Cybersecurity Blog

We are linking up again with The National Cybersecurity Alliance to bring you a series of posts on remaining cyber safe as you embark on your next adventure.

We’re coming up on peak vacation time in the Northern Hemisphere, so we wanted to send a checklist to help you remain cyber safe during your travels. In this first part of our series we’ll cover some tips for the preparation phase of your trip, as you’re packing and getting ready to go. Bear these tips in mind to keep your vacation plans free from cybercriminal meddling.

Travel lightly

Limit the number of devices you take with you on your trip. The more laptops, tablets and smartphones you take with you, the more risk you open yourself up to.

Check your settings

Check the privacy and security settings on web services and apps. Set limits on how and with whom you share information. You might want to change some features, like location tracking, when you are away from home.

Set up the “find my phone” feature

Not only will this feature allow you to locate your phone, it gives you the power to remotely wipe data or disable the device if it gets into the wrong hands.

Password protect your devices

Set your devices to require the use of a PIN, passcode or extra security feature (like a fingerprint or facial scan). This will keep your phone, tablet or laptop locked if it is misplaced or stolen.

Update your software

Before hitting the road, ensure all the security features and software is up-to-date on your devices. Keep them updated during your travels by turn on “automatic updates” on your devices if you’re prone to forgetting. Updates often include tweaks that protect you against the latest cybersecurity concerns.

Back up files

If you haven’t backed up the data on your devices, like photos, documents or other files, do so before heading on vacation. If your device is lost, stolen, broken or you otherwise lose access to it, you won’t lose all your data. You can back up your data on the cloud, on an external device like a hard drive or, preferably, both.

One More Thing

We’ll just let this image speak for us. 👇

Seriously. Think before you post.

Next time: Cybersecurity tips for when you finally reach your destination!

This post was written by Ray Truex, Cybersecurity major and captain of Messiah’s CCDC (Collegiate Cyber Defense Competition) team.

Last Friday and Saturday (March 31 – April 1, 2023), students from Messiah University were given the opportunity to compete at the MACCDC (Mid-Atlantic Collegiate Cyber Defense Competition) regional event. Originally, the team had placed 12 out of about 30 teams, missing qualifiers by a few spots. The team still planned on attending the regional event as volunteers but thanks to a last-minute dropout of another team, Messiah was actually able to compete. In less than a few hours a team of six was assembled and on their way to Largo, Maryland.

The night before the competition the final team packet was sent, and we noticed that we had over forty systems to harden and ensure availability. The competition was scored on six categories: service availability, business injects, board meetings, orange team, red team activity, and IR reports. The team was very limited, half of us had not even competed in the qualifier, and this was our first CCDC event.

The initial plan once the competition started was to get into the systems and change the default passwords. After that, students broke into groups; some worked on injects while others worked on hardening services. As the team captain, I was tasked with responding to board requests which were very aggressive in their demands. Their main demand was to make sure that the hypothetical shipping company that we were running was accepting orders and getting packages shipped. Day one came to an end quickly. Everyone was very fatigued and there was still a lot to do. After a debrief at Applebee’s with our coach, Dr. Bibighaus, we made sure we had a more focused approach for day two.

At the start of Day two, we had a meeting with the board of directors, during which I got yelled at by them for not having shipped any packages yet. As soon as the meeting ended, we got back to work. Unfortunately, we were unable to prioritize their request for getting packages shipped as the team was busy putting out fires the rest of the day. We did, however, have a minor victory of getting the blog server up and running, and at one point even having the greatest number of services running. The rest of the day consisted of continuing to harden and ensure availability, as well as completing injects and incident response reports.

Day two was also April 1^st, April Fools’ Day, so we started the day with the power strip turned off. This incident ended up being the highest scored incident report that we submitted, so it worked in our favor. An additional April Fool’s setback was the scoreboard being messed up the whole day, making it exceptionally hard to determine how we were doing on keeping our services online. After lunch on day two, the red team was given the green light to destroy everything, and we started noticing subtle signs like our webpage being defaced by power rangers. Within an hour or two left in the competition, services were dropping like flies. The last thirty minutes of the competition was dedicated entirely to filling our incident response reports due to the sheer number of attacks we were experiencing.

