Information security
A resilient, trustworthy and future-proof IT infrastructure that meets the requirements of research, teaching and administration is an essential prerequisite for Worms University of Applied Sciences. This means that the university’s information, IT systems and digital services must be protected in such a way as to ensure that their confidentiality, integrity and availability are maintained.
Malware, phishing, stolen login details or information inadvertently disclosed to the wrong people can jeopardise the university’s security. It is therefore important to remain vigilant, follow security guidelines and report any suspicious activity at the earliest opportunity.
The Information Security Officer (ISB) is available to answer any questions you may have: isb@hs-worms.de. If you have identified a phishing attempt, please forward it as an attachment to phishing@hs-worms.de.
Further information and resources will be added to this page to support and protect you in your day-to-day work.
Poster campaign on information security
Information security affects us all. Information security starts in our everyday lives and also depends on how we all behave. The following topics highlight what matters most. You’ll find background information, further links and practical tips.
Information security is a shared responsibility – every single contribution counts. A compromised account can provide cybercriminals with a point of entry, thereby putting not only individuals but the entire university at risk. So: stay alert and take even unusual or suspicious activity seriously. If you notice anything, report it – better to report it once too often than once too little. Please report any incidents to isb@hs-worms.de
Use a strong, unique password for each application – never use the same password for multiple services. A good password should be at least 15 characters long and contain a mix of upper- and lower-case letters, numbers and special characters. It’s even easier and more secure to use a password manager, which generates and manages secure passwords. That way, you only need to remember one strong master password.
Data can be irretrievably lost as a result of a cyberattack, accidental deletion or the loss of a laptop. An up-to-date backup can then make all the difference. Back up important data regularly and keep a copy separate from the original device. A local backup on an external hard drive can save your data in an emergency.
On public Wi-Fi networks, there is always a risk that third parties may attempt to intercept or tamper with data traffic. A VPN encrypts the connection between your device and the VPN server, thereby protecting communication on the network. In addition, certain malicious or suspicious connections can be blocked. You should therefore use the university’s VPN, particularly when on public networks.
The dark web is a part of the internet that cannot be accessed via conventional search engines and is used, amongst other things, for anonymous communication. Unfortunately, stolen login details and other information from data breaches are also traded or published there. There are reputable websites that allow you to check whether your email address or other login details have been affected by a known data breach. One such option is the Identity Leak Checker provided by the Hasso Plattner Institute.
Phishing emails try to trick you into clicking on a link, opening an attachment or revealing confidential information. Such messages often appear legitimate at first glance – which is why it’s worth taking a closer look:
- Do the sender’s name and the actual email address match? Is it a familiar and legitimate email address?
- Does the message have a digital signature, if applicable, and is it valid?
- Are the links included trustworthy? Check the actual destination of the link before clicking on it.
- Are the attachments trustworthy, and do you have a plausible reason for receiving them?
- Are the actions requested in the email plausible and appropriate? Be particularly cautious if time pressure is being applied or if you are asked to disclose passwords, payment details or other confidential information.
- Is the channel used to transmit confidential information trustworthy in the first place? If in doubt, you should verify the request via a known and independent channel of communication.
Don’t click, don’t reply, don’t open – check first. If a message seems suspicious, report it via phishing@hs-worms.de.