Understand Stanford’s Risk ClassificationsStanford uses a three-tier classification model (Low Risk, Moderate Risk, and High Risk) for categorizing data and systems by risk level. Understanding these classifications and how they apply to you is the first step in protecting yourself and Stanford.
Recognize phishing and other social engineering attacksMost often motivated by financial gain, hackers frequently employ social engineering techniques to gain unauthorized access to data and accounts via email (“phishing”), text messaging (“smishing”), phone (“vishing”), or online services such as social networking.
To avoid becoming a victim, never provide personal information in response to an unsolicited email, phone, text message or letter, even if it appears to be from a friend or colleague. If unsure, contact the purported senders using information from their official website, as opposed to information provided in the unsolicited communication.
You can protect yourself and Stanford by learning to recognize a phishing email and reporting any suspicious email to phishing@stanford.edu.
The phishing awareness program periodically sends an email to each participant that resembles a phishing message. It’s designed to create a safe, educational environment for a recipient to practice phishing email identification with no penalty to them, or their department, if a link is clicked. Individual results will never be reported.
Keep your software up-to-dateNew vulnerabilities in operating systems, web browsers, and other software are discovered daily. Updating software frequently prevents these vulnerabilities from being exploited.
BigFix and Jamf are broadly used services at Stanford that help keep your laptop or desktop computer up-to-date. If unsure whether BigFix or Jamf are already installed or need to be installed on your machine, contact your local IT support team.
Back up your devicesBacking up your files protects your data against ransomware, accidental loss, and system failures. CrashPlan is Stanford’s recommended backup and recovery service for laptops and desktops. If unsure whether CrashPlan is already installed or needs to be installed on your machine, contact your local IT support team.
Encrypt your devicesEncryption protects your personal information and Stanford’s data to prevent unauthorized access in the event that the device is lost or stolen. The MyDevices website tracks your registered devices and their compliance statuses. The encryption guide walks you through the process of encrypting your devices.
Protect against malicious softwareTo protect against malicious software, install Stanford’s recommended antivirus software on your computer. If unsure whether an antivirus software is already installed or needs to be installed on your machine, contact your local IT support team.
Use approved Stanford servicesThe Risk Classifications website lists approved Stanford services corresponding to each risk level. Consult with your IT support team before using services that are not listed.
To get started using Stanford supported software, visit University IT’s Essential Stanford Software website.
Use a password managerIt is a best practice to use unique and strong passwords for each of your online accounts. Password managers facilitate the generation and secure storage of passwords. They also save you time and trouble by requiring you to remember only one master password to access the password manager.
Use secure emailWhen sending sensitive information (especially High Risk Data) via email, add “Secure:” to the subject line, even when sending within Stanford. “Secure:” ensures that the message is sent securely to prevent unauthorized access. For sharing protected health information (PHI), use the Stanford Medicine Box.
Report lost or stolen devicesIf one of the devices used for your Stanford work (whether personally or Stanford owned) has been lost or stolen, report the incident to the University Privacy Office.
Copyright Stanford University. Stanford, California 94305.