Security Bulletin
Butte College takes internet security seriously. This bulletin has information on current issues, vulnerabilities, 以及将安全漏洞风险降至最低的建议.
New Email Security Implemented 7/6/2017
Ransomware and other malware exploits are on the rise. 就在上周，又有报道称Petya勒索软件漏洞在全球范围内遭到攻击. 勒索软件呈上升趋势，对我们的系统和数据构成非常严重的威胁. 传播这些恶意攻击的主要方法是通过电子邮件. To better protect you and the campus from these attacks, IT部门在我们的Office 365电子邮件系统中为教员增加了额外的安全层, staff, and generic email accounts.
Visit http://q5f.kshgxm.com/services/itss/security/atp/index.html 以获取有关我们实施Office 365高级威胁防护的更多信息.
WannaCry Ransomware Outbreak 5/15/2017
IT服务和支持部门发现了一种名为“想哭”(WannaCry)的新型恶意软件，该软件最近在至少99个不同的国家大规模感染，成为新闻. “想哭”是一种被称为勒索软件的恶意软件. It is most often downloaded as part of a phishing email scam, and then the recipient is tricked into running it. Once it has been run, 它加密受影响的计算机和网络共享驱动器上的文件, 然后用户需要支付赎金来恢复文件. 这种恶意软件传播如此猛烈的一个原因是，它会试图感染网络上没有安装最新安全更新、没有防范“想哭”的其他计算机。.
What IT is doing to protect the district:
How you can help protect the district and yourself:
-
Do not open ANY unexpected email or attachments, 这是正确的——none——不要打开任何你不期待的消息. Call the person who sent it to you to verify its validity.
-
This threat uses emailed PDF files to infect. 据报道，对于某些变体，仅打开电子邮件就足以感染您的计算机.
-
Personally owned computers:
If anyone suspects a possible infection, 应将其视为最优先事项，以控制这种蠕虫的传播，立即拨打895-2888与用户支持服务联系.
What is Phishing?
网络钓鱼是一种在线获取敏感信息(登录信息)的行为, credit card details, money, etc.) by pretending to be a trustworthy entity. Criminals can use phishing, 垃圾邮件和其他恶意电子邮件获取您的个人和财务信息, 以及敏感的大学信息和获得十大网赌正规平台资源的途径.
Malicious email typically:
- Use urgent language
- Ask for personal information such as passwords, bank account numbers, user names and/or credit card numbers
- May have grammatical, typographical, or other obvious errors
PHISHING ALERTS
- Date: 12/21/2016
- Sent From: Ileana Grecu
- See Details Here
- Date: 12/19/2016
- Sent From: Help Desk
- See Details Here
March 5, 2015 - Zip File Email Attachment Policy Change
为了减少病毒和校园垃圾邮件的传播, 以下警告消息将被附加到任何具有 .zip attachment or executable content. While not all content in .Zip附件是有害的，将恶意内容放入 .Zip，然后将其附加到电子邮件中是攻击者传播病毒的一种简单方法. 通常，电子邮件信息是可信的，足以欺骗收件人点击并安装内容 .zip, or following instructions in a password protected .zip. This leads to infected machines and compromised accounts, 这将使该地区面临数据被盗和不当访问机密数据的风险.
在过去的一个月里，我们一直在评估校园电子邮件的数量和性质，包括 .zip attachments. 有合理数量的合法业务在进行交易 .Zip附件，所以我们选择这个策略，而不是阻止 .zip attachments. 这些警告信息将作为警告用户谁收到了潜在的恶意电子邮件之前，我们能够评估和实施阻止特定的电子邮件，如果它被确定为恶意.
我们已经在各种设备和邮件客户端上成功地测试了这些警告, and this action is negligible in system or account impact, 并且不会干扰原始信息的传递.
A message that contains an executable attachment or .包含可执行文件的Zip文件将在电子邮件正文前附加以下警告消息. 并非所有可执行内容本质上都是病毒式传播——这条消息纯粹是作为一种警告.
Example:
***********************************
WARNING--This message contains a .zip attachment. Zip files can contain viruses--open with caution.
If you were not expecting this message, even if sent from someone you know, contact the sender to verify its validity.
Delete this message if it is not valid.
---------------------
Butte College IT Services and Support
http://q5f.kshgxm.com/itss
Students: 530-895-2525 Faculty & Staff: 530-895-2888
***********************************
April 28, 2014 - Internet Explorer Security Vulnerability
微软在所有版本的ie浏览器中发现了一个漏洞. 如果您的系统受到攻击，攻击者可以完全控制您的系统.
Workarounds
If at all possible, do not use Internet Explorer. Google Chrome、Mozilla Firefox、Safari和Opera都不受此漏洞影响. 对于需要使用ie浏览器的工作，请执行以下步骤:
Internet和本地intranet的安全区域设置为“高”。
请按照以下步骤提高Internet Explorer浏览器的浏览安全性。
- On the Internet Explorer Tools menu, click Internet Options.
- 在“Internet选项”对话框中，单击“安全”选项卡，然后单击Internet.
- Under Security level for this zone, move the slider to High. 这将您访问的所有网站的安全级别设置为高.
- Click Local intranet.
- Under Security level for this zone, move the slider to High. 这将您访问的所有网站的安全级别设置为高.
- 单击OK接受更改并返回Internet Explorer.
Note 如果没有可见的滑块，请单击“默认级别”，然后将滑块移动到“高”.
Note 将该级别设置为“高”可能会导致某些网站无法正常工作. 如果您在更改此设置后使用网站有困难, and you are sure the site is safe to use, you can add that site to your list of trusted sites. 这将允许网站正常工作，即使安全设置设置为高.
如果您有任何疑问或疑虑，请联系用户支持服务.
