Welcome to the Network Security website at the IAS
This website is intended to bring you the latest news, how to's, tools and resources in Information Security. Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.
The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute. For a description of these principles, please see our About section.
In keeping with the spirit of the Institute, I encourage questions and open discussions about security. And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.
Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep
Changing my GnuPG key
Submitted by ep on
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256,SHA1 This is a public notice that I am migrating to a new GnuPG key to upgrade the digest algorithm and the assymmetric algorithm. My old keys are: sec dsa1024 2006-09-22 [SC] 128A38F44CFA5EDB99CE473461174C250371C12A uid [ultimate] Brian Epstein <ep@ias.edu> uid [ultimate] Brian Epstein <bepstein@ias.edu> uid [ultimate] [jpeg image of size 3503] uid [ultimate] [jpeg image of size 6400] ssb elg2048 2006-09-22 [E] sec rsa4096 2014-05-02 [SC]
SIM Jacking - or how the thieves can steal your phone number
Submitted by ep on
There is a nefarious practice of stealing people's phone numbers to intercept their phone calls and text messages, and it is fairly easy to do if you know what you are doing. The attack involves calling the wireless carrier and convincing them to switch your phone number to a new device.
Update to Duo Login
Submitted by ep on
An upcoming change will modify the look of our Duo Multi-Factor Authentication login prompt. This change will enhance the security of the system, and will be rolled out to our web applications over the next few months. Although there is no major difference on how you use the login prompt, we wanted you to be aware of the change so it isn't a surprise.
Old Prompt
Here is a screen shot of the old login prompt.
New Duo Mobile version 4
In October 2021, DuoSecurity will be releasing a new version 4 of their Duo Mobile application for Apple and Android devices. There are some major design differences which may cause some confusion, notably the position of the Approve and Deny Buttons. Here is an image showing the differences.
Warning about text messages impersonating the New Jersey Motor Vehicle Commission (NJMVC)
Submitted by ep on
The New Jersey Cybersecurity & Communications Integration Cell (NJCCIC) sent out a notice reporting several incidents regarding fake text messages impersonating the New Jersey Motor Vehicle Commission. This scam is being used to collect your private information which could be used to open credit accounts or steal your identity.
https://www.cyber.nj.gov/garden_state_cyber_threat_highlight/sms-text-sc...
What I'm doing about Contact Tracing apps during the global pandemic
Submitted by ep on
The short answer is, I'm using the COVID Alert NJ [1] [2] app on my smartphone. I find it to be a safe, secure, and private way for me to participate in helping to stop the spread of COVID-19. That being said, I didn't trust the app blindly. I did research and testing to ensure it met my requirements for privacy and security. My findings are below in case it helps you make a choice on whether or not you participate as well. For more
Upcoming changes to support Duo Multi-Factor Authentication in web based login screens for IAS
Submitted by ep on
In the upcoming months IAS will be making a change to the login process for our web based applications by adding support for Duo Multi-Factor Authentication (MFA). This is the same technology that we currently use for our remote access system, OpenVPN. This move will change the look of the login screen, which we explain below.
May 2020
Old: Central Authentication Service (CAS)
CAS has been in use for many years at the IAS and has a simple login screen that looks like this.
Zoom Meeting Security
Submitted by ep on
Now that we've moved our meetings to being online, there are some safety concerns that we need to keep in mind that we never had to think too hard about before. We are seeing news articles about "Zoom-bombing", where uninvited guests join public Zoom calls to disrupt, or even terrorize its participants. There are a number of techniques that you can use to secure your Zoom sessions.
Be Aware of Gift Card Scams and other Phishing Attacks
Submitted by ep on
What are Gift Card Scams?
The story starts with an innocent email from a supervisor, colleague, or friend asking for your help. They tell you a tale about how they need some gift cards for gifts to family, friends, potential donors, etc. Unfortunately, they are unable to make the purchase themselves, could you help them out? And of course, it is an emergency, please do it as quickly as possible. Did you just fall for a gift card scam? [1]