Security

Identifying and managing spam

• Spam refers to unsolicited emails that are sent to large numbers of people at once. Spam emails are typically advertising fake products or get rich quick schemes.
• Don’t spend time unsubscribing from spam emails; this just confirms to spammers that your email address is correct and that they should keep spamming you.
• The most effective way of managing spam emails is to use your email settings to send these emails to your junk folder. (Drag and drop to your Junk or via settings). 

What is phishing?

Phishing (pronounced fishing) emails are more sinister than spam. They’re designed to trick you into providing personal information like:

• a mobile phone number
• usernames and passwords
• credit card details or bank details.

Phishing can be via text messages, phone calls, push notifications and not necessarily only email.

What to look for?

• Sender’s address – Hover your mouse over to uncover the real address instead of what is displayed.
• Greetings – Generic greetings and sign offs. Ex – Dear Customer, Dear User.
• Grammer & Spelling – There use to be a time with easy to detect incorrect grammar & spelling. Criminals now use Ai to write perfectly correct spam/phishing messages.
• Creating sense of urgency - Often encourage you to click a link or download an attachment to avoid a problem to create a sense of urgency.
• Links and Websites - If you receive an email with a suspicious link, hover over the link with your mouse to see the actual web address the link leads to – it could lead to a fake website. Always type the URL
  to the address bar instead of clicking on links when unsure.
• Attachments - Often an attachment will appear to be a PDF, image or Office file, but when you try to open the document, it tries to run a malicious software program to infect your computer/mobile device.
• QR codes - Criminals are increasingly using QR codes in phishing messages, as they may bypass email spam filters designed to detect malicious content.
• Push Notifications – We are increasingly relying on apps on our smart devices. Push notifications are a convenient way for us to be aware of things. However cyber criminals do use this for their advantage. Don’t just blindly allow push notifications.

Passwords are part of our everyday lives and often our first line of defence. We use them everywhere from our bank accounts, social media, email and more.
The tips below will help you continue to keep your passwords safe.

Use a variety of characters (ensure your password is at least 12 characters long)

If your password is all letters, though it might be easy for you to type and remember, it’s also easy to guess. Try to incorporate the following factors in your password.

• Uppercase and lowercase letters
• Numbers
• Special characters like $,% and @

Don’t use something obvious

Never use information that is easy to guess or accessible to criminals. Avoid the following:

• Children’s names
• Pet’s names
• Favourite sporting team
• Date of birth

Other general tips

• Change your password at least couple of times a year.
• Enable Multi Factor Authentication (MFA) on all accounts.
• When changing it, don’t just change one character – make it a significant change. (ensure brand new set of letters, numbers, characters. Make it passphrase)
• Don’t share your passwords: a reputed business will never ask for your password, if this happens to you, it is likely a phishing or a scam.
• Don’t have the same password for every account – if your privacy is breached and a hacker gets your password, they would then have access to all of your private accounts.
• Don’t let computers ‘remember’ your password for important sites such as online banking. (Browses do provide the option to remember your passwords for convenience. This can be a bad practice)
• Use a password manager. This will work on your browser, and you only need to remember once secure strong password. Rest will be automated via this tool.
  
  
  

You can’t put a value on your identity.

Your identity is of the utmost importance and should be carefully guarded. Whilst physical identity documents, such as your birth certificate, are more difficult for scammers to obtain, your ‘digital identity’ consists of various pieces of information about you such as your name, address, date of birth, driver’s licence number, passport number, bank details and other unique identifiers that can be used to impersonate you over the phone or internet for fraudulent and other criminal purposes.

Ways to protect your identity

Observe the below measures to help protect your personal information.

Follow guidance from your bank on financial security on your accounts.

Banks offer various ways to protect your information. Ensure you are familiar with these settings and have them enabled on your accounts when doing online banking.

Review your social media settings

Check the privacy settings of your social media accounts and see who has access to your profile(s). You should avoid sharing personal information such as your whole date of birth, email address and phone number. It’s also a good idea to have your settings on “private” and avoid accepting ‘friend requests’ from people you don’t know.

Protect your devices

Always run anti-virus, malware and spyware protection programs, use strong passwords and update them at least couple of times a year. Avoid repeating the same password, especially banking passwords.
Encrypt your computer disk using BitLocker or any other commercial encryption mechanism.  

Never click suspicious links.

If you suspect an email or text message you’ve received is malicious, never click an attached link.
Get you and your team educated to ensure you are up to date with information to identify scams.

