WIXLIB

Voiceover Transcript:Confidential and sensitive information may only be created, processed, stored, or backed up oncloud-based services that CUNY has adopted.Never use personal cloud-service accounts to create, process, store, or backup confidential orsensitive data.1.22 B130 - Protecting Univ dataVoiceover Transcript:CUNY and work data that is public may be freely accessed, published, or backed up in the cloudwithout restriction. In fact, public data should be made as widely accessible as appropriate topromote data sharing and transparency across the University.CUNY Cybersecurity Awareness Course Transcript21

1.23 B140 - Protecting Univ dataVoiceover Transcript:One of the cloud-base services CUNY has adopted is Microsoft Office 365 for Education.The service includes programs like OneDrive for Business, SharePoint, Teams, and Skype, as wellas widely used Microsoft applications such as Word, Excel, PowerPoint and the downloadableOffice ProPlus suite.Information about accessing Microsoft 365 for Education, video tutorials, and FAQs areavailable on the CUNY Technology Services web site.1.24 C000 - Recognizing ThreatsVoiceover Transcript:CUNY Cybersecurity Awareness Course Transcript22

Click Next to Begin this Section.1.25 C010 - Recognizing ThreatsVoiceover Transcript:Since the dawn of modern computing, there have been individuals who have used theirknowledge to create destructive and malicious programs.The term “malware” describes any malicious program designed to interfere with thefunctioning of a computer system or network.Malware can:crash your computer;modify, corrupt, or delete files on your computer or network; or evengather information, including usernames and passwords to access resources, such as the CUNYnetwork.Some malware gives hackers remote access or control of a computer or network.CUNY Cybersecurity Awareness Course Transcript23

1.26 C020 - Tab ScreenVoiceover Transcript:There are a variety of terms used to refer to common types of malware. Select each tab for adescription.Ransomware is designed to lock access to the data on a computer system or network serveruntil a ransom is paid. Successful ransomware attacks have targeted individuals andorganizations in both the public and private sector, including hospitals, school systems, andgovernment agencies.A trojan is a malicious computer program that misleads users about its true intent. The trojanmay appear to be a legitimate, useful program. When it is executed, it may reveal its truenature immediately, or it may appear to operate harmlessly, while its true nature remainshidden.Viruses are bits of code that attach themselves to another computer program. When the hostprogram is started, the virus replicates itself, “infecting” the system. Viruses typically causeharm by damaging data or files, providing remote access, or otherwise altering the computer’soperation.Worms are malware programs designed to infect a system, create copies of themselves, andtransfer the copies to infect other systems over a network. The malicious code is designed toperform various destructive or criminal functions.Spyware is software that infiltrates your computer or device to steal your internet usage dataand sensitive information. The most dangerous spyware employs keyloggers, which record yourkeystrokes to obtain login information which is used or sold for criminal purposes.CUNY Cybersecurity Awareness Course Transcript24

Trojan (Slide Layer)Ransomeware (Slide Layer)CUNY Cybersecurity Awareness Course Transcript25

Virus (Slide Layer)Worm (Slide Layer)Spyware (Slide Layer)CUNY Cybersecurity Awareness Course Transcript26

Bot (Slide Layer)1.27 C030 - Recognizing ThreatsVoiceover Transcript:Every internet user knows the word "spam" and sees it in their inbox quite often. Spam, alsoknown as junk email, is anonymous, unsolicited bulk email. It’s hard to believe that almost 50%of all email worldwide is spam.Most spam messages are commercial in nature, but some are sent with malicious intent. Themalicious messages are designed to trick you into downloading malware or disclosingusernames, passwords, credit card details, or other sensitive information.By some estimates, almost 10% of spam contains malicious content.In today’s environment, learning to recognize spam, and learning to resist the natural curiosityto open it, are critical.CUNY Cybersecurity Awareness Course Transcript27

1.28 C040 - Recognizing ThreatsVoiceover Transcript:Email spoofing is the disguising of an email header so that when a message is delivered itappears to be from someone other than the actual sender. Email spoofing is used in spamcampaigns because people are more likely to open email if it looks like it’s from a familiarsource.While most spoofed email is simply a nuisance, malicious varieties can pose serious securityrisks.In today’s environment, learning to recognize spam, and learning to resist the natural curiosityto open it, are critical.1.29 C050 - Recognizing ThreatsCUNY Cybersecurity Awareness Course Transcript28

