�Ӱɴ�ý

Today we're talking about the �Ӱɴ�ý Confidential Hotline. It's important that we all know how to report instances of non-compliance or suspected unethical practices.

00:30

One way the University of Alaska demonstrates its interest in hearing about issues is by making sure the hotline is available to everyone, this includes employees, students, contractors, and community members.The hotline offers confidentiality and the option to remain anonymous, making it a safe space for those who may be concerned about the potential for retaliation. 

First I would like to emphasize the importance of reporting issues to your supervisor. However if you don't feel comfortable going to your supervisor, the �Ӱɴ�ý Confidential Hotline is available as a confidential and anonymous reporting tool. That said, if you see anything that just doesn't look right, please say something. You can help the University of Alaska by being situationally aware, asking questions, and familiarizing yourself with university policies and reporting any concerns.

01:28

The most frequent issues reported through the �Ӱɴ�ý Confidential Hotline include: misuse of University resources, conflicts of interest, discrimination, harassment, and ethical violations.

Employees may encounter compliance related issues that warrant reporting as well. For instance in the area of accounting and finance, an employee might be concerned about the potential for fraudulent activities, such as falsification of financial records, or misappropriation of funds. In the area of diversity and equal opportunity, an employee could observe potential biased incidents or discrimination related to race, gender or other protected classes.

Information security issues may also arise, including data breaches, malicious use of technology, or unintentional use of insecure technology processes, any of which could threaten the Integrity of sensitive University information, or cause a privacy breach.

Additionally risk and safety matters may involve reports of unsafe working conditions, or environmental hazards that threaten employee wellbeing.

02:46

When a report is submitted, hotline administrators triage it to determine the next steps, including which department should be notified, to ensure proper followup of the reported situation. From here follow-up is performed to gather facts. An investigation is performed if necessary, as based on the facts of the situation. Corrective action is taken to address the issue and prevent future problems. One challenge is that to maintain confidentiality the reporter may not be aware of the substantial enforcement efforts occurring behind the scenes. Unfortunately this lack of visibility can lead to the perception that no action is being taken.

03:29

Speaking of anonymous reporting, how does the university ensure confidentiality and protect against retaliation?

Once a report is submitted through the hotline, whether by phone or online, it's assigned a case number. This provides tracking throughout the processes of triage, followup, and if warranted, investigation. The report is assessed and researched, and confidentiality is maintained to the extent practical at every step. If the individual chooses to remain anonymous, they can still communicate through the system without revealing their identity, allowing for follow-up questions if more information is needed.

The university will take steps to respect the identities and privacy of those involved. Absolute confidentiality may not be maintained in all circumstances, especially in cases where the university must take action to protect the safety of others. Care is taken that information is not shared beyond those with the need to know. The university operates in accordance with the Alaska Whistleblower Act to protect employees from being retaliated against in response to reporting concerns in good faith. Retaliation is not tolerated. In fact, retaliation itself can be subject to investigation and disciplinary action.

04:50

What role does the hotline play in fostering a culture of transparency and accountability at the university? Have there been any notable improvements as a result of the hotline reports?

The confidential hotline allows for open anonymous reporting which encourages people to speak up sooner rather than later. This has led to improvements such as clarification and communication of policies and procedures, stricter policy enforcement, better resource management, and increased awareness around issues like workplace conduct and conflicts of interest. Overall it has helped to build trust; where every one knows their concerns will be taken seriously, and handled appropriately.

05:34

What advice would you give to employees that are hesitant about using the hotline?

For anyone feeling unsure, I'd emphasize the hotline is there to protect both the individual and the university. The hotline is designed with confidentiality and anonymity in mind, meaning that no one should fear retaliation for coming forward. The university takes every report seriously and handles them with care and professionalism. There are strong anti-retaliation protections in place so no one will feel negative consequences for reporting. Using the hotline creates a safer and more ethical workplace, and can lead to positive changes for everyone.

06:15

Thank you Nikki, any final thoughts?

