Be aware of scams and risks

Understand the impact of insider threats View

What to do

Keep an eye out for signs of insider threats. These are risks that come from a person within an organisation.

They typically happen when a current or former employee or contractor with legitimate user credentials misuses their access to our networks, systems or data.

Not all insider threats are deliberate or malicious, take steps to avoid unintentional insider activities in your day to day work.

How to do it

Knowing what to look out for is the first step.

Examples of intentional insider activities include:

Sharing passwords or access credentials
Publicly disclosing classified or privileged information.
Sharing sensitive intellectual property with a third party for personal benefit.
Deliberately accessing off limits areas without proper authorisation.

Report suspected intentional insider threats to the Cyber Team via cyberteam@monash.edu for further investigation.

Examples of unintentional insider activities include:

Leaving your laptop or computer unlocked when you are away from your desk.
Misplacing your security pass.
Discussing sensitive information in public or at a social gathering where you could be overheard.
Accidentally CCing the wrong person on an email containing sensitive information.

Remember to follow everyday cyber hygiene to minimise risks and make a report if you believe any of our work practices could accidentally lead to a security incident.

Why it matters

An insider can misuse their access to the detriment of Monash’s networks, research and data. This misuse could lead to cyber security incidents like data breaches.

Staff can watch and share this video about insider threats.
Read this article on malicious insiders on cyber.gov.au for further information.

Be aware of physical security View

What to do

Prevent unauthorised people from gaining physical access to your workplace or devices.

How to do it

Protect your devices:

Have passwords or PINs set up on all devices including personal ones like your phone.
Don’t leave devices unattended. You should keep your devices with you at all times, this includes data storage devices such as portable hard drives and USBs.
If you find a data storage device, never plug it into your computer. It may contain malware. Report it to the Monash Cyber Team via cyberteam@monash.edu.

Protect your data:

Shield your devices from view using your body or by cupping your hands when entering passwords or pin numbers, and when accessing confidential or sensitive information.
Be aware of shoulder surfers on public transport. People can get a lot of your information just by looking over your shoulder.

Protect your workspace:

Always lock your computer when you are away from your workspace, so that it requires a login when you start it.
Always keep your staff or student pass with you, or opt for a Digital M-Pass.
Never let anyone borrow your staff or student pass.
Don’t hold secure doors open for people you don’t know.
Don’t leave printed documents in the printer areas.

Why it matters

Cyber or online attacks aren’t the only way people can steal or gain access to confidential information.

If attackers can physically access secure areas and devices, they can bypass digital security measures.

Staff can watch and share this physical security video on Workplace (staff login required).
Monash University implements a number of controls relating to physical and environmental security.

Protect yourself from social engineering attacks View

What to do

Stop and think before sharing information with someone, could it be a social engineering attempt?

Be aware that scammers will use a range of social engineering techniques to try and get information from you.

No one is too small to be a target.

How to do it

Social engineering relies on manipulation tactics to get you to act before thinking. When you know what to look out for, it’s easier to know what to do next.

Here are some ways you can spot social engineering attacks:

Is a message or call unsolicited?
Are they asking for something out of the ordinary?
Is the person trying to apply pressure to make you act immediately?

Examples of social engineering methods:

Receiving an unsolicited email, call or message from someone who claims to be from the Monash Service Desk asking you to reset your password and provide it to them directly.
Receiving an email from someone claiming to be from your bank asking for personal information, such as your account number, password or PIN code.
Being asked for information about Monash or your details by someone claiming to be from HR.
Receiving a LinkedIn message offering you career advancement, research or collaboration opportunities.

The more information attackers have about you the more convincing they can be. Read the secure your social media accounts section below for further information on keeping your personal information safe.

Why it matters

Social engineering is one of the most common techniques used by cyber criminals and scammers.

Spamming and phishing are types of social engineering, but here are some other examples:
- Baiting: The attacker leaves a USB drive to be found, which spreads a malicious virus when it’s plugged into a computer.
- Mind games: Attackers may call you claiming they’re responding to a question you had raised or a survey you had completed.
- Tailgating: The attacker may claim to have forgotten their pass or simply walk in behind you to gain access to a secure area.
Staff can view this social engineering presentation in the Cyber Security Champions group on Workplace (staff login required).

Scams information sheet (pdf, 6.71mb)

Secure your social media accounts View

What to do

Protect your privacy by actively using the privacy settings on the social media platforms you use. Check them regularly as the platforms do update them.

How to do it

Consider setting profiles to private or friends-only when the option is available.

Click on the ‘Learn more’ section below for links and guides to protecting your privacy on major social media platforms.

Why it matters

Everything you post online can be seen by your virtual audience. Do you know who this audience is? Any information you post publicly can be used in social engineering attacks or to try and guess your password and access your accounts.

Public information you post online can be used to steal your identity. Learn about the risks, how to protect yourself and what to do in this article on identity theft on cyber.gov.au.
LinkedIn
Do you know that oversharing your career history could lead to tax fraud, social engineering, identity theft and could even lead to leaking sensitive information?