The competition ended and Messiah placed 6^th out of 7 teams, beating out George Mason University for last place. The team was very happy to get anything but last place, since this was our inaugural year. Being able to compete at regionals was much more than we expected. We brought back so much more to learn, practice, and prepare for next year. We were also able to meet many new employers and other teams to partner with in the future. The team is very excited to prepare for next year and hopefully get back to regionals.

Registration is now open for Cyber Camp at Messiah University this summer!

This day camp for high school students entering 9^th through 12^th grade is a fun way to dive into the world of cybersecurity. We’ll focus on the human factor of cybersecurity through topics such as cryptography, online behavior and privacy, data breaches, ethical hacking, and social engineering.

Students will learn through hands-on cyber labs, simulations, and interactive gaming scenarios. Plus, they’ll receive instruction directly from our cybersecurity faculty and industry experts, all while getting to experience an introduction to what college life is all about.

The camp takes place June 12-14. Space is limited, so register soon! Find all the details here: https://www.messiah.edu/cybercamp.

Messiah University’s Computer Science Club and associated Women in Cybersecurity (WiCyS) chapter hosted their Spring CTF Night on February 24th. A CTF (Capture-The-Flag) event is a cybersecurity competition in which participants complete cyber-related challenges to find hidden strings of characters, called flags, that they submit to win points.

Our CTF included 24 challenges designed by our club leadership in areas such as cryptography, steganography, password cracking, web server vulnerabilities, and more. Many cybersecurity students participated and got the chance to learn new skills, hang out with friends, and potentially win Cyber Program hoodies!

We are grateful for our collaboration with the Games Club and Cybersecurity Program to provide pizza/snacks and a large group of students excited about this event. We hope to continue hosting a CTF Night each semester in the future and look forward to the events.

This post was written by Grace, a Cybersecurity student and leader of the WiCyS chapter at Messiah. We appreciate Grace’s hard work in spearheading and overseeing this event.

The local WiCyS (Women in Cybersecurity) chapter, along with support from the Cybersecurity Education Program, hosted a Women in Cyber lunch for female CIS, Cybersecurity, and Business students on February 16 in the Messiah University Cyber Center. It was a time of making connections and learning from one another over a shared meal. Special guest Christina Martin, Cybersecurity and IT specialist at Highmark Health, spoke about the importance of having a healthy support network and of not being afraid to try new things in the industry. The event ended with a time of Q&A, followed by an extended time of fellowship and networking.

We are grateful to Christina for making time in her schedule to speak with our students. We’re also grateful to our students for their leadership of this event. We hope to do more events like this in the future that deal with the crossroads of cybersecurity, tech, and business, as well as women in leadership.

Special thanks to the Gender Concerns Committee for sponsoring this event!

On February 4, students from Messiah University participated in the collegiate cyber defense competition, a six-hour-long cyber security inherit and defend competition. This year’s scenario was to inherit a fictitious shipping company’s infrastructure and harden it before the hackers started attacking it. Students worked as a team to fix problems, harden the infrastructure, update, and ensure service availability all while being given business tasks from the company such as writing newsletters, acceptable use policies, and getting Graylog working.

This was the first year that Messiah University has participated in the competition. Led by coach Dr. Bibighaus and captain Ray Truex, a team was quickly formed and preparation started. The team roster included Luke Anderson, Justin Ayres, Chris Copeland, Ryan Donat, Delainey Gray, Aidan Hubly, Brandon Snook, Michael Stefanchik, Grace Taylor, Ray Truex, Shane Wahlberg, and Xavier Zepiora.  Each team member was assigned a certain machine to work on either apps, core, files, virtual, data, logs, and saas.

During the competition, the team was able to see a scoreboard showing which services were up and running and which were down, in addition to total score and place. After the competition, Xavier Zepiora said “we were not off to a great start, showing up as last place on the scoreboard at the start, but after a few hours of having all of our services up and running we slowly started climbing places passing other teams”. Messiah University went from last place to a high of thirteenth place. By the end of the competition the team was ranked 15th out of 29, which meant the team did not place in the top eight teams which move on to regionals. A few days after the event, the competition director notified the team of our final score, which was 11^th out of 26. 

