obligated to ensure that the University’s confidential information are properly protected, especially if we need to use an outsource service or a cloud service. If the service involves confidential information, you must consider the related information security technology before the project begins or signing the contract, which ensures the data is protected properly.

Reference

• Office for Personal Data Protection, Macao
• Personal Data Protection Act, Macao
• Privacy Policy, UM
• Guidelines for Handling Confidential Information, UM
• How can I identify a phishing, fake email and websites?
• What you need to know about EU General Data Protection Regulation?
• Other Information Security Tips

In the modern IT era, there are a lot of individual and home use Internet-enabled devices, including smart phones, smart watches, home routers, electronic game consoles, and a variety of smart home devices. While bringing convenience to life, it may also bring certain information security risks. Therefore, we would like to provide some security tips for you to ensure that the devices you are using are assets, rather than burdens.

• Make sure your computer program is up to date Keep updating the system and software programs of the device regularly. If the anti-malware program has been installed, it should be updated to avoid damage or infection by malware;
• Secure your network The wireless network should be protected properly using WPA2 encryption, complex passwords, and the software of WiFi router at home should be updated regularly;
• Learn more about your device Have a solid understanding on how a device works, the nature of its connection to the Internet, and the type of information it stores and transmits;
• Understand how to keep devices up to date Read the instructions carefully to understand all necessary safe use methods, including changing the default password and precautions;
• Understand the data content being collected Some smart devices will collect data. Take some time to understand what information your connected devices collect and how the information is managed and used;
• Know how your data is stored Smart devices will send and store the collected data on cloud. Therefore, users should be aware of where the data is stored and the security measures to protect personal data;
• Do more studies Before adopting new smart devices, study and understand more about other users’ evaluation on the security and privacy of the devices and service provider.