You are able to manage more than 70 options in your LinkedIn privacy settings such as who can send sales pitches or see your profile picture. Some are more crucial than others. Proactively managing these settings can help protect you from social engineering threats.
- Understanding LinkedIn's privacy settings
- Managing your LinkedIn privacy settings
Facebook
Who do you want to see your posts and comments? Understand the general audience options such as Public, Friends, Custom, Only me. Check and manage your audience on Privacy Settings and Tools. Guard your personal information and control your timeline.

Nothing is 100% private on the Internet even with all privacy settings in place, so be mindful of sharing information and the audience.
- Facebook’s basic privacy settings and tools
- Control who can see what you share on Facebook
Instagram
Keep your photos private. Take note of the geo-location data for posted photos.
No, you can’t make your Instagram followers “unsee” a photo but you can delete it from your photo feed even after you’ve shared it.
X (formerly Twitter)
By default, X is a public network and anyone will be able to follow you and see what you post. Keep in mind that the keyword here is ‘public’ – every little thing that you post will be available online, for anyone who wants to see it.

You can protect your posts on X, making them private and viewable only by you and people who follow you. You are not protected from people screenshotting these then sharing them.

Turn off location on your posts:
1. Select “more” on the left nav menu.
2. Go to Settings and privacy, then Privacy and safety.
3. Under Data sharing and personalization, go to Location information.
4. Go to Add location information to your Posts.
5. Ensure the box is unticked and if you wish to remove location information from past posts, click Remove all location information attached to your posts then click Delete.
Learn more about X's privacy settings
TikTok
Did you know that anyone can view and download your videos? Consider keeping your TikTok account private. A private TikTok account keeps all your content and information private, only showing them to followers that you approve.
- TikTok’s Safety Centre

Check that websites are secure View

What to do

Check if a website is legitimate and secure before providing any personal information like passwords, payment information or IDs.

How to do it

Check the site has a secure connection. Make sure that the url starts with https, not http. Click the symbol in the address bar next to the URL (in Chrome this is two circles and two lines, in Edge and Firefox it’s a lock). This will confirm whether or not the connection is secure. This does not ensure that the site itself is legitimate.

You can consider if the site is legitimate by using the Palo Alto Test A Site tool. This will give you information about the website including a risk category and when it was created.

Save your regular websites as bookmarks/favourites in your browser or in your password manager to always be sure you are on the legitimate website.

Why it matters

If your connection to a website is not secure, then anyone can see the information you share with that website. This could leave you open to scams, phishing attempts, credit card fraud or identity theft.

Cyber criminals can create fake websites that imitate real ones to trick you into giving them your login credentials or money.

Read this article about staying safe while shopping online on cyber.gov.au and explore their personal security guides.
You can adjust the security and privacy settings on your web browser further another layer of protection when you browse online:
Google Chrome
Change your privacy and security settings by entering chrome://settings/privacy in the address bar of your Chrome browser.

Find more information in Google’s Chrome’s Help Center:
- Google Chrome - Manage Chrome safety and security
- Google Chrome - Safe browsing
Microsoft Edge
Change your privacy and security settings by entering edge://settings/privacy in the address bar of your Edge browser.

Explore further information on Microsoft Edge’s privacy and security settings:
Firefox
Change your privacy and security settings by entering about:preferences#privacy in the address bar of your Firefox browser.

Explore useful information on how you can apply security features in Mozilla Firefox:
- Firefox - Privacy and security
Safari
Find useful information in Safari’s User Guide
- Safari - Change Security Settings
- Safari - Change Privacy Settings

Join the Cyber Security Champions group on Workplace View

Contact the Cyber Team

Email the cyber team at cyberteam@monash.edu

Contact the Service Desk

Contact the Monash University Service Desk.

Cyber Security at Monash University

Cyber Security at Monash University

Be aware of scams and risks

Understand the impact of insider threats View

What to do

How to do it

Why it matters

Be aware of physical security View

What to do

How to do it

Why it matters

Protect yourself from social engineering attacks View

What to do

How to do it

Why it matters

Secure your social media accounts View

What to do

How to do it

Why it matters

LinkedIn

Facebook

Instagram

X (formerly Twitter)

TikTok

Check that websites are secure View

What to do

How to do it

Why it matters

Google Chrome

Microsoft Edge

Firefox

Safari

Join the Cyber Security Champions group on Workplace View

What to do

How to do it

Why it matters

Contact the Cyber Team

Contact the Service Desk

Be aware of scams and risks

Understand the impact of insider threats View

What to do

How to do it

Why it matters

Be aware of physical security View

What to do

How to do it

Why it matters

Protect yourself from social engineering attacks View

What to do

How to do it

Why it matters

Secure your social media accounts View

What to do

How to do it

Why it matters

LinkedIn

Facebook

Instagram

X (formerly Twitter)

TikTok

Check that websites are secure View

What to do

How to do it

Why it matters

Google Chrome

Microsoft Edge

Firefox

Safari

Join the Cyber Security Champions group on Workplace View

What to do

How to do it

Why it matters

Understand the risks specific to your role

Contact the Cyber Team

Contact the Service Desk