No matter how secure our systems are, a single click on a malicious link or a moment of misplaced trust can lead to a serious breach. 

The Marks & Spencer cyber-attack started with social engineering, the theme of this article. Awareness is our first line of defence; please ensure you’ve completed your mandatory information security training and consider refreshing your memory by watching this short training module:

What is Social Engineering?  

Here’s how we can all contribute to a safer digital environment: 

Acting as a human firewall 

We can all act as human firewalls by being vigilant and proactive: 

• Stay informed: Regularly participate in information security training and stay updated on the latest threats. 
• Politely challenge unusual requests: This could be a potentially fake email asking for an iTunes voucher to be obtained on a Purchasing Card, or an external telephone call asking who is responsible for the Finance System access.
• Report suspicious activity: If you notice any unusual activity report it to IT Services immediately and forward any suspected phishing attempts to phishing@lboro.ac.uk. 

Cautious email handling 

Emails are often used by malicious actors as a way of getting into a network to launch a cyber-attack. Here’s how to handle them safely: 

• Look for red flags: Be wary of emails that create a sense of urgency, contain suspicious file names, or come from unfamiliar addresses. 
• Be wary of attachments and links: Treat all attachments and links with caution, especially if they come from unknown or unexpected sources. 

Protecting your credentials 

Every individual plays a vital role in safeguarding our University's digital infrastructure. Start by protecting your credentials: 

• Use strong, unique passwords: Never use the same password across multiple sites. Consider using a password manager to keep track of them.  
• Do not share your IT credentials with other colleagues or write them down in the office. Ensure you sign out of unattended computers, and do not let others use your credentials to access the VPN from other countries.
• Enable multi-factor authentication (MFA) where available across all your accounts (personal and University): This adds an extra layer of security, making it harder for attackers to gain access. 

IT Services work tirelessly to keep phishing attempts out of our inboxes and protect our digital infrastructure, but cybersecurity is a shared responsibility. By working together and staying vigilant, we can protect our University from cyber threats.