UAB IT is aware of a critical vulnerability — called “POODLE” — on Web browsers and is taking steps to ensure that all enterprise systems and applications have been protected from this vulnerability.

Security researchers have identified POODLE — “Padding Oracle on Downgrade Legacy Encryption” — in an old but still commonly used version of SSL, the technology used to encrypt HTTP and other web traffic. Any server that supports SSL version 3 (SSLv3) can be exploited so that an attacker can decrypt secure sessions, potentially revealing passwords and other private information.

Web browsers will be updating their technology over the next few weeks to automatically disable SSLv3 on the client (browser) side, eliminating the POODLE vulnerability. If you utilize an older computer, please ensure that you have updated modern web browser such as Firefox 33, Chrome 38, Safari 7, Internet Explorer 10 or 11. There are platform-specific settings available for most browsers to disable SSLv3 at runtime for those who do not want to wait. Most users can simply ensure they get automatic browser updates and wait for the official update.

The safest and simplest solution is to disable SSLv3 support on all software, and instead use more recent versions of SSL: TLS version 1, 1.1, or 1.2. (Confusingly, more recent versions of SSL use the name TLS, for Transport Layer Security, rather than SSL, and the numbering scheme was reset to 1. So SSLv3 is older than TLSv1. TLS version 1.2 is the most recent version of SSL/TLS.)

Server administrators should take immediate action to disable SSLv3. Simply enabling other versions and leaving SSLv3 enabled is insufficient, as protocol downgrade attacks are possible. Disabling SSLv3 on a server may create compatibility problems for ancient client software — most notably, Internet Explorer 6 will be blocked from using SSL. Protocol configuration is platform-specific, so please refer to your official documentation for instructions. Some unofficial guides and methods of checking your server are available in in the references below.

Web clients other than browsers, such as web services, may need reconfiguration to communicate over TLS. Administrators and developers responsible for non-browser clients should check their official documentation. 

In an effort to emphasize the risks of using cloud services to store University data, UAB IT is releasing interim guidance on the use of cloud services for the UAB campus.

The guidance is for members of the UAB campus community who wish to use cloud applications and services available on the Web, including file storage, Web conferencing and content hosting.

While recognizing that cloud services can fill a need in certain areas, UAB IT reminds all UAB employees to use appropriate due diligence when entering into agreements, especially with cloud providers. UAB employees should not store sensitive/restricted information in a cloud service without University-approved agreements in place.

UAB employees cannot subscribe to cloud services to store sensitive or classified data (see UAB Data Protection and Security Policy for what UAB defines as sensitive data) without an appropriate agreement directly with UAB — and employees cannot be reimbursed for such cloud subscriptions without an affirming statement that the data stored is not sensitive.

“We want to make people aware of how risky it is to use such sites for sensitive data,” said David Yother, director of enterprise technology services for UAB IT. “The safest method is to keep it here at UAB, unless a specific business reason exists and appropriate management approvals have been received.”

Over the coming months, additional information will be released, including guidelines for specific cloud services.

More information about the cloud guidance can be found here.

UAB Hospital employees should refer to guidance from HSIS with regard to using cloud services.



Cyberspace is a shared resource, and its security is the responsibility of all American citizens, businesses, groups and governmental agencies. Cyber security begins with the awareness of our individual internet usage habits and changing them to practices that can help safeguard our digital lives.  cybersecurityawareness logo

When in doubt remember staysafeonline.org’s motto: STOP. THINK. CONNECT.

STOP: Before you use the Internet, take time to understand the risks and learn how to spot potential problems.

THINK: Take a moment to be certain the path ahead is clear. Watch for warning signs and consider how your actions online could impact your safety, or your family’s. 

CONNECT: Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer.


Cybersecurity is daily issue that will affect the rest of your life.  Therefore, every individual should place the cybersecurity motto “STOP. THINK. CONNECT.” at the same level of importance as “Stop, drop and roll” and “Look both ways before crossing.”

This year, the UAB Enterprise Information Security department will focus on the campus community through classroom and homecoming event presence. The classroom presence involves an intuitive presentation to the CAS 112 – Success in College class. The CAS 112 course prepares students for a successful collegiate career in any field of study.