Ryan Donat, Michael Stefanchik, and Shane Wahlberg are seniors this year and will not be able to compete next year but are still excited for the future of the team. After the competition Shane Wahlberg said “I am so excited for the future of the team, this was the first year and we just wanted to see what the competition was like. I think we did pretty good for it being our first year”. After having one competition under the team’s belt, the team is ready to start recruiting and preparing for next year. The team has a large list of items that they now know they need to work on more in-depth. The main goal in training for the next competition include having a CCDC virtual environment where the team can practice during their meetings. Some team members hope to go to regionals as volunteers to gain more experience and talk to other teams to learn from how they prepare for the event. Just because the competition for this year is over for the team does not mean that practice and training is over, the team will continue training and recruiting until the next event.

*This post was written by Messiah Cybersecurity major Ray Truex. If you are a Messiah Cybersecurity student and you’re interested in joining the CCDC team, reach out to Ray for more information.

We’ve launched a brand new YouTube channel, where our goal is to showcase the stories of our students – why they’ve chosen cybersecurity as a career, how they ended up at Messiah, and even what cybersecurity is and why it’s important. We’re thrilled to be able to capture some of their experiences in their own words, and to have a platform where students can bring awareness to the importance of cybersecurity for individuals and corporations.

Watch the first videos and subscribe here >> https://www.youtube.com/channel/UCdPfEhuYkF3dtghXwLSWAoA

What is the difference between cybersecurity and data privacy, and how do they work together? Read on for our final post of Data Privacy Week. Thanks again to the National Cybersecurity Alliance for allowing us to partner with them in an effort to resource people with tools to protect their data.

What Is Data Privacy?

The sheer volume of data generated about you and your activities online is staggering, which is why data privacy has become a defining issue of our digital age. Even if you don’t care very much, thousands of businesses across the globe pay top dollar to learn about you through this data.

Your online data can be categorized in certain ways. First, there is personal information like your name, birthdate, and Social Security number. There is also important information about you like your medical records and credit card numbers.

Then there is data about what you do online, like what websites you visit, what products you buy online, and who you communicate with on social media. This data can be extremely granular, like how many seconds you spend looking at a webpage before clicking to something else. Advertisers and other businesses prize this sort of data because they can better target ads and products toward you.

Often, this data is anonymized when sold, meaning an advertiser won’t know the specific name of the person who clicked on a link. But a cross-section of data about you can be added together to try to personalize ads to you. Data privacy, then, is the right to keep your data private. Understand that you cannot keep all of your data private from everyone – the IRS, for example, must know how much money you make, or you will face unpleasant consequences. However, you should know your data privacy rights and, when you can, make choices to only share your data when you feel it is appropriate.

Is Data Privacy the Same as Cybersecurity?

Data privacy and cybersecurity are different fields, but they go together. Data privacy revolves around rules, guidelines, and your own personal choices about who has access to your data, and how much access they have. Cybersecurity is focused on preventing and solving threats like hackings, malware, and online scams.

Bad actors often exploit cybersecurity vulnerabilities, though, to get data – it is that valuable. A lot of cybersecurity is about keeping your data safe. Data privacy, on the other hand, is about your right to keep your data safe, especially from those who aren’t cybercriminals, like websites and businesses.

Why Is Data Privacy Important?

You might be thinking that all your data is already out there, who cares who sees it? Why do I care if an advertiser knows what shoes I just bought through social media?

Think about this: have you ever been creeped out after using a search engine and then suddenly all the ads on the websites you visit are about the thing you searched? Do you want unscrupulous marketers to have your phone number so they can call you constantly?

There is probably some data you really don’t want others to have full access to, like your emails. However, if you don’t pay attention to your data privacy, you might download a program or plug-in that scans your email for data and sells it to advertisers. Even if the plug-in provides a decent service, like easily allowing you to unsubscribe from promotional emails, you might think twice about giving the service total access to your email inbox if you know that they sell your data.

With technology, there is always a trade-off between privacy and convenience. A maps app, for example, needs to know your current location to give you directions. In many cases, though, you can choose how much data you want to share. This is where knowing about data privacy can help you make decisions and form habits.

Finding peace of mind by being more aware of your data privacy is worth it.

