WannaCry header

UAB’s cybersecurity protections have warded off “WannaCry” ransomeware. To date, this malicious software has had little effect at UAB because of security protections put in place by UAB IT. However, the UAB community should remain on guard to protect from future threats.

The ransomware attack using what’s been called WannaCry software has locked computers in more than 150 countries, exploiting vulnerabilities, and has already inspired similar attacks.  In a ransomware attack, malicious software can encrypt and block the data on your computer or device — and hackers can then demand payment in exchange for the return of access to your data. 

The UAB community must be aware of the risks to avoid being tricked into installing malicious software on their computers, which can then also spread to other computers on the network.

This kind of attack is not new — it is a new twist on an old crime — but the rapid worldwide spread of WannaCry heightened media attention.

Over the past year, UAB IT has been putting new protection methods in place that help guard against such cyber attacks.

Among the new defenses:

  • SCCM, or Microsoft System Center Configuration Manager, provides automated patch management to systems across campus. Patch management helps protect against potential malicious intrusion and allows the network to be monitored constantly — that way, immediate action can be taken if a patch has yet to be released when a vulnerability is discovered. Patch operating systems, software and firmware on devices. A centralized patch management system, like UAB’s SCCM, is the best way to manage system patching. SCCM patched many UAB systems against the WannaCry malware more than a month before the outbreak. Anyone who is not using SCCM is encouraged to contact AskIT to work with UAB IT staff to deploy it on their systems.
  • Default-deny is a new firewall posture implemented late last year to better protect against intrusions by external attackers. The posture, which is considered a best practice, means only approved network services are allowed. Everything else is denied to help protect the network — and UAB and employees’ and students’ data. This posture protected UAB’s systems from external WannaCry scans and infections.
  • PhishMe simulated campaigns and PhishMe Reporter tool have helped increase awareness of the dangers of phishing emails among UAB students, faculty and staff.  Phishing scams often take the form of fraudulent emails designed to trick users into revealing sensitive or protected information, such as usernames and passwords or bank information, but posting as a legitimate entity such as your bank, social media sites — or even the university president.
UAB faculty, staff and students are urged to remain vigilant against phishing attacks. To guard against phishing and ransomware attacks:

  • Be aware that you are a target.
  • Scrutinize links contained in emails, and do not open attachments in unsolicited emails.
  • Report any suspected phishing emails.
  • Keep all software on your computer up to date.
Automatic email forwarding to a non-UAB IT account is permissible, but be sure you understand the risks and policies that affect you.

Storage or forwarding of Restricted/PHI data is not permitted in uab.edu email.  However, if you receive an email containing Restricted/PHI information and you have configured your mailbox to forward to a third party; this will lead to a breach of this information.


Also, UAB IT encourages faculty, students and staff not to automatically forward email to non-UAB accounts because of the lack of security oversight of those types of services; data protection concerns around FERPA and HIPAA; and the desire to guarantee the best possible supported user experience on campus.

If you choose to set up email forwarding, please note:

  • Any UAB message, regardless of location, is subject to UAB open records policy.
  • Any phishing remediation resulting from forwarding messages will be charged back to the individual, not the department.
  • Information forwarded to third parties, outside of UAB contracts, could constitute an unauthorized disclosure of restricted information. You are liable for these disclosures.
  • It is a violation of UAB HIPAA policy to forward email containing sensitive information or Protected Health Information to public email systems.
In an effort to better protect the UAB community from cyber threats, specifically the increasing number of phishing and malware attacks that students, faculty and staff are experiencing, UAB IT is enabling URL Filtering at the UAB internet connection. 

URL filtering technology starts by assigning each known website into different risk categories and can be configured to allow or prohibit access to these sites based on these categories. As part of this implementation, UAB IT will be protecting networked systems from access to the most dangerous categories, malware and phishing. The changes will be effective on May 20.

Users can test a site’s categorization here.

The upcoming change does not impact any servers or services located within the UAB Health System network.

If you have any specific technical questions, feel free to contact the Enterprise Information Security staff at 975-0842 or via email at datasecurity@uab.edu.
UAB IT will host two online town halls this month to explore alternative options for the UAB Dropbox service.

