Information security and data protection guidelines

How to protect your credentials and avoid scams

Phishing aims to obtain users’ passwords, which are then used for financial gain or malicious actions. Malware that spreads through the web and email attachments can, for example, steal or destroy files, transmit your account and password information to the malware author, and slow down network performance.

• Laurea’s systems are accessed with a personal username and password.
• You are personally responsible for the use of your credentials. Do not give your password to anyone else. Even system administrators should not know it. If someone asks for your password, they are without exception up to no good.
• Change your password often enough and immediately if you suspect it has fallen into someone else’s hands. If you receive a new password from user support, change it immediately to something only you know.
• Your password can be something you easily remember but which outsiders cannot crack or associate with you. For choosing a password you can use tools such as passphrases.
• Do not write your password down without encrypting it.
• Do not use the same password on any non-Laurea service as you use for Laurea services, so that compromise of an external service does not allow access to Laurea systems.

Remember the risks of email

Email is not intended for confidential communication. Use encrypted email when necessary.

• The email address provided by Laurea should be used for Laurea communications, services and learning environments.
• If you receive an email that belongs to someone else, inform the sender about the wrong address. Remember that you are bound by confidentiality regarding the message you received. Forward the message to the correct party if known.
• When composing messages, bear in mind that the recipient may forward your message to a wider audience than intended.
• Email messages travel through the network unencrypted without any protection. Confidential information should be sent as encrypted email by using the email Encrypt button.
• Consider carefully to whom you give your email address or where you publish it. Obtain a separate non-Laurea email address for private use.
• Use the recipient, cc and bcc fields correctly.

Beware of phishing emails and other scams

Be reasonably suspicious of the reliability of any email you receive. Email messages may contain malware or direct you to pages that host malware. An email may also come from a party other than the sender shown in the From field. Malware may send emails in a user’s name without their knowledge.

• Beware of phishing messages that ask you to give up your credentials or to enter them on a website. Administrators will never ask for your password or online banking credentials.
• Always check the real target address of a link before clicking. Be especially cautious if you have received a link or attachment in a message.
• Do not reply to advertisements or chain letters; delete them immediately. If an offer seems too good to be true, do not take it.
• Besides email, you may be deceived by other means, for example by phone or social media. Beware of unexpected invoices, fabricated messages, or surprising requests sent in the name of people you know.
• Laurea uses various methods for spam and malware filtering that may affect email delivery. Check your spam folder occasionally.
• If you suspect you have been the target of a scam or a scam attempt, you can ask for instructions from Laurea’s ServiceDesk or file a security report.

Devices are your responsibility

Take care of your study devices.

• Take care of your computer’s security and operation. Note that home computers may only be connected at Laurea to Laurea’s visitor network. Also make sure to back up your personal data.
• Ensure that the operating system and applications on both your computer and mobile devices remain up to date.
• Always log in to a computer with your own credentials.
• Lock the computer whenever you leave it, even if you step away only for a moment. This prevents unauthorized use of systems and files under your credentials.
• If you use a shared computer, delete any files you may have temporarily saved on the computer before logging out.
• Save all important study materials to OneDrive. This way your data will remain safe if the device is lost.
• Installing software on Laurea machines is generally prohibited and often technically blocked. If you need a specific software on a school device, contact the ServiceDesk.
• Use a USB stick only for transferring data, not as the only or permanent storage location.
• Do not leave your devices unattended in public places or on public transport.
• If your device is stolen, file a police report and change all passwords for Laurea systems that were stored on the lost device.

Be cautious with public computers and open networks

• When using other wireless networks, use only web services that encrypt their traffic. The address will then begin with https://.
• Note that public computers in public spaces may have software that collects user information. Consider whether it is necessary to log in to, for example, Laurea email from such a computer. Learn how to clear the browser cache and remove other traces left after your use.
• Be cautious about USB sticks brought by others. Turn in any found USB stick to the ServiceDesk without inspecting its contents.
• Make sure you use a secure protected connection outside Laurea. For example, the worldwide Eduroam service used in higher education is protected and secure.

Take care of devices and data also when mobile and abroad

• The security of mobile devices depends on how you use them. Through your own actions you are responsible for ensuring that devices and data remain secure also when using them on the go for studies.
• Use data connections judiciously, especially outside Europe.
• Turn off wireless connections (Bluetooth and WLAN) on your device whenever you do not need them.
• Download mobile apps only from official app stores.
• Consider whether to allow location access in mobile services. Be especially cautious if you suspect the usage environment is untrustworthy or otherwise unsafe.

Keep your own computer healthy and operational

• Protect your computer with a firewall and anti-malware protection.
• Do not install any software you do not genuinely need.
• Install security updates for software.
• Create personal user accounts (without administrator rights) on your computer for each user. Administrator accounts should only be used for maintenance tasks (installing software, creating other accounts).
• Back up your computer files regularly. Store backups separately from the computer and, if possible, in a locked location.

Remember personal data protection

• All information that can identify an individual is personal data. At Laurea, personal data may generally only be processed in systems that are accessible with Laurea user credentials. Only named persons may handle sensitive information on devices and systems appointed by Laurea for that specific purpose.
• Use secure printing and take care to handle paper documents appropriately.
• Consult Laurea’s privacy statements if necessary.
• When studying in public spaces, pay attention to what you speak aloud. Avoid writing confidential messages in such situations. Use a privacy screen on your display where possible.
• Dispose of personal data when it is no longer needed.
• Ensure proper handling of personal data also at home.
• Processing confidential information and personal data in cloud services other than those provided by Laurea is not permitted. If necessary, check with the ServiceDesk in which systems it is permitted to process data.

Use online services and social media wisely

• In many online services user data is stored only on the service provider’s servers and in consumer services often also outside the EU. Before adopting a service, check at least who retains ownership of the data and whether the data will be passed on to others.
• In your studies, primarily use services provided and approved by Laurea.
• Check from time to time the privacy settings of the online services you use (e.g. who can view your information) and adjust them if necessary.
• It is easy to impersonate others in online communities. Do not take everything you read too naively.
• Beware of pop-ups and advertisements on websites. Malware spreads rapidly on social media and online services – do not click carelessly.
• When using social media services, consider what information you share. Once information is put online (for example documents, photos, personal data, opinions) it may later be impossible to completely remove.

Do you suspect malware infection or a security breach?

Antimalware programs cannot provide perfect protection, as new malware is constantly emerging. If you suspect that a computer you use has or has had malware, file a security report and act as follows:

• Immediately change on another computer all passwords that you have used on the machine infected by malware or that are the same as those used on that machine.
• To investigate possible misuse, report the suspected malware and any potential compromise of your account to the customer support of the most important services you use.
• If the computer is a Laurea device, contact the ServiceDesk. If it is your own device, do not use it until you have established how to remove the malware. You can get limited advice on cleaning your own computer from the ServiceDesk or from the website of your antivirus provider.
• If you suspect a security breach or misuse of a system, contact the party responsible for the service. If the service is Laurea’s or you used the service with Laurea credentials, contact the ServiceDesk and file a security report.