I just remind everyone that reporting concerns is a shared responsibility. It's a critical mechanism for maintaining an ethical and transparent campus environment. If anyone has questions or would like more information the hotline is a great resource, and of course you can always reach out to Danielle Foster or myself as the hotline administrators.

Thanks everyone for joining this Compliance Chat. We each have a responsibility to help create a safe and ethical campus.If you see something that doesn't look right, it's important to speak up. You can contribute by staying alert, asking questions, understanding University policies, and reporting any concerns. Also be sure to check out the �Ӱɴ�ý Confidential Hotline.

00:18

No matter your position, it’s crucial that all university employees maintain compliance with laws, policies, and procedures. To understand why this is important, let's begin by discussing the risks of non-compliance.

Non-compliance can have significant repercussions. At the worst, failure to follow laws and regulations can result in injury, death, legal actions, fines, or lawsuits.

• Legal Consequences can span safety, finance, research, and student rights.
• Reputation Damage can harm enrollment, funding, and credibility, especially if legal issues arise.
• Financial Impact of non-compliance may result in fines, legal fees, and reduced funding, affecting resources and donor support.
• Operational Disruption can be significant. Violations require quick actions to make things right, which could disrupt academic functions and research.
• Finally, this can include loss of funding and trust erosion. Failure to comply can risk grants and research support.

01:14

As a university employee, let's take a look at what your compliance responsibilities include. These are grouped into: risks, mitigation, training and reporting.

Risks:

It’s each of our responsibility to understand compliance risks relevant to our roles. Familiarize yourself with the policies, procedures, and laws that govern your work. You are expected to conduct university business in a compliant and ethical manner. As an example of risk, imagine a hypothetical situation where researchers stored hazardous chemicals in a lab without proper containment and labeling. This risks chemical reactions, spills, and endangers lab personnel and the environment.  It can lead to potential accidents, injury and penalties.

Mitigation: 

This includes following established compliance activities, processes, and controls to mitigate risks. As an example, the university has a risk mitigation plan concerning minors on campus.  This includes specialized training and establishing clear policies to prioritize the safety of the minors attending its programs.

02:16

Training:  

As an employee, you need to complete all required compliance education and training for your position.  Speak with your supervisor to understand what the compliance requirements are of your position, and to identify relevant laws, Board of Regents policy, and University regulation, as well as training specific to your role.

Let’s consider what can happen with OR WITHOUT the right training. Imagine if a university's event planning team arranges an inaccessible seminar, lacking ramps, elevators, sign language interpretation, or accessible materials. Or, consider the alternative. After participating in proper disability access training, the team knows to choose a venue with ramps, elevators, to provide a sign language interpreter, and accessible materials. This is not only lawful, it also demonstrates our commitment to inclusivity. 

03:09

Reporting:

As members of the University community, we all share the responsibility to foster a safe and ethical campus environment. If you observe any concerns, don't hesitate to speak up. Stay attentive, inquire, acquaint yourself with university policies, and report any issues to your supervisor or other university leadership. If you feel uncomfortable approaching your supervisor, you can report using the confidential and anonymous �Ӱɴ�ý Hotline. The hotline serves as a system-wide tool for receiving tips on safety, financial or reputational risks. 

�Ӱɴ�ý Confidential Hotline
855-251-5719

alaska.ethicspoint.com

Again, thank you for your time and let me know if you have any questions.

00:05

I'm here with Bridget Ballou and Jesse Benton to discuss protection minors at the University. As you walk around campus you likely have noticed the growing number of students under the age of 18 in class, in Residence Life, and in other Student Activities. "Protection of Minors" is a set of policies and measures aimed at keeping individuals under 18 safe and secure when they're on our campuses. Such policies reflect the institution's commitment to maintaining a secure and supportive space for all members of the campus community.

00:42

Three key things university employees need to know about minors attending the university are:

1. Some university employees involved in the protection of minor processes are "mandated reporters." The list of included employees is sent in Statue set by the state, which may change over time.