Voiceover Transcript:Isabel, an employee at CUNY, received the email shown on your screen. Review the email andthen select Next.1.30 C060 - Is the Email Legitimate?(Multiple Response, 10 points, 2 attempts permitted)CorrectChoiceFollow the link to Manage My Healthcare Insurance. She needs to take careof this quickly.Be suspicious but follow the link to see where it goes.XDo not click on any link in the email. Look up the number for humanresources in the CUNY directory and call them to confirm they sent this.XDelete the email. It is clearly a scam.Feedback when correct:That’s right!CUNY Cybersecurity Awareness Course Transcript29

Isabel should absolutely not click on the link, even if it’s just to “see where it goes.” If she is sureit is a scam, she could just delete it. If she isn’t sure, she should call human resources. There areseveral signs that identify this email as a scam. Click Continue for an analysis.Feedback when incorrect:That is incorrectIsabel should absolutely not click on the link, even if it’s just to “see where it goes.” If she is sureit is a scam, she could just delete it. If she isn’t sure, she should call human resources. There areseveral signs that identify this email as a scam. Click Continue for an analysis.Voiceover Transcript:Take moment to complete this exercise.Correct (Slide Layer)CUNY Cybersecurity Awareness Course Transcript30

Incorrect (Slide Layer)Try Again (Slide Layer)1.31 C070 - Recognizing ThreatsCUNY Cybersecurity Awareness Course Transcript31

Voiceover Transcript:Select each number for details.[1]The sender address is fake - Note that it’s CUNY dot org, not CUNY dot edu.[2]The message is designed to convey urgency. Scary warning messages are typical of scams. Ifyou’re alarmed, you’re more likely to rush into making a mistake.[3]Hovering over the link displays the target URL. If the link doesn’t make sense, it’s a scam. In thiscase, the link includes the word “secure” to sound more trustworthy. Nevertheless, it is clearlyphony. If Isabel followed the link it would open a fake landing page that might appear to be alegitimate CUNY form. If she entered the requested information, she’d be giving it to acybercriminal or hacker.[4]The official sounding NOTICE is another attempt to instill trust. It is also a second attempt toprompt Isabel into following a risky link that could download malware or trick her intodisclosing confidential information.Layer 1 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript32

Layer 2 (Slide Layer)Layer 3 (Slide Layer)Layer 4 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript33

Untitled Layer 5 (Slide Layer)1.32 C080 - Recognizing ThreatsVoiceover Transcript:You’re probably familiar with the term phishing, but if not, it’s the practice of using deceptiveemail to lure people intodisclosing sensitive information,following links that deliver malware,or downloading attachments that deliver malware.Like the email Isabel received, phishing scams use many types of "bait" to catch their victims.Phishers attempt to make their email look like it comes from a friend, trusted company,government agency, or a department within your organization. They use familiar logos andspoof email addresses. Attackers may send phishing emails to millions of people or they mayCUNY Cybersecurity Awareness Course Transcript34

target a specific group within an organization.1.33 C090 - Tab ScreenVoiceover Transcript:What do phishers want? They want to harvest information, deliver malware, or perpetratescams.Select each tab to learn more.Harvest (Slide Layer)CUNY Cybersecurity Awareness Course Transcript35

Deliver (Slide Layer)Perpetrate (Slide Layer)1.34 C100 - Recognizing ThreatsCUNY Cybersecurity Awareness Course Transcript36

