Occasionally, you might need to transmit, store, edit and access different types of data for work purpose. No matter what format the data stored as, we are obliged to ensure proper security measures and controls are adopted on UM data to avoid data leakage, especially the confidential data. Some common causes of data leakage are human errors, weak password being cracked, stolen credentials, lost of devices, software vulnerabilities being used, insecure network connection, etc. Disclosure of confidential data may cause damage to the reputation of the University or may have certain legal implications. Therefore, please refer to the below tips to protect the data:

Protect data with password and encryption, erase old data
Ensure confidential data is handled as required by the “Guidelines of Confidentiality” and the “Guidelines for Handling Confidential Information”. For example, when you take or process the confidential data outside campus for official work purpose, the data must be protected with password and encryption with encryption tool. In addition, erase all confidential data on the device immediately after processing it.

Transmit and share data carefully
Before sending/replying/forwarding an email, please review the recipients’ email addresses, email content, attachments and ensure they are correct. For example, don’t contain too much personal information or unverified content such as rumors, exclude all unnecessary confidential data in the email history. Besides, when you share data to other people in computer systems, please ensure the privileges are set correctly.

Enable 2FA and use strong password
To minimize the probability of credentials being stolen and password being cracked, please enable Two-Factor Authentication (2FA) service and use strong password to protect your UM user account. Moreover, use different passwords for different accounts, in particular those for handling confidential data.

Protect your devices by biometric technologies
Besides using password lock, it is also recommended to use biometric technologies to protect your smart phone and tablet, i.e. fingerprint and facial recognition. It can minimize the probability of unauthorized people accessing your personal data, working email, online payment and bank information in case you lost or misplaced the device.

Update computer systems and devices, enable anti-virus software
Ensure the operating systems, web browsers and software on your electronic devices are updated to the latest version, and patch them for vulnerability as soon as possible to prevent attackers from being able to take advantage of the known problems or vulnerability. Please be reminded to enable the real-time protection and monitoring feature of anti-virus software, scan the computer regularly and keep the version up to date.

Be careful in using public WiFi networks and computers
Please always assume public WiFi network and computers are insecure as attackers may capture your data in the same public network or computer you are using. Thus, avoid performing financial or other transactions that involve confidential data while using public network and computers.

How to Use Mass Email Efficiently & Safely

In our daily work, we may need to distribute email to multiple recipients, mail groups or different organizations. What is the most efficient way to do this? Sending it one by one with the same message? or sending it in a mass email? Of course, sending a mass email will be a better choice.

Although distributing mass email saves you time from delivering the same message repeatedly, it comes with some drawbacks at the same time if it is not done carefully. Drawbacks can be disclosure of recipient contacts unnecessarily to third party, or wasting email resources, etc. The following aspects must be considered before sending the mass email:

1. Is the email justified for proper purpose?
2. Will it cause any security/privacy related issues?
3. What will happen if one of the recipients click ‘Reply All’?
4. Will the email confuse the recipients?

To cater the above aspects, we suggest the following:

• Make sure the email aligns with your organization’s mission and approved purpose.
• Use Blind carbon copy (Bcc) to hide the recipient list from individual recipient and it can protect recipients’ privacy. This can also avoid duplicated mass email when any recipient clicks ‘Reply All’.
• Give a clear subject heading can help recipient to differentiate the normal email from spams or phishing.

For more details about Sending Mass Email, please refer to “Guidelines for Sending Mass Email and Using Email Group”.

Reference: Don’t Let a Phishing Scam Reel You In

The daily online activities may bring risk to your electronic device, because most threats that infect your computer system, such as viruses and malware, usually come from the programs that you download and install from the Internet.

Here are the 4 tips to download and install software in a relatively safe way:

1. Only download software from the official website of the vendor/publisher
You are always recommended to download the software only from the official website of the vendor or publisher, and avoid to download software installers from third party websites. It is because some of the installers have been embedded with various types of ads, which may install additional malicious programs to your system.