However everyone is encouraged to report whether they are a mandatory reporter or not. Mandatory reporters must submit a report to the state of Alaska's Office of Children's Services within 24 hours a reasonable cause to respect that a child has suffered harm as a result of abuse or neglect. This includes reporting requirements and follow-up investigation after the event has taken place, as well as here at �Ӱɴ�ý, we report all concerns to the Equity and Compliance Office.

1. Training and certification. Certain work teams and departments that frequently interact with minors, such as admissions teams assisting minors regularly, should provide staff with appropriate training and certification to handle situations involving minors effectively and responsibly.

1. Employees need to start the Protection of Minors process at least 30 days prior to a minor event taking place on campus. Give yourself and your team or department plenty of time, because the process can involve multiple employees, work teams, background checks, and collaboration with external partners. 

2:08

Employees should be aware that certain activities involving minors may require heightened levels of supervision and additional mitigation processes. These could lead to different procedures, potential timeline delays, and the need for specific authorizations.

Decisions on such activities may be based on risk assessments, staffing considerations, equipment requirements or insurance coverage, among other factors. When volunteers and protection of minors activities are combined, there are additional procedures and authorizations that are needed.

These could involve risk management assessments, Title IX training, waivers and more, to ensure the safety and well-being of minors involved. As a best practice to protect both employees and minors, avoid being isolated or alone with a minor at any time. If such situations are unavoidable, employees should take steps to ensure the safety of both parties. For assistance in developing action plans for such scenarios, employees can reach out to their Protection of Minor’s contact.

The upcoming new protection of minors policy will require a minimum of two supervising adults to be present at every event involving minors, although there will be some exceptions.

Documentation and the retention of all records is vital to meet all the laws related to protection of minors.

3:31

If you see something of concern please make a report to the Office of Children's Services and notify your Protection of Minors contact. 

If you have ideas for future compliance chats please send them to ua-compliance@alaska.edu.

04.56

Hello, I'm Mary Gower, and today I'm joined by Mitzi Anderson from �Ӱɴ�ýS, Sara Childress from �Ӱɴ�ýA, and Kaydee Van Flein from �Ӱɴ�ýF to talk about Title IX protections here at the university. 

Title IX is foundational for ensuring equal rights in education, preventing sexual harassment, and combating sex-based discrimination. It provides essential safeguards and procedures to address misconduct in educational settings.

Title IX also includes provisions for pregnancy protections. This, and other federal and state laws, ensure that pregnant students and employees have access to necessary accommodations and support to continue their work or education. The staff that support this work at �Ӱɴ�ý play a pivotal role in upholding a safe and inclusive campus environment through their efforts to prevent discrimination and harassment.

Mitzi, my first question is for you. Let's say a coworker tells me that they are being sexually harassed. What do I tell them about how to make a report? Also, what happens after a report is made?

01:03

If the coworker believes they’ve experienced discrimination, they can report the incident online through the equity and compliance website. They can also report in person or over the phone to the Title IX Coordinator or their staff, or make an anonymous report through the �Ӱɴ�ý confidential hotline. These resources will be shared later in this Chat. Also, a reminder that most university employees are considered responsible employees. This means that, with few exceptions, University employees must report any incidents of sexual misconduct they become aware of to the Title IX coordinator or other designee within 24 hours of becoming aware.

This is because the university is required to address any incidents of sexual misconduct about which a responsible employee knew or should have known. When reporting under Title IX, the process usually follows these steps. First, supportive measures are offered to the impacted individuals and additional information may be collected. If it appears that a policy violation may have occurred, the individual may choose to file a formal complaint and the University will then proceed with an investigation. This includes notifying parties involved that an investigation is being initiated, explaining their role in the process and that of others, such as advisors, and offering supportive measures and other resources throughout the entire process.

02:25

Following an investigation, if an informal resolution cannot be reached, a hearing with the opportunity for cross-examination will occur. Once a determination has been made on whether policy was violated, and after any appeals have concluded, the University will identify remedial efforts. If a violation is found, the university must stop the discrimination, work to prevent it from happening again, and remedy the effects of the discrimination, which can include sanctions. Sanctions for a respondent employee found responsible for discrimination range from a written reprimand, disciplinary probation, suspension without pay,and up to termination for cause, following university policy.