Voiceover Transcript:Spam filters and other technology help to limit the number of phishing emails in your inbox, butinevitably some get through. Your ability to recognize and avoid phishing scams is a crucial lineof defense against cyberattack.Resisting our natural curiosity to open stray emails is critical. You’ll be surprised at how quicklyyou grow into safe computing habits.1.35 C110 - Recognizing ThreatsVoiceover Transcript:Let’s look at some examples that illustrate common phishing techniques.Social media sites like Facebook or LinkedIn are favorites of scammers, as well as popular retailsites such as Amazon or Walmart. Often, the phishing email is much more alarming than theone shown here. For example, you may receive email with subjects like "Account Suspended"or "LinkedIn Profile Security Alert."Select each number for details.[1]Following the Click here link opens a fake landing page. The attacker captures any credentialsentered to gain access to the victims’ LinkedIn accounts.[2]You should never act on an unsolicited request to verify any sort of account information.If you aren’t positive an email like this is a scam, go to the legitimate web site and login to see ifthere is a problem.CUNY Cybersecurity Awareness Course Transcript37

Layer 1 (Slide Layer)Layer 2 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript38

1.36 C120 - Recognizing ThreatsVoiceover Transcript:Services used by large numbers of people, such as Dropbox or Microsoft Office 365, are alsofavorites of scammers. The example shown here illustrates some of the typical characteristicsthat identify email as a scam.Select each number for details.[1]The domain, my office 365 dot com, is not a legitimate domain.[2]As with most phishing email, the message creates a sense of urgency, demanding “immediateaction” before something bad happens. The attacker wants to rush the victim into making amistake without thinking.[3]Hovering over the link displays the target URL. In this case, the link is to manage my office 365dot com, which is not a legitimate Microsoft Office URL.CUNY Cybersecurity Awareness Course Transcript39

Layer 1 (Slide Layer)Layer 2 (Slide Layer)Layer 3 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript40

1.37 C130 - Recognizing ThreatsVoiceover Transcript:With this type of email, phishers hope you will click the “Shipping Details” link to find out moreabout this unexpected package. If you don’t click there, they hope you’ll click on the “FedExTracking Update” link . In either case, if you’re tricked into going to one of the phonydestinations, you may be infected with malware or prompted to disclose information, such as aCUNY FedEx billing account.Layer 1 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript41

Layer 2 (Slide Layer)Layer 3 (Slide Layer)1.38 C140 - Recognizing ThreatsCUNY Cybersecurity Awareness Course Transcript42

Voiceover Transcript:Like some of the previous examples, this email is designed to appear as if it came from alegitimate department. This one has an added motivator. Who doesn’t like having moneydeposited into their account?Similar types of phishing email may tempt you to download an attachment that contains thingslike details of upcoming changes to your department.If you receive an unexpected email from another department, look up the department’s emailaddress or telephone number, and make contact to verify the legitimacy of the email beforetaking any action. If the mail is an obvious scam, contact the department to report it.When verifying a suspicious email, never use the contact information provided in the email.Layer 1 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript43

Layer 2 (Slide Layer)Layer 3 (Slide Layer)1.39 C145 - Recognizing ThreatsCUNY Cybersecurity Awareness Course Transcript44

Voiceover Transcript:As this item from Cyberheist News illustrates, falling victim to a targeted cyberattack can bevery costly. In the case of the attack on Wichita State University employees, cybercriminalsspoofed the university's payroll system by sending email designed to trick employees intoproviding their university ID and password. That was all the attackers needed to gain control ofemployee profiles and alter personal banking details to redirect their paychecks to thecriminals' bank. The scam was discovered when several employees didn’t receive theirpaycheck.Similar attacks have been directed at college and university students, especially during periodswhen financial aid funds are disbursed in large volumes. In these campaigns, criminals usevarious means to obtain the student logins. After gaining access, they change the destination offunds disbursed by direct deposit.Layer 1 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript45

Layer 2 (Slide Layer)Layer 3 (Slide Layer)1.40 C147 - Tab ScreenCUNY Cybersecurity Awareness Course Transcript46

Voiceover Transcript:There are many, many, other types of phishing scams to beware of. Click each tab for additionalexamples of common phishing scams.W2 (Slide Layer)Gift (Slide Layer)CUNY Cybersecurity Awareness Course Transcript47

Secret (Slide Layer)1.41 C150 - Tab ScreenVoiceover Transcript:Select each number to view the top eight clues that identify an email as a phishing attempt.CUNY Cybersecurity Awareness Course Transcript48

1 (Slide Layer)3 (Slide Layer)4 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript49

5 (Slide Layer)2 (Slide Layer)7 (Slide Layer)CUNY Cybersecurity Awareness Course Transcript50