Town halls will be held at 2 p.m. Thursday, May 18, and at 9 a.m. Tuesday, May 23.

Join the May 18 town hall here, or call 205-996-0000 and enter conference ID 514784.

Join the May 23 town hall here, or call 205-996-0000 and enter conference ID 795562.

The current UAB Dropbox is nearing the end of life, or end of sustainability, and UAB IT will be evaluating options for replacing it or encouraging use of current cloud collaboration services. UAB IT will offer a survey following the town halls for members of the campus community to express their opinions about the options.
UAB IT's office for institutional cell phone service and support is moving to the TechConnect store, located at the Hill Student Center, effective Monday, May 8.

The cell phone office has been located in Cudworth Hall.

The new location is a better fit with the services already offered at the store, which provides sales and service for personal technology purchases for students, faculty and staff.

Hours of operation are Monday through Friday from 8 a.m. to 4 p.m. Appointments are encouraged and can be scheduled via e-mail to Ed Ramsey at eramsey@uab.edu.


In just six months, UAB IT has improved its customer service rating from a 0.4 to at least a 2.2, according to HDI, an industry-leading customer service consultant. 

Since summer 2016, UAB IT has made improvements in the AskIT help desk a main priority — with UAB IT leadership, including Vice President and CIO Dr. Curt Carver, taking time answering phone calls from students, faculty and staff.

New training, standard knowledge sharing and process improvements have helped AskIT's technicians deliver a more consistent customer experience for the UAB campus community.

"We've really been pleased to see these changes coming through," said Karen Buckner, director of operations for the School of Nursing's Dean's Office.

And improvement plans don't stop there.

"We're strategically working to better analyze and track the types of issues our customers are having so that we can develop better processes and improve our system so you don't even need to call us because we've already identified the trend," said Jason Johnson, associate director for AskIT.

"Our goal is to solve your problems quickly, so that you can get back to work and get back to changing the world," Carver said.
In an effort to provide transparency and measurable results, UAB IT’s Infrastructure & Operations has developed a new infrastructure service level agreement (SLA) to govern managed server provisioning, maintenance, and support.

The new SLA is currently being reviewed by existing clients for feedback and planning sessions and includes topics such as Service Descriptions, Support Procedures, and Standard Maintenance Windows.

The new SLA will take effect for new customers starting in May 2017 and will be published in the Service Catalog

Existing customers will be moved to the new SLA upon renewals in FY18 with the existing rates staying the same for FY18.  However, Infrastructure & Operations is working hard to develop new services and new rates under this SLA in order to stay competitive with the various consumer cloud infrastructure services and to appropriately protect UAB’s IT resources, such as networking and data security, with new contracts and new cloud-based services.

UAB IT’s Infrastructure & Operations will next be working on similar SLAs and Service Roadmaps for Storage & Backup Services, Colocation Services, and Mail & Web Services to be available by the end of the summer within the Service Catalog.

For questions or comments, please reach out to Rachel Moorehead, 205-934-5065, rmoorehead@uab.edu, executive director of infrastructure & operations.
digital signage screens
UAB IT is now dropping the cost of maintenance for digital signage from $45 to $30 a month. There will also no longer be an upfront license fee.

These changes are to ensure that UAB IT is doing its part “to provide a consistent, cost-effective digital signage solution for campus," said Robert Howard, associate vice president and deputy chief information officer.
UAB digital signage offers dynamic, vibrant messaging with easily adaptable, branded content. With proper hardware, signs can even be interactive.

UAB digital signage offers branded content, automatic emergency notification integration and media flexibility. It is easily managed and maintained through a simple web interface.

For more about digital signage, click here.
As part of UAB's ongoing efforts to enhance email security, UAB IT will be implementing several security improvements during April.

These enhancements include additional support for data loss prevention (DLP); enabling email encryption; and improving our protection against phishing campaigns. Additional details will be forthcoming when these services are implemented.

Data loss prevention support will include more email policy tips, similar to the credit card number policy tip implemented in March.

Email encryption will give those who use Office 365 email the opportunity to use an extra layer of security when sending emails, if they choose.

