The days of foreign princes wanting to give us millions of dollars via email are gone. Today, large, organized, international criminal syndicates make massive investments in methods to trick us into believing that we should click on links in innocent seeming email messages. This is called social engineering—using deception to manipulate individuals into divulging confidential and/or personal information. Fortunately, some basic steps can help us avoid social engineering traps.

Following these three basic rules for reading email messages will dramatically reduce your risk of unknowingly falling victim to a social engineering trap.

Slow down – Take the time to determine if the message makes sense. At first glance, a message saying you need to reset your Facebook password (for example) may seem very reasonable. But pause to think before clicking, opening attachments, or entering confidential information. Does the request make sense? Has something changed that requires an action? If it doesn’t make sense, report the message or ignore it.

Pay attention to the details – Look at the message specifics. Does the sender’s email address match the purpose of the message? Be careful–sometimes the differences are subtle, like facebook.com vs. ffacebook.com. Do the links point to a site that makes sense within the context of the message? Do you know and trust the sender?

When in doubt, check it out – If you have any reason to question the message, take the time to verify before responding. Reach out directly to the sender or visit the site rather than clicking the link in the message. Not sure? You can always report the message by emailing informationsecurity@drake.edu and ITS will review it for you. The bottom line is, if you have any doubts, don’t respond directly or open links or attachments.

If we all follow these practices, we can protect ourselves and others and prevent social engineering attacks from succeeding.

ITS will be continuing phishing education this month using emails that mimic real attacks. A short training lesson will be assigned to any faculty and staff who repeatedly click links or open attachments in phishing emails, simulated or not.

— Information Technology Services

Out-of-State Work Policy FAQs
The following FAQs have been developed in response to the excellent feedback provided by the campus community regarding the newly published Out-of-State Work Policy establishing a mandatory University-wide process for securing approval for employee out-of-state work arrangements.

Does this policy apply to temporary out-of-state work arrangements? 
No, the Out-of-State Work Policy does not apply to short-term, temporary out-of-state work arrangements such as arrangements that are made to attend a conference or to allow an employee with an approved remote work arrangement to temporarily work from an out-of-state location on a short-term basis. If an employee is working more than twenty-five (25) consecutive days outside the state, the work arrangement should be evaluated to see if the policy applies.

What prompted the University to adopt this new policy? 
The University has adopted this new policy to address the increase in requests for out-of-state work arrangements in connection with remote work arrangements that have been adopted across the University in response to COVID-19.  Because long-term and/or permanent out-of-state work arrangements may require the University to comply with additional or conflicting out-of-state laws and regulations (including state employment, labor and/or taxation rules), it is necessary for the University to be aware of, and explicitly agree to, long-term out-of-state work arrangements with its employees.  

Why does the new Out-of-State Work Policy require a 60-day notice period? 
As previously mentioned, long-term out-of-state work arrangements may require the University to comply with additional or conflicting out-of-state laws and regulations put in place by the state in which the employee will be working.  In many cases, the University must file with the Secretary of State and is subject to the filing timelines of each state. Although the University will make every effort to accommodate a request for a shorter approval period for an out-of-state work arrangement, the requirements of other states may not make it possible to comply with all legal requirements if we have less than sixty (60) days to do so.

New Capital Projects Policy
Drake University has formalized a new policy for the identification, prioritization, approval, development, and delivery of Capital Projects at Drake University.  All interested members of the Drake community are encouraged to review and comment on these policy revisions by March 15, 2021.