January 22-28, 2023 is Data Privacy Week. To celebrate, we are partnering with the National Cybersecurity Alliance to spread awareness and resources about online privacy.

Your data is valuable. Even if you don’t agree, many organizations and groups would pay top dollar for it and they don’t all have your best interests in mind. But you have the power to take charge of your data. This is why we are excited to celebrate the second ever Data Privacy Week!

The goal of Data Privacy Week is to spread awareness about online privacy. We think data privacy should be a priority both for individuals and organizations. Our goal is twofold: we want to help individuals understand that they have the power to manage their data and we want to help organizations understand why it is important that they respect their users’ data.

Data Privacy For Individuals

All your online activity generates a trail of data. Websites, apps, and services collect data on your behaviors, interests, and purchases. Sometimes, this includes personal data, like your Social Security and driver’s license numbers. It can even include data about your physical self, like health data – think about how a smartwatch counts and records how many steps you take. While it’s true that you cannot control how each byte of data about you and your family is shared and processed, you are not helpless.

Here are some simple, easy tips that will help you manage your data privacy:

1. KNOW THE TRADEOFF BETWEEN PRIVACY AND CONVENIENCE.

Nowadays, when you download a new app, open a new online account, or join a new social media platform, you will often be asked for access to your personal information before you can even use it. This data might include your geographic location, contacts, and photos.

For these businesses, this personal information about you is tremendously valuable — and you should think about if the service you get in return is worth the data you must hand over, even if the service is free. Make informed decisions about sharing your data with businesses or services. Is the service, app, or game worth the amount or type of personal data they want in return? Is the data requested even relevant for the app or service (that is, “why does a Solitaire game need to know all my contacts”)?

 2. ADJUST THE SETTINGS TO YOUR COMFORT LEVEL

For every app, account, or device, check the privacy and security settings. These should be easy to find in a Settings section and should take a few moments to change. Set them to your comfort level for personal information sharing; generally, we think it’s wise to lean on the side of sharing less data, not more.

3. PROTECT YOUR DATA

Data privacy and data security go hand-in-hand. Along with managing your data privacy settings, follow some simple cybersecurity tips to keep it safe. We recommend following the Core 4:

• Create long (at least 12 characters), unique passwords for each account and device. Use a password manager to store each password – maintaining dozens of passwords securely is now easier than ever.
• Turn on multi-factor authentication (MFA) wherever it is permitted – this keeps your data safe even if your password is compromised.
• Turn on automatic device, software, and browser updates, or make sure you install updates as soon as they are available.
• Learn how to identify phishing messages, which can be sent as emails, texts, or direct messages.

Data Privacy For Organizations

Respecting the privacy of your customers, staff, and all other stakeholders is critical for inspiring trust and enhancing reputation. By being open about how you use data and respecting privacy, you can stand out from your competition. Communicate clearly and concisely to the public what privacy means to your organization, as well as the steps you take to achieve and maintain privacy.

Here are a few steps toward building a culture of respecting data at your organization:

1. CONDUCT AN ASSESSMENT

Assess your data collection practices. Make sure the personal data you collect is processed in a fair manner and only collected for relevant and legitimate purposes. Understand which privacy laws apply to your business, and remember you will have to think about local, national, and global regulations.

2. ADOPT A PRIVACY FRAMEWORK

Research how a privacy framework can work for you. A privacy framework can help you manage risk and create a culture of privacy in your organization. Get started by checking out the following frameworks:
NIST Privacy Framework
AICPA Privacy Management Framework
ISO/IEC 27701 – International Standard for Privacy Information Management

3. EDUCATE EMPLOYEES

Your employees are the frontlines toward protecting all the data your organization collects. Create a culture of privacy in your organization by educating your employees of their and your organization’s obligations to protecting personal information.

January 22-28, 2023 is Data Privacy Week. To celebrate, we are partnering with the National Cybersecurity Alliance to spread awareness and resources about online privacy. Our posts next week will focus on managing online privacy for both individuals and organizations, as well as the differences between cybersecurity and data privacy and how they work together. To get us ready, here are a couple of short videos with interesting statistics on how individuals and organizations approach data privacy!

Do You Know?

Respect Customer Privacy