Protection against phishing campaigns will include methods to avoid UAB email servers being blacklisted.
A technology upgrade in Heritage Hall classroom 442 is earning rave reviews from those who use the classroom.

All of the technology in the room was upgraded: the computer is an all-in-one touch-enabled Windows 10PC; the AV controls were updated to the new classroom standard, with a new control panel with intuitive icon-driven interface; new, brighter projector; and Blu-ray player controlled by the touch panel.

“The Crestron system that controls the room will eventually be monitored remotely to ensure more efficient maintenance and support,” said Walt Creel, manager of classroom technology.

Academic adviser Raven M. Dials said she appreciated that UAB IT sought feedback from instructors and others on campus before making changes in the classroom.

“I had a guest speaker this past Tuesday, but she used the system and it worked great and looks amazing,” said academic adviser Raven M. Dials. “I was happy to see the upgrade as I was having issues every week with the projector shutting off in the middle of my presentations as well as our guest speakers. Thank you for taking the time to have it set up and asking for feedback!”

Academic adviser Courtney White added, “The new system is great. The old one would shut off about 10 minutes into my class every week and take me about five minutes to get the projector working again. I had absolutely no issues today.”

Learn more about the classrooms UAB IT serves here, and get the status of classroom technology here.
EmailtotheCloud

UAB IT is planning to migrate UAB employee and faculty email to Office 365, a cloud-based system that offers new tools and continuous upgrades to improve the service and environment.

Office 365 offers several advantages for users, and because email is in the cloud, it is not dependent on UAB facilities being available when the user is off-campus. Office 365 is also the email system that students use.

After two successful pilot programs, UAB IT has been migrating the email of customers served by Desktop Services throughout the month of March.

On April 7, UAB IT will begin migrating all campus employees' email to Office 365, with migrations taking place in waves throughout the summer. Employees whose email will be migrated will be notifed by email the week before the migration, with detailed instructions about how to prepare for the change.

There are three main steps that employees can take to prepare for the most successful email migration:
  • Update to Microsoft Office 2016.
  • Ensure your user name is set in the format "BlazerID@uab.edu" on ALL of your devices.
  • Ensure that your email is in what is called "cached mode." 
             To enable cached mode:
                   1. Go to File click the Account Settings button and select Account Settings
                   2. Select the account with Microsoft Exchange as the Type, then click the Change button
                   3. Under Offline Settings, check the box for Use Cached Exchange Mode
                   4. Click Next, Finish.
You can find details about these steps at uab.edu/Office365. Contact your department IT staff or AskIT if you have any questions.

UAB IT will host an online Town Hall meeting about the migration for campus IT professionals on Monday, March 27, at 1 p.m.

Click here to learn more about the migration.
Beginning Apr 15, 2017, access to the Report Viewer application will be limited to UAB Campus and Hospital networks, or for external users via VPN.

A VPN is used to connect a remote user to UAB campus resources that are restricted for reasons of security and/or licensing constraints.

For detailed instructions and downloads, please visit uab.edu/VPN. Anyone who has trouble accessing this resource from off campus should contact AskIT at askit.uab.edu.
With the latest Firefox update (52.0) and subsequent updates, Java, Silverlight, Adobe Acrobat, and other plugins will no longer work.

Use Internet Explorer 11 to access Oracle and any other system that relies on the above applications.

Click here for more information from Mozilla. 
April UAB IT Security Awareness

Identity theft is a real threat; it can happen to anyone, and it can be challenging for victims to deal with the fallout. 

The following tips can help you prevent identity theft.