2. Always delete any software that is downloaded to your device automatically
This often happens when you accidentally visit malicious websites on the Internet and the websites will send their malicious programs directly to your device. When this happens, always delete the application that is downloaded automatically to your device without your acknowledgement.

3. Don’t download any type of cracked or hacked programs
A program that includes any type of crack or hack is certainly a malicious program. When you run it, it will install malicious codes into your system or device. It tends to disturb your system and send malicious commands to it. It is better for you to stay away from cracked or hacked software.

4. Follow the installation steps carefully
When you download a software installer even from the official website, do not just mindlessly click “next”. You have to follow the installation steps very carefully because a bad software vendor might embed malware or adware into their installer. Make sure to tick off any unnecessary options during the installation.

Reference
· Don’t Let a Phishing Scam Reel You In
· How can I identify a phishing, fake email and websites?
· Beware of Phishing Trap
· Other Information Security Tips

Do you know? In the recent years, data breach occurred in different industries over the world. In case you have not changed your password for a long time, your password may have been compromised in various information security incidents such as phishing emails, fake websites, Trojan horse programs, vulnerabilities, password cracking, etc. Your account password may have already known by the hackers, so you are advised to refer to the following security measures for ensuring account security.

• • Change password periodically. Usually, it is recommended to change password every 180 days. If you have not changed your password for a long time, please change it immediately (Change password);
  • Strong password. Use strong password, such as “gL3ToL@uh%” (please refer to ICTO knowledge base);
  • Lengthen the password. You can also lengthen the password instead of using complicated password. It is recommended to use unrelated word combinations which is more than 15 characters in total. It is not only more secure but also easier to remember and input the password, e.g. “PersonalOceanAlthough”;
  • Beware of information security fatigue. We believe that you have already had a certain extent of awareness and alertness. However, sometimes you may unconsciously get relax and unfortunately cause information security incident. Therefore, you are recommended to make good use of some security tools as below to reduce security risk.
    • Use two-factor authentication to log in to your accounts (2FA);
    • Encrypt mobile disks (BitLocker);
    • Use RMS to protect important documents (RMS).

ICTO has launched the 2FA service since 2019. Besides, we have an automatic security mechanism to detect network intrusion activities. Once a suspicious intrusion activity is detected or any account is compromised, its related network connection will be terminated or the related user account will be automatically disabled as well to avoid further security threats.

Reference

• • Office for Personal Data Protection, Macao
  • Personal Data Protection Act, Macao
  • Privacy Policy, UM
  • Guidelines for Handling Confidential Information, UM
  • Acceptable Use Policy on ICTO Computing Facilities Campus Network and Internet
  • Other Information Security Tips

ISO27001 is an information security management standard (ISMS), which is based on risk management principles to establish, implement, operate, monitor, review, maintain, and improve an organization’s information security system. Its purpose is to ensure the security and reliability of information services, and to provide users with information security operation standards. In other words, in the field of information security management, information is a valuable asset. Therefore, it is necessary to maintain that the information meets the following three elements in the process of creation, transmission, storage, and use, generally called CIA, and such requirements are also the requirement of the Macao Cybersecurity Law, in which the University must fulfill the relevant regulations.

• Confidentiality To ensure not to disclose to any unauthorized persons
• Integrity To ensure there is no unauthorized tampering of information
• Availability To ensure authorized users can access information and resources properly and reliably

ICTO used to attach great importance to information security. In order to ensure that the University’s information management can meet the international standards and best practices, since the end of last year, ICTO has actively planned to obtain the certification for ISO27001 information security management in stages, and the first stage of certification is about to be carried out.

In addition, information security is everyone’s shared responsibility. Every user may need to send, handle, and access different types of information. ICTO will timely announce and refine the related information security reference materials, guidelines and tips, etc., so as to ensure that users can easily understand the related requirements and important matters of information security.

Reference

• The Cybersecurity Law is now in effect. Are you ready for it?
• Information Security is everyone’s responsibility
• Other laws, regulations and policies