Website URLs

If a website starts with “https”, you are being protected by a security protocol – always check for this.

Take additional care and attention for documents with personal information

It’s always best to shred physical documents that you’re discarding to protect your personal information. Always be mindful of paper and electronic documents that have your details and be careful with where you leave them or who has access to them.

How to claim your stolen identity back?

• Report the theft to the law enforcement and Australian Cyber Security Centre (ACSC).
• Change your passwords on all accounts and shut down accounts you did not set up that have been created by the scammer.
• Contact any business or organisation that may be affected or at risk as a result of your stolen identity.
• Contact IDCARE for support.

Malicious software is known as Malware. It can include:

• Viruses
• Worms
• Trojans
• Spyware
• Ransomware
• (and other malicious programs)

Malware programs can harm your system by:

• Recording your keyboard strokes to access your passwords or credit card details
• Viewing your sensitive emails
• Executing a ransomware attack
• Controlling your audio and video on the device

Ransomware attacks involve sending a misleading email, such as a bill or fine, to trick you into clicking a link. If this happens, ransomware locks the files on your computer and opens a pop-up window requesting a ransom to be paid, often in Bitcoin or another cryptocurrency. Payment of the ransom may not secure the release of your files. Ransomware has become one of the most popular ways for criminals to demand financial gains from organisations.

Protecting yourself from attacks

Consider taking the below precautions to help avoid a malware attack.

Update software

Frequently updating your operating system, browsers and applications helps safeguard your privacy. Many of the update tasks can be automated to execute automatically without you having to manually do it.

Run anti-virus software endpoint protection software

Installing reputed commercial anti-virus software will help to prevent scammers from accessing your information by warning you of suspicious activity.

Data Backups

It’s good practice to keep a backup of your data in the event of an attack or unforeseen system issues. This can take the form of cloud storage, portable hard drive or a different system with no direct access from your accounts.

There are many ways to identity possible malware attack signals

• Computer is slower than normal in start-up
• Computer crashes frequently
• There are new, unfamiliar icons on your desktop
• You can’t access your files
• Your files have been changed
• File’s structure has changed and unexpected changes in size
• Pop up messages
• Potential blue/black screen displaying system codes

Actions to take if you believe you have become a victim of an attack

• Don’t shutdown the computer device.
• Isolate the affected device: disconnect it from the internet and any other connected devices to prevent the malware spreading
• Check if your anti-virus is up-to-date and run a scan
• Seek professional assistance (e.g. contact ACSC).

There are number of actions for practicing safer online behaviours to stay away from cybercrime. Few of those are listed below for your reference and inclusion into your daily activities.

• Better password management and enabling MFA on services/accounts
• Phishing and scam awareness - Ability to differentiate what is legitimate and what is not
• Keeping all the systems and applications up to date
• Using reputable commercial software and services
• Social Media security - Review privacy settings and be vigilant of unsolicited requests
• Financial security - Make purchases from reputed services, regularly monitor our bank transactions
• Effective management of personal information. Think before sharing any personal information and do not overshare
• Enable device and/or disk encryption. (e.g. BitLocker on Windows devices)
• Practice safe browser habits. Look for HTTPS in URLs, be caution of pop ups and advertising links, do not save password in browsers.

There are number of simple actions we can practice to protect ourselves and our business from becoming a cybercrime victim. Here are few of the actions you can consider.

Information Collection

• Only collect information you really need
• Keep sensitive files in secure locations
• Only share information with people who need it and double-check before sharing any personal details

Keeping Information Secure

• Lock your computer when stepping away and keep your desk clear of sensitive papers
• Store important documents in locked cabinets
• Properly destroy papers you no longer need

Safe Communication

• Double-check email addresses before sending and be careful when discussing sensitive information
• Don't send sensitive details through regular text messages
• Use secure methods to send important information
• Ask if you're unsure about sharing information

Digital Safety

• Only use approved work devices
• Don't install unknown software
• Be careful with USB drives and external devices. Do not plug unknown devices
• Log out of systems when finished

Being Privacy-Aware

• Think before sharing personal information
• Know what information needs special protection
• Understand basic privacy rules
• Report any possible privacy breaches

Safe Disposal

• Shred sensitive papers/documents
• Delete files properly including from recycle bins
• Don't just throw away sensitive information
• Clear old files from devices before they are decommissioned or disposed

Always seek help if you are unsure before taking an action.