  • Read your credit card, bank, and pay statements carefully each month. Look for unusual or unexpected transactions. Remember also to review recurring bill charges and other important personal account information.
  • Review your health insurance plan statements and claims. Look for unusual or unexpected transactions.
  • Shred it! Shred any documents with personal, financial, or medical information before you throw them away.
  • Take advantage of free annual credit reports. In the US, the three major credit reporting agencies provide a free credit report once a year upon request.
  • If a request for your personal info doesn’t feel right, do not feel obligated to respond! Legitimate companies won’t ask for personal information such as your social security number, password, or account number in a pop-up ad, e-mail, text, or unsolicited phone call.
  • Limit the personal information you share on social media. Also, check your privacy settings every time you update an application or operating system (or at least every few months).
  • Put a password on it. Protect your online accounts and mobile devices with strong, unique passwords or passphrases.
  • Limit use of public Wi-Fi. Be careful when using free Wi-Fi, which may not be secure. Consider waiting to access online banking information or other sensitive accounts until you are at home.
  • Secure your devices. Encrypt your hard drive, use a VPN, and ensure that your systems, apps, antivirus software, and plug-ins are up-to-date.
If you become a victim of identity theft:

  • File a report with the US Federal Trade Commission at IdentityTheft.gov.
  • Use the identity theft report to file a police report. Make sure you keep a copy of both reports in a safe place.
  • Flag your credit reports by contacting the fraud departments of any one of the three major credit bureaus: Equifax (800-525-6285), Experian (888-397-3742), or TransUnion (800-680-7289).
60 Sec Survey Student Page

UAB IT wants you to take a 60-second survey to tell us your communication and technology preferences.

The quick 10-question survey will give UAB IT more information about how to communicate with our customers and will let us know what technology services are most valuable and important to you.

UAB IT appreciates the feedback from students, faculty, staff and researchers to help determine technology priorities and communication methods.

Take the survey here.

Emailing Sensitive Information

Sending credit card numbers and personally identifying information via email makes you more vulnerable to identity theft.


Beginning late Friday, March 10, UAB IT will implement policy tip warnings via email if it appears you are trying to send a credit card number via your UAB email account.

These warnings are intended to alert you to potential danger and help you protect yourself.

The popup policy tip will say: "The content of this email appears to conflict with UAB Policy regarding unsecured transmission of credit card or other personally identifiable information. Be safe and review the email content before sending."

With Friday’s introduction of the policy tip, emails will not yet be blocked from being sent. But emails that appear to include credit card information will eventually be blocked — both in incoming and outgoing emails.

“Sending credit card information, Social Security numbers, dates of birth and other personal or financial information is extremely dangerous and could leave you vulnerable to identity theft,” said Brian Rivers, assistant vice president and chief information security officer. “Our goal with these policy tips is to help protect our students, faculty and staff.”

In the future, UAB IT will add more policy tips and preventive measures to protect other sensitive information — including Social Security numbers — from being transmitted via email.
UAB IT will host an open town hall meeting from 10 to 11 a.m. on Monday, March 20.

The focus of the town hall will be campus needs and opportunities for improvement on the AskIT help desk.

The town hall will be held in the Alumni Theater at the Hill Student Center.

Learn more about UAB IT’s efforts to improve service at the AskIT help desk here.
Sending sensitive data via email is dangerous — and UAB IT is implementing new methods to help prevent students, faculty and staff from sending information they might regret.

Beginning March 3, UAB IT will implement a new system to help prevent credit card information from being transmitted via email. In the first phase, UAB IT's information security team will be notified of attempts to send a credit card number from a UAB email account.

During the next phase, you will see a popup policy tip advising you that sending such information violates UAB policy.

The popup policy tip will say: "The content of this email conflicts with UAB Policy regarding unsecured transmission of credit card information. If you do not resolve this conflict, this email may be blocked. Please refer to the UAB payment card policies and handbook."

When UAB IT introduces the policy tip warnings, emails will not be blocked from being sent yet. But emails that appear to include credit card information will eventually be blocked — both in incoming and outgoing emails.

"Our goal is to create a safer environment for UAB students, faculty and staff and to protect their personal and financial information," said Brian Rivers, assistant vice president and chief information security officer.

In the future, UAB IT will add more policy tips and preventive measures to protect sensitive information — including Social Security numbers — from being transmitted via email.

We all like to travel with our mobile devices (smartphones, laptops, or tablets) — whether it’s to the coffee shop around the corner or to a café in Paris. These devices make it easy for us to stay connected while on the go, but they can also store a lot of information — including contacts, photos, videos, location, and other personal and financial data — about ourselves and our friends and family. Following are some ways to protect yourself and others.

