In today’s information age, email service has become an indispensable communication tool in daily work, as well as one of the major communication tools. Hence, email security are becoming more and more important. For external attacks such as telecommunications fraud and malware attacks, although user’s information security awareness is increasing, the possible problems arising from the use of email cannot be ignored. In particular, for any jobs that involved personal data, you must handle them with special care. To further enhance users’ skills in using email more secure, here are some security tips:

• Before sending an email, you must review the email content, attachments, and the recipients’ email addresses;
• Before replying to email, you must confirm the identity of the sender. Do not reply to the email casually. For those emails that involve sensitive content such as money, personal information or account password, etc, please pay special attention;
• Before forwarding emails, you must understand whether the email content, which included attachments and contents of reply history, is suitable for forwarding. You can also consider extracting some necessary contents instead of forwarding the entire email. Do not arbitrarily forward unconfirmed content, so as not to spread the rumors;
• To consider carefully the necessity of mass emailing and make good use of email system resources. For more details, please refer to the “Guidelines for Mass Email and E-mail Groups“;
• Be aware of using “Reply to all”. It may cause unnecessary distortion. Please carefully consider the necessity;
• Make good use of Bcc., to ensure that the recipients are not allowed to see each other’s email addresses, thus protecting the privacy of each recipient;
• Note the email contents and attachments. Do not send too much content or attachments, especially personal information. If it contains sensitive content, you must consider whether it is suitable for transmission via email. In addition, the use of email must also comply with the policies of the University and existing local laws and regulations, as well as other laws that may need to be complied in other jurisdictions. (Please refer to the Reference information.)
• Do not rely on “email recall”! Actually, the email recall is a facilitating function that can only minimize the impact, but it cannot guarantee recalling the email you sent successfully.

In addition, users can get used to writing emails before filling in the recipients’ email addresses, so as not to send unfinished emails by mistake. If you need to select an email address from the contacts, be careful when selecting an email address as some email addresses may look similar.

* Reference information

1. Office for Personal Data Protection, Macao
2. Personal Data Protection Act, Macao
3. Privacy Policy, UM
4. Guidelines for Handling Confidential Information, UM
5. Acceptable Use Policy on ICTO Computing Facilities Campus Network and Internet
6. Guidelines for Mass Email and E-mail Groups
7. How can I identify a phishing, fake email and websites?
8. What you need to know about EU General Data Protection Regulation?
9. Data Privacy in an Era of Compliance
10. Other Information Security Tips

Traveling today is so much easier with technology. You can stay productive, entertained, and in touch. For many, having a cell phone or other electronic device is a critical part of having a great travel experience and an integral part of daily life. Unfortunately, traveling with devices can mean increased risks for keeping your personal data private as well as the potential for device theft.

Here are some steps you can take to help secure your devices and your privacy.

• Travel only with the data that you need. That means leaving some of your devices at home, using temporary devices, removing personal data from your devices, or shifting your data to a secure data storage;
• Protect your data. Perform a full backup of the data that you leave at home and consider enabling encryption feature for your device;
• Update any software, including anti-virus protection, to make sure you are running the most secure version available;
• Turn off Wi-Fi and Bluetooth to avoid unexpectedly automatic connections;
• Turn on “Find My [Device Name]” tracking and/or remote wiping options in case it is lost or stolen;
• Well prepared. Especially, charge your devices before you go;
• Be aware of the risk of committing an offense. Clear your devices of any content that may be considered illegal or questionable in other countries, and verify whether the location you are traveling to has restrictions on encrypted digital content;
• Don’t overlook low-tech solutions:
  • Tape over the camera of your laptop or mobile device for privacy;
  • Be aware of people “shoulder surfing” for personal information;
  • Keep your devices on you whenever possible, or use a hotel safe;
  • Label all devices in case they get left behind!

Cybercriminals use phishing—a type of social engineering—to manipulate people into doing what they want. Social engineering is at the heart of all phishing attacks, especially those conducted via email. Technology makes phishing easy. Setting up and operating a phishing attack is fast, inexpensive, and low risk: any cybercriminal with an email address can launch one.
According to Verizon’s 2018 Data Breach Investigations Report, the education sector saw a rise in social engineering–based attacks. Students, staff, and faculty all suffered losses when personal data and research were disclosed to unauthorized parties. Phishing played a part in more than 40% of these breaches. Knowing what you’re up against can help you be more secure. Here are a few things you can do to guard against phishing attacks:

• Limit what you share online. The less you share about yourself, the smaller the target you are for a phishing attack. Cybercriminals use information you post online to learn how to gain your trust.
• Protect your credentials. No legitimate organization or department　 will ask for your user ID and password or other personal information via email. ICTO definitely won’t. Still not sure if the email is a phish? Contact ICTO Help desk.
• Beware of attachments. Email attachments are the most common vector for malicious software. When you get a message with an attachment, don’t open it—unless you are expecting it and are absolutely certain it is legitimate.
• Confirm identities. Phishing messages can look official. Cybercriminals steal organization and company identities, including logos and URLs that are close to the links they’re trying to imitate. There’s nothing to stop them from impersonating University, financial institutions, retailers, and a wide range of other service providers.　If you get a suspicious message that claims to be from an organization, use your browser to manually locate the organization online and contact them via their website, email, or telephone number.
• Check the sender. Check the sender’s email address. Any correspondence from an organization should come from an organizational email address. A notice from your college or university is unlikely to come from @.
• Take your time. If a message states that you must act immediately or lose access, do not comply. Phishing attempts frequently threaten a loss of service unless you do something. Cybercriminals want you to react without thinking; an urgent call to action makes you more likely to cooperate.
• Don’t click links in suspicious messages. If you don’t trust the email (or text message), don’t trust the links in it either. Beware of links that are hidden by unknown URL shorteners or text like “Click Here.” They may link to a phishing site or a form designed to steal your user ID and password.

Reference

How can I identify a phishing, fake email and websites?