03:10

Thanks Mitzi. Sara, what's different about Title IX now versus ten years ago?

03:17

Well, compared to a decade ago, our current landscape is a significant contrast in awareness, process and action regarding Title IX-related  issues. We've seen frequent federal changes, 

prominent national cases, and influential social movements such as the #MeToo movement that have driven these issues to the forefront. Staying on top of these federal changes takes our departments' constant attention. We are consistently updating our processes and materials to align with the frequent federal regulation changes. Notably, in the past 10 years our universities have expanded their infrastructure, support and resources for the parties involved in sexual harassment and discrimination. 

Additionally, there is increased accountability for all aspects of Title IX processes. The updated regulations include specific requirements for how institutions must respond to Title IX complaints, placing a premium on ensuring a fair process for all parties involved. We've also intensified our focus on training. �Ӱɴ�ý Safe is a custom-designed training module developed in response to feedback from both our students and our employees to reflect Alaska's special needs. In addition to �Ӱɴ�ý Safe, TIX teams across the universities engage with critical stakeholders to create meaningful programming outside of the training module.

04:36

Thanks Sara. Kaydee, how can my department become a Title IX  partner?

04:41

Thanks so much Mary. There are specific steps the departments at our universities can take  to become Title IX partners. Departmental leadership can ensure that their team members complete �Ӱɴ�ý Safe training annually and also confirm their employees' knowledge of reporting Title IX concerns or incidents. It can be as simple as asking your teams how and when they would report to the Title IX office. Encourage your teams to connect with their respective TIX teams and ask questions about processes, how to help others report and what to expect. 

We're happy to attend staff meetings to talk about challenges employees are facing and how we as Title IX can be good partners to all of you. Departments can request bystander or green dot training to better understand the university's prevention and awareness programs, as well as understand how to recognize and safely intervene in potentially dangerous situations. They can also ensure all team members are familiar with an employee's pregnancy and childbirth rights to accommodations, which might include things like schedule adjustments, additional breaks, workstation modifications, and accessible parking. Finally, fostering a departmental culture that is inclusive, respectful, and free from discrimination and harassment is the best way to partner.

05:53

It's great to see colleagues leading by example and setting a standard for respectful behavior. Please reach our offices for opportunities to collaborate and ways you feel we can support you all in your respective teams. Thank you so much.

06:07

Thanks Mitzi, Sara and Kaydee. Everyone, thanks for joining us for this Compliance Chat, and if you see something of concern, please make a report.

For sex discrimination claims or other inquiries concerning the application of Title IX of the Education Amendments of 1972 and its implementing regulations, individuals may contact the University’s Title IX Coordinator, or the Assistant Secretary in the U.S. Department of Education Office of Civil Rights, or both:

�Ӱɴ�ýA Title IX Coordinator

3190 Alumni Drive, Suite 352

Anchorage, AK 99508

Phone: 907-786-0818

E-Mail: uaa_titleix@alaska.edu

Website:

�Ӱɴ�ýF Title IX Coordinator

1692 Tok Lane, 3rd Floor Constitution Hall

Fairbanks, AK 99775-6910

Phone: 907-474-7300

E-Mail: uaf-tix@alaska.edu 

�Ӱɴ�ýS Title IX Coordinator

11066 Auke Lake Way

Juneau, AK 99801

Phone: 907-796-6371

E-Mail: uas.titleix@alaska.edu

Office for Civil Rights, Seattle Office

U.S. Department of Education

915 Second Ave., Room 3310

Seattle, WA 98174-1099

Phone: 206-607-1600

TDD: 800-877-8339

E-mail: OCR.Seattle@ed.gov

Today I'm joined by the university registrars‚ Lindsay Chadwell, Trisha Lee and Holly McDonald, and we're going to be discussing FERPA. FERPA is the Family Educational Rights and Privacy Act, and it's a federal law that provides university students with access to their educational records. It also gives students a level of control over the disclosure of personally identifiable information from their student record. FERPA is a guardian of student privacy, mandating that universities and educational institutions uphold the confidentiality and accuracy of the student record.