8 (Slide Layer)6 (Slide Layer)1.42 C160 - Tab ScreenCUNY Cybersecurity Awareness Course Transcript51

Voiceover Transcript:When you think of cybercriminals, you may envision an evil mastermind mountingsophisticated attacks over the Internet. Although most attacks do come in the form ofdeceptive web sites, email, or social media posts, attackers also use the phone to trick theirvictims.How do phone scams work?Select each picture to learn more.Computer (Slide Layer)Money (Slide Layer)CUNY Cybersecurity Awareness Course Transcript52

Bank Building (Slide Layer)1.43 C170-old - Tab ScreenVoiceover Transcript:Select each to view more ways to protect yourself.CUNY Cybersecurity Awareness Course Transcript53

Hang Up (Slide Layer)Don't Trust (Slide Layer)Don't Open (Slide Layer)CUNY Cybersecurity Awareness Course Transcript54

Don't Answer (Slide Layer)1.44 C170 - Tab ScreenVoiceover Transcript:Select each picture to learn more.CUNY Cybersecurity Awareness Course Transcript55

Hang Up (Slide Layer)Don't Trust (Slide Layer)Don't Open (Slide Layer)CUNY Cybersecurity Awareness Course Transcript56

Don't Answer (Slide Layer)1.45 D000 - Recognizing ThreatsVoiceover Transcript:Click Next to Begin this Section.1.46 D010 - Password Security(Multiple Response, 10 points, 2 attempts permitted)CUNY Cybersecurity Awareness Course Transcript57

CorrectChoiceWait and see if it happens again.Find out what his role is. If he has accesshimself, there is no need to do anything.XImmediately change her password.XReport the incident to her manager.Feedback when correct:That’s right!The first thing Janet must do is change her password. Whenever you suspect a password hasbeen compromised, you should immediately change it. She should then report her concerns toher manager.Feedback when incorrect:That is incorrect.CUNY Cybersecurity Awareness Course Transcript58

The first thing Janet must do is change her password. Whenever you suspect a password hasbeen compromised, you should immediately change it. She should then report her concerns toher manager.Voiceover Transcript:Review Janet’s situation and then answer the question.Correct (Slide Layer)Incorrect (Slide Layer)CUNY Cybersecurity Awareness Course Transcript59

Try Again (Slide Layer)1.47 D020 - Recognizing ThreatsVoiceover Transcript:Individuals seeking to gain unauthorized access use a variety of techniques to obtain your userID and password. Shoulder surfing - looking over a user’s shoulder when they are logging in - isone of those techniques.Always take a moment before you log in to make sure no one can see what you type.Always feel free to ask a trusted colleague to turn away. No one should object to such a request.If they do, they may not be as trustworthy as you think.Never divulge your user ID and password to anyone.If you suspect your password has been compromised, change it!CUNY Cybersecurity Awareness Course Transcript60

1.48 D030 - Recognizing ThreatsVoiceover Transcript:Your devices and accounts are only as secure as the strength of the passwords that protectthem.Let’s go over guidelines for best password practices.At a minimum, all passwords must be at least eight characters long. Your CUNY campus ordepartment may have adopted more stringent password controls. For example, you may berequired to include at least one upper case and one lower case character, have at least onenumber, or have at least one special character.1.49 D035 - Recognizing ThreatsVoiceover Transcript:CUNY Cybersecurity Awareness Course Transcript61

When you create a password, do not include information related to you. For example,passwords should not include your birthday or your son or daughter’s name.Don’t use the same password for home and work accounts.Keep your passwords secure.Passwords must be treated with the same care as other confidential information. Don’t writepasswords down unless you keep the paper record under lock and key.Lastly, change passwords regularly. All passwords must be changed at least every 180 days.Privileged access accounts must be changed at least every 60 days. Privi

CUNY Cybersecurity Awareness Course Transcript 6 1.6 B00 - Our Cybersecurity Challenge Voiceover Transcript: Click Next to Begin this Section. 1.7 B010 - Our Cybersecurity Challenge Voiceover Transcript: Supporting the free flow of information is vital for learning. Our cybersecurity challenge is