The UAB Enterprise Information Security department’s homecoming presence will be at a booth in the Occupational Health and Safety Vendor Fair from 11 a.m. to 2 p.m. on Friday, Oct. 10. The OHS Vendor Fair will be located between Rast Hall and the Campus Green.  Come and visit our booth so that we can chat about cyber security.  You will leave our booth with more cyber security awareness knowledge — and a few treats.

Additional cyber security resources:

National Cyber Security Alliance

Password Security

Phishing Scams

Physical security tips







AskIT is changing its phone support hours slightly to better serve UAB students, faculty and staff.

The AskIT help desk will now be open from 7 a.m. to 9 p.m. Monday through Friday; from 9 a.m. to 6 p.m. Saturdays; and from 1 to 6 p.m. on Sundays. The change goes into effect Monday, Oct. 5.

AskIT professionals offer support for all of UAB’s central applications and services, as well as enhanced support for Desktop customers.

Help desk professionals are also available for walk-up support at the Center for Teaching and Learning (ETS 238, Education Building) from 8 a.m. to 8:30 p.m. Monday through Friday; from 10 a.m. to 5:30 p.m. Saturdays; and from 1 to 5:30 p.m. on Sundays.

You can live chat with a professional from 8 a.m. to 5 p.m. Monday through Friday by clicking on the “Live Chat” button at uab.edu/askit.

You can also submit a ticket at any time by clicking on the “Submit a Ticket” button at uab.edu/askit.
UAB IT is urging all university employees to be aware of a possible e-mail phishing scam with the subject line “Your Nex Salary Notification.”

The e-mail claims to be communication from UAB Human Resources and asks users to click a link which takes them to a fraudulent site.

UAB IT officials are taking steps to prevent the further dissemination of e-mails from this particular sender, but remind UAB employees remain vigilant about potential phishing scams.

To report suspected spam to AskIT, please follow the instructions here.

Some tips to help users avoid phishing scams include:

Be wary of unsolicited email. Phishing scams try to convey a sense of urgency and try to pressure you into clicking a link. They might claim that unusual activity regarding your account has been flagged, or you must reconfirm your password by clicking on a link in the e-mail. If you receive such a message, be very skeptical and do not click on any links. Send an email to AskIT@uab.edu to report the suspicious email.

Check for misspellings or grammatical errors. Phishers often make such mistakes when writing the subject matter line or when writing the body of the email.

Think before you click. Both the sender’s email address and any suspicious links in the message body can help identify a fraudulent email. First, hover your cursor over the sender’s email address and check the domain name (the part of the address that comes after the “@”; for example, @school.edu). Now hover your cursor over the suspicious link (be sure not to click on it!) to view the web site address of the link (for example, school.com). There’s likely a problem if those two don’t match (for example, an email address of ITadmin@school.edu and a web site address of passwordchange.school.com).

Verify the address. Be aware that cyber-criminals will try to trick you into thinking a web site address is real by making it look similar to the real thing. For example, UAB web sites end in the domain name “uab.edu.” A phishing e-mail might ask you to click on a malicious web site link with the domain name “uab.edu.com.”

Avoid opening attachments. Many phishing emails include attached documents that contain malware that can infect your computer. Never download and open these attachments.

Protect your password. Remember, information security and IT officials at both UAB Hospital and the university will never ask users for passwords or any other sensitive information.

Report suspicious activity. If you have any questions or you receive a suspicious email that you want to report, university employees and students can call the AskIT Help Desk at 205-996-5555.  Hospital employees can call the HSIS Help Desk at 205-934-8888.

Wondering if your photos, data and other information are securely stored in the cloud after the leak of celebrity photos over the Labor Day weekend?

UAB IT security professionals say the incident is a good reminder to the rest of us to take precautions with our own data.

Since most of us aren’t celebrities, our photos probably won’t be worth hackers’ time — but personal information can be.

So what can you do to keep your personal cloud accounts safe?

• Enable two-factor authentication on your cloud accounts. That way, if you — or someone else — tries to log into your account from a device that is not registered, you’ll have to log in using a verification code sent to one of your devices. It’s an extra step that helps secure your information.

Microsoft’s OneDrive — a cloud storage application available free for UAB students — uses two-factor identification and allows users to add security information to their account. Learn more here.

• Make sure you have a strong password. Ideally, you should use a passphrase you can remember. For example, choose “goblazers,” but replace some of the letters with numbers or symbols and include capital letters. The example, then, could become g0b!azers — easy to remember, harder to hack.

