News

Innocent internet scrolling has been the antecedent for many frantic phone calls to our office:

I was just scrolling through facebook and clicked on something interesting; now my computer is beeping at me and telling me I have to call this 1-800 number to get rid of a virus!

This issue is generally what we call a Browser Hijack, and is easy to fix by ending the tasks of your open browsers using Task Manager.

On a Windows machine, launch Task Manager by clicking ctrl + alt + delete or right-clicking on your taskbar/bottom menu bar. Then, look at the apps running in “Processes” – ending the process for the affected browser. If you aren’t sure which browser is problematic, it is okay to end the process for any that are open.

On a Mac, try “Force Quit” from the Apple menu to quit your browsers.

You will want to check your “new tab” page, your default search engine, installed extensions/plugins and your homepage to make sure that the browser hijack did not also change some of your browser settings.

The majority of browser hijacks that we see on work computers are innocent in nature, but really do stem from behaviors that should cause concern on a corporate network. Is scrolling through the internet done on a computer that also connects to your server or shared data? Next time the call to our office may not be for a simple browser hijack, but may be ransomware or a debilitating virus. Consider limiting the amount of non-work related web surfing performed on corporate devices and the corporate network.

 

October is Cyber Security Month; this first week focuses on staying safe at home and on home devices. When we prepare networks and firewall settings for our K-12 clients, we are often asked to block access to social media and blogging sites.  Our settings can restrict students from accessing these on the school internet connection, but we cannot restrict students from accessing the same sites/services from their data plan on their cellular device.

While we do believe that schools play a positive and important role in shaping student interactions online and teaching about online safety, we also believe that this oversight and monitoring of a personal device falls to the family. We have collected safety and setup guides to some of the top social media apps and services and shared them below.  It is important to remember that most of our productivity apps also now have chat and communication components included: these collaboration components are critical for our current education and business climate. However, even apps designed for productivity can be utilized in other ways.  It is also important to note that there are hundreds and perhaps thousands of anonymous chat/messaging apps available in the iOS and Google Play stores; your child and their peers may prefer to use an app that is not included on this list, but may have similar features and safety concerns.

It is hard to raise children in this era without allowing access to technology: we have 1:1 technology initiatives in our schools, we have smart devices in our homes, and we know that our future economy and career choices are tightly linked to technology. Take some time to talk to your children, visit sites and apps with them, and develop an open line of communication to solve problems together should they arise. We know from experience that dealing with tech problems is always easiest when we are proactive: when we take the time to setup the device and apps appropriately for the age of the child, we run into less issues further down the road.

Learn more about safeguarding privacy for children and teen online from The National Cyber Security Alliance.

Parent’s Guides to Social Media Apps and Services:

Instagram:

Snapchat:

WhatsApp:

WeChat:

Yubo:

Kik:

Facebook:

Reddit:

TikTok and Musical.ly:

Tumblr:

Twitter:

Telgram:

Twitch:
(also similar: Mixer, XBox Live)

Device Setup Guides

Android:
Setup Parental Controls on Google Play
Apple:
Parental Controls on iPhone/iPad
Amazon:
Setup Amazon Free Time
InternetMatters.org:
More setup guides for streaming services, etc.

As more schools are utilizing Chromebooks and GSuite, schools are finding that it is helpful to have multiple staff members on campus that have password reset rights in the GSuite console.

There are several levels of administrative roles built into the console, and the ability to quickly develop custom roles if you want staff to only have access to specific tools and services. When setting up staff to reset student passwords, we strongly recommend drilling down into each level of the admin role you are considering assigning, or making a custom role to limit access to unnecessary tools.

For example, some of the built-in admin roles have access to the email audit log; I may want the library associate in each building to be able to reset passwords for students, but do not want to burden him/her with looking up messages lost to the spam filter.

Learn more about pre-built administrative roles and custom roles in GSuite Support.

Schools can also turn on password recovery for staff, so they can generate their own password reset when needed. GSuite does not allow this feature to be utilized for users under age 18.

Several times a year, we see waves of phishing and spam attacks cycle through K-12 email domains. Our K-12 schools are tightly connected with other districts – sharing staff, AEA services, vendors and more, so spam emails are quickly spread and quickly read, infecting inboxes of students, patrons, staff and more.

When Google sees a suspicious login attempt, it will often present a login challenge. This may include:
•A pin code sent to your cell phone
•A request to verify your recovery email address
•A request to verify your usual sign-in location
•Domain administrators can also setup two-factor authentication for their domain, or assign an employee ID to use as the login challenge.

If you have not set up your recovery cell phone number or your recovery email address, Google defaults to ask your usual sign-in location.

Another security feature to help you keep your account safe is an automated email that notifies you of a suspicious login. Individual users do have the ability to disable this feature, but we highly recommend that you keep it turned on. It takes just seconds to delete an email when you sign-in on a new device. Full recovery from a hacked account is a much longer process!

To learn how to setup your recovery cell phone number and recovery email address, follow these steps from Google.

If your account has been hacked, your Google Administrator may need to help you with some digital clean-up. We typically check account settings for these changes:
•Clear sign-in cookies, either through the administrative console or through the user’s account
•Check for a reply-to address and name change in the user’s email settings
•Check for a forwarding address in the user’s email settings
•Check sent mail to see if the account was used to send out spam/viruses

We also recommend these computer security steps:
•Run a scan on school machines and home machines that accessed this Google account
•Consider whether your school Google password was the same password used for other accounts. If it was, it is important to change passwords for other accounts as well. In the future, use unique passwords for each account.
•Consider whether you may have responded to a phishing request and given up your Google credentials to a spammy website. You may want some training in recognizing phishing emails.