00:41

I expect that most of the people that are joining us on this Chat want to know what requirements they need to follow to ensure compliance with FERPA regulations when they're handling student records and information. 

To ensure compliance with FERPA regulations when handling student records and information, university employees should:

1) Limit access to student records to school officials with a legitimate educational interest. This means university employees who need access to a student's records to perform their professional duties related to the student's education.

2) Obtain a FERPA release form from students before releasing personally identifiable information to anyone unless an exception under FERPA applies. And I'll explain some of those exceptions in a moment. It's important to note that FERPA does not acknowledge verbal consent, so obtaining the students permission in writing before releasing any information is critical.

3) Complete the university's FERPA training annually in the My�Ӱɴ�ý learning library.

4) Ensure student records and information are always secure. We can lock our computer before we step away; don't print student records unless absolutely necessary; and if you do, keep them secure in a locked cabinet or office and flip them upside down if someone enters your workspace.

02:10

When employees transition out of a role, ensure their access to student records and information is removed promptly. Delete drives, documents, etc. containing student information after the business need has been met. And remember FERPA applies to our work environments at home too.

There are situations, as I mentioned, where records may be released without the student's consent, such as when transferring to another school, complying with a judicial order or a subpoena, and in health and safety emergencies. The university can also disclose directory information without the student's consent unless they have enabled a directory hold in �Ӱɴ�ýOnline. It's best to discuss these situations with your university registrar before releasing information to ensure you're complying with FERPA.

03:00

Trisha, as students under 18 are increasingly enrolling here at the university, what do employees need to understand regarding FERPA with minors?

In this situation parents do not automatically have rights to access their student’s educational records under FERPA as they did in high school. At the university, those rights are granted to the student only, regardless of their age. This can be a tough learning curve for parents, so keep this in mind when working with them.

FERPA considers students who have reached the age of 18, or who attend college, as eligible students. This means that even if a student is under 18, the student has control over who can access their educational records. Lindsay mentioned the FERPA release form. Signing a FERPA release is the most efficient way for any student to allow their parent or another designated person to discuss their student records with the university.

Also, employees should complete FERPA training annually to become and remain familiar with the requirements. Employees can access FERPA training in the My�Ӱɴ�ý learning library. Simply search for FERPA. Also it's good to know that FERPA coverage begins on the first day of a student's first class, regardless of age.

04:20

Holly can you help us understand how FERPA applies in the following situations? For example, what if a professor asks students to peer review each other's work, which includes sharing you know grades and feedback? Or what about when a faculty member is asked to write a letter of recommendation and that includes details from a student's academic record?

When a professor asks students to peer review each other's work, including sharing grades and feedback, FERPA considerations come into play. Under FERPA, grades and feedback provided by students in the course of peer review are typically considered to be part of the instructional process, and are not treated as educational records until they are reported by the instructor.

However, professors should be mindful of student privacy and ensure that the peer review process does not involve the disclosure of grades or feedback in a manner that would be considered harmful or an invasion of privacy. Best practices include anonymizing the work where possible, or obtaining written student consent for sharing grades and feedback among peers.

05:27

Regarding the question of letters of recommendation, when faculty members are asked to write letters of recommendations that include details from the student's academic time with us, FERPA does require that they obtain written consent from the student. This is because letters of recommendation that reference specific grades GPA or other educational records are disclosing protected information under FERPA.

The written consent should specify what records are to be disclosed, the purpose for the disclosure, and to whom the disclosure can be made. Your university may have a release form available specifically designed for letters of recommendation, so chat with your University register first.

As always, Lindsay, Trisha and I are here to help. Students, faculty and staff are encouraged to contact us with any questions or concerns regarding FERPA.