Change your password often to keep your data secure. That’s why UAB requires employees and students to change their BlazerID passwords frequently, and to make sure they contain the kind of character combinations that make them much less vulnerable to attacks.

• Consider using a password manager or password vault such as LastPass or KeePass. Such tools — which vary in price — can help manage your different logins while keeping them secure.

UAB employees should also be very cautious about cloud storage in regards to University information.

“UAB employees should not use cloud products for UAB business data without approval,” said Scott Fendley, information security operations manager for UAB IT. “UAB IT reviews the contracts and ensures that the cloud products meet our requirements.”

This month’s Tech Talk on Sept. 25 will feature a discussion of cloud computing at UAB. 

Would you like to know more about plans for cloud computing at UAB and the overall direction UAB IT is taking?techtalk
Then join us Thursday, Sept. 25, for the next Tech Talk.  Planned topics include:

·         IT strategy (key components of UAB IT’s Strategic Direction)

·         Risk profile project (update on the project which is taking an inventory of all of the servers on campus)

·         Cloud computing (guidance to campus and upcoming plans)

Tech Talk is open to all in the UAB community involved in information technology. This will be a great opportunity for discussion, not just a presentation.

Tech Talk will be held from 2 to 3:30 p.m. Thursday, Sept. 25, at Cudworth Hall, room 140.

No registration is required.

Forgot your BlazerID password? You don’t have to contact AskIT.

Did you know there is a quick and easy way to reset it through BlazerID Central?

If you have a phone number registered for B-Alert/e-Notify, you can use the automated password reset. Just register a new or existing phone number for “Identity” in the e-Notify signup here. You’ll get a text or voice message with a code to reset your password.

And if your password has expired, you can still log in to BlazerID Central with your old password to reset to a new password.

UAB’s password/passphrase policy, effective Jan. 1, 2014, requires faculty and staff to change their passwords every 90 days, and students to change their passwords every 180 days.

UAB IT has changed its notification schedule for changing your BlazerID password. Users now receive notices 15 days before their passwords expire, as well as seven days, three days, two days and one day prior to expiration.

Remember: E-mailed password change notices from UAB IT will NOT include clickable links, due to ongoing phishing attempts. All updates to your BlazerID password should be managed through BlazerID Central.

You’re shopping for dorm room decorations, signing up for classes and buying books.

But don’t forget to get your computer ready for UAB’s campus, too.

UAB IT has a handy guide to preparing your computer for use on our network, including instructions for installing antivirus applications for both Windows and Mac operating systems, downloading software and accessing the network.

Click here for all the instructions. 

The Campaign for UAB has reached its halfCampUAB Tag 4c-700way mark less than a year after its launch – and fundraisers will soon have a new tool to help reach their ultimate goal, thanks to UAB IT employees.

The Advancement Performance tool will help fundraisers with detailed reports about donors and potential donors, said Marylyn Crane, senior director of advancement information services and analytics for the University’s Advancement Services.

For the past year, UAB IT employees from the Enterprise Applications and Solutions department have been verifying the data in the Advancement Performance tool from vendor Ellucian to make sure the data is accurate for the use in fundraising.

“The main benefit to Advancement Performance is our ability to put data in the hands of our leadership, advancement staff and development officers,” Crane said. “Our goal is for them to be more accurately and actively guided through the decision-making process for our initiatives, key measures and fundraising efforts.”

UAB IT already runs data reports on a regular basis for the Advancement Services team, but the new tool will give fundraisers the opportunity to create their own reports. But creating and verifying the database has been a detailed, painstaking process for the UAB IT team, said Ramsey Scott, assistant director of administrative computing services and leader of the technical team responsible for this project.

In fact, UAB IT employee Ryan Teel created a validation tool – a Web application – that Ellucian will include in its next version of the software, Scott said.

“We have been validating the data for the better part of a year,” Scott said, making sure that the data for Advancement Performance matches what is already in the Banner system.

The new tool will go live in August.

“We want our data to tell a story so we can reach the right people for the right reasons during our current campaign and into the future,” Crane said.

“This project is an example of how UAB IT partners with units across campus to support the mission of the university,” said Phillip Borden, assistant vice president of information technology. “Our employees are proud of the role they play in important strategic initiatives such as The Campaign for UAB.”