This article is intended for our staff and students.
While we have measures in place to help protect our systems, the threats to cyber-security are ever changing. Criminals are always developing new ways to exploit software vulnerabilities, which unfortunately can include manipulating users into helping them.
Criminals who intend to cause harm to IT infrastructure often use email to try and install malicious software on a victims device for a number of reasons, commonly for ransom or blackmail. This is why when it comes to email security, our advice to our users has always been don’t trust an email if you’re unsure of the sender and recieve an unexpected message with attached files or links. In rare instances, however, we know attackers may attempt to gain confidence with an initial email and then follow up with an attack.
In short, if in doubt don’t click.
What is phishing?
Phishing is the term used to describe an a cyber attack whereby an email, which may appear legitimate, is recieved with the purpose of misleading the recipient into revealing sensitive information. This usually involes getting a targeted user to follow a link within an email to a malicious or hijacked website, or, by opening an attachment which includes malicious code (a computer virus).
You can learn more about phishing attacks as well as other forms of email threats from Get Safe Online. Get Safe Online – www.getsafeonline.org – is a partnership supported by HM Government and leading organisations in banking, retail, internet security and other sectors.
How to report a suspicious email at Bradford College
Always remain vigilant. If you’re ever in doubt about an email, you can always forward it to IT Services using the email address [email protected] and we’ll investigate.
You can always approach a member of IT Services for advice. If you believe you may have inadvertantly clicked on a malicious link or opened a malicious file, please don’t be afraid to report it — our priority is to help protect our users. We do not seek to blame and we handle all reports to us in a professional manner.
A number of our users already report such emails to us and we’ve prevented dangerous attacks against our IT infrasture as a direct result of people making these reports to us. For that reason, we’d like to say thank you. We recognise the importance of our users in helping prevent cyber-attacks of this nature.
What about outside of college?
We recognise that this threat isn’t just related to our staff and students whilst at college. If you think you may have received a phishing email outside of college and not to your college email address, there’s help for you too.
Visit ActionFraud at www.actionfraud.police.uk from the UK National Fraud & Cyber Crime Reporting Centre for help and advice including an online reporting tool, types of fraud and support & prevention.
Obvious signs of phishing
The UK National Cyber Security Centre has provided the following warning signs to help you determine a suspicious message:
- Many phishing scams originate overseas and often the spelling, grammar and punctuation are poor. Others will try and create official-looking emails by including logos and graphics. Is the design (and quality) what you would expect from a large organisation?
- Is it addressed to you by name, or does it refer to ‘valued customer’, or ‘friend’, or ‘colleague’? This can be a sign that the sender does not actually know you, and that it is part of a phishing scam.
- Does the email contain a veiled threat that asks you to act urgently? Be suspicious of words like ‘send these details within 24 hours’ or ‘you have been a victim of crime, click here immediately’.
- Look out for emails that appear to come from a high-ranking person within your organisation, requesting a payment is made to a particular bank account. Look at the sender’s name. Does it sound legitimate, or is it trying to mimic someone you know?
- If it sounds too good to be true, it probably is. It’s most unlikely that someone will want to give you money, or give you access to some secret part of the Internet.
What happens when an email is reported to Bradford College?
If you have submitted a report to IT Services using the email address above, you should receive an automated reply. Our team looks at the emails and take the necessary action, which can include (and is not limited to) the following steps:
- Block any malicious links within phishing emails on all the college firewalls. This will prevent people who already have the emails from being tricked into going to the harmful webpage.
- Add the email address (and sometimes domain) to filters to prevent more emails coming into college unless there is a very good reason not to.
- Search the databases on the college mail servers for all the emails that have come in already from that source and that match that criteria – these are then instructed to be removed by the system.