Go Fishing, But Don’t get Caught in the Net!

Phishing is the practice of attempting to trick you out of your username and password, your credit card information or your Social Security number, or …any other sensitive and valuable information. It takes little investment to send an email blast with fake offers or fake warnings and reap the benefits of people surrendering their information in a moment of weakness. While you may not think that the information in your Penn State account is particularly secret, determined hackers can and will use your credentials to get inside Penn State's system and then look for other vulnerabilities to probe. Under some circumstances starting with one username and password could get someone access across the University. And, of course, accidentally surrendering your personal information can cost you much personal time, effort and perhaps money.

Penn State's Office of Information Security has conducted two 'self-phishing' educational programs recently - once in February of 2018, and again in March of 2019. These programs involve sending realistic-looking phishing messages to account holders across the University, and if someone clicks the link they are presented with educational material about phishing and its risks. Our College did well in 2018, and improved in the 2019 program. While even one click is too many, the 2019 results showed that over 95 percent of our college resisted the temptation to click. Pat yourselves on the back, but stay vigilant.

Penn State's Office of Information Security reminds us that Penn State will NEVER ask for your password, social security number of other sensitive information via email. Never. And they offer three pieces of advice…Be Wary, Confirm before you Click, and Details Matter. Further discussion of these tips can be found at their website, https://security.psu.edu/phishing/.