Before you go:

  • If possible, do not take your work or personal devices with you on international trips. If you do, remove or encrypt any confidential data.
  • For international travel, consider using temporary devices, such as an inexpensive laptop and a prepaid cell phone purchased specifically for travel. (For business travel, your employer may have specific policies about device use and traveling abroad.)
  • Install a device finder or manager on your mobile device in case it is lost or stolen. Make sure 
    it has remote wipe capabilities and that you know how to do a remote wipe.
  • Ensure that any device with an operating system and software is fully patched and up-to-date with security software.
  • Makes copies of your travel documents and any credit cards you’re taking with you. Leave the copies with a trusted friend, in case the items are lost or stolen.
  • Keep prying eyes out! Use strong passwords, passcodes, or smart-phone touch ID to lock and protect your devices.
  • Avoid posting social media announcements about your travel plans; such announcements make you an easy target for thieves. Wait until you’re home to post your photos or share details about your trip.

While you’re there:

  • Physically protect yourself, your devices, and any identification documents (especially your passport).
  • Don’t use an ATM unless you have no other option; instead, work with a teller inside the bank. If you must use an ATM, only do so during daylight hours and ask a friend to watch your back. Also check the ATM for any skimming devices, and use your hand to cover the number pad as you enter your PIN.
  • It’s hard to resist sharing photos or telling friends and family about your adventures, but it’s best to wait to post about your trip on social media until you return home.
  • Never use the computers available in public areas, hotel business centers, or cyber cafés since they may be loaded with keyloggers and malware. If you use a device belonging to other travelers, colleagues, or friends, do not log in to e-mail or any sensitive accounts.
  • Be careful when using public wireless networks or Wi-Fi hotspots; they’re not secure, so anyone could potentially see what you’re doing on your computer or mobile device while you’re connected.
  • Disable Wi-Fi and Bluetooth when not in use. Some stores and other locations search for devices with Wi-Fi or Bluetooth enabled to track your movements when you’re within range.
  • Keep your devices with you at all times during your travels. Do not assume they will be safe in your hotel room or in a hotel safe.

When you return:

  • Change any and all passwords you may have used abroad.
  • Run full antivirus scans on your devices.
  • If you used a credit card while traveling, check your monthly statements for any discrepancies for at least one year after you return.
  • If you downloaded any apps specifically for your trip and no longer need them, be sure to delete those apps and the associated data.
  • Post all of your photos on social media and enjoy reliving the experience!

 

Desktop install

A new grant to help prepare the Birmingham area workforce for new IT jobs got a helping hand last month from UAB IT.

Staff members from the department’s Desktop Services helped install computers at Innovation Depot to prepare for the first cohort of future IT professionals to participate in training as part of the Innovate Birmingham program.

The Innovate Birmingham initiative is a result of the Innovate Birmingham Workforce Partnership, a coalition of more than a dozen regional leaders, receiving nearly $6 million from the Department of Labor and Training Administration’s America’s Promise Grant. UAB served as the lead partner and fiscal agent for the consortium. Other partners include the City of Birmingham, TechBirmingham, the Dannon Project and Innovation Depot.

“Assisting with this project is part of our initiative to grow the community of information technology excellence in our community and beyond,” said Dr. Curtis A. Carver Jr., vice president and CIO.

The America’s Promise grant was awarded to community, business, and education leaders who are committed to fostering economic growth for the region and offering better opportunities for young adults. The grant will train nearly 1,000 people aged 17-26 and transition them into high-paying jobs in the IT sector. The partnership has secured support from 27 regional employers. This will establish a sustainable pipeline of talent in Birmingham to fuel inclusive innovation for local employers, meeting IT workforce demand for the region by offering demand-driven education, training and employment opportunities for area youth who are disconnected from the labor market. The training and education program will co-locate job-seekers with job-creators in the heart of the newly formed Innovation District by providing space for training at the Innovation Depot. Grant activities began January 1, 2017 with intent to begin training this spring.

“This award represents the commitment and collaboration of Birmingham’s top leaders in government, industry and academia to form the partnerships that enable our young people to obtain the skills they need to land good jobs in the city,” said Josh Carpenter, director of external affairs for UAB.