�Ӱɴ�ýA https://www.uaa.alaska.edu/students/registrar/ferpa.cshtml

�Ӱɴ�ýF https://www.uaf.edu/reg/ferpa.php

�Ӱɴ�ýS https://uas.alaska.edu/registrar/academic-records/ferpa.html

  

Everyone thanks for joining this Compliance Chat and if you have any further questions please reach out to your university registrar.

00:04

Today I'm joined by Raina Collins, Senior IT risk and compliance analyst at the University of Alaska System Office of Information Technology to talk about data security and privacy.

In our positions here at the University there are so many of us that are handling sensitive information, and data security and privacy are really critical issues. And many of us have a large digital footprint. By footprint, I'm referring to all of the documents, emails, videos, images and also our transaction records.Having this large digital footprint heightens our vulnerability to data breaches, which can result in identity theft, financial harm and damage to the University's reputation.

When I'm thinking about the compliance concerns here, these include, legal, regulatory obligations surrounding the data handling, storage, and retention. Managing this extensive data and controlling access is really challenging.

Raina, so many employees viewing this video have a large data footprint with the university, including years worth of emails and stored documents, knowing that this presents an exposure risk to the university. How do you suggest going about trimming back that risk?

01:19

I'd suggest starting with identifying the contents of the data that you have. Data can consist of emails, photos, videos, documents, spreadsheets and all kinds of unique file types. There's also a difference between working documents and documents for retention. Hint: emails are considered working documents.

• Working documents are actively used during day-to-day operations. They serve as tools for collaboration, decision-making, and ongoing task management.

• Documents for retention are retained for legal, operational or historical reasons. They're not actively used in daily work but are preserved for compliance, reference or recordkeeping. �Ӱɴ�ý OIT is currently working to develop tools and resources to help people identify the kind of data they have, so stay tuned.

Also there's one caveat: although �Ӱɴ�ý emails are regarded for document retention as "working documents", they are retained indefinitely through Google, and in that sense, are closer to retention documents.

This is why it's important to know the content of your data.

Now that we know what the data is, let's discuss location. Throughout �Ӱɴ�ý, data can be stored in our Google workspace environment, Microsoft 365, department file sharers, Onbase or other dedicated data repositories.

So now that we've defined the what, and the where, let's discuss how much.

In many cases, the systems mentioned above have seemingly limitless capacity for storage, which can contribute to years worth of data and documents being stored.

As you noted already, this creates an extensive footprint. Our recommendation is to really look at what kind of data you produce, evaluate its sensitivity, then determine if you have to keep it for regulatory purposes or if it's just a nice to have. For things that you must keep for retention reasons, you can work with the OIT Records and Information Management office to help you determine where to keep them. For things that are for your own convenience or departmental record keeping, you should save it in a secure location that is appropriate for the type of data that it is.

Let's look at permissions more closely. Google Drive and Microsoft 0365 are designed to allow for easy sharing of data both internally with our co-workers, and externally with our stakeholders. This helps create efficiency in our work products, and allows us to collaborate worldwide. However the possibility of oversharing creates many kinds of cyber-security vulnerabilities.

There are many Federal requirements in place to protect �Ӱɴ�ý data, and in support of them, we recommend you do a routine audit of your storage locations. Look at who those files are shared with, and then remove access where appropriate. Delete files that you no longer need, or find them a secure and permanent home. This type of review should always be done after employees leave or if they transfer outside of your department. But if this doesn't happen often, then at least annually.

04:05

Looking at the security of the data, in what instances are University employees expected to be, encrypting their emails, and using secure file transfer for their documents? Also, how do we go about that?

Wherever there's a need to send protected sensitive or private data, users should employ added encryption to keep their messages secure. �Ӱɴ�ý users can leverage our large and secure file transfer service at securefiles.alaska.edu which allows �Ӱɴ�ý account holders to exchange secure emails within �Ӱɴ�ý or with external stakeholders. We do not recommend sending secure, private or sensitive email messages via Gmail or Outlook.

Also to note, sometimes the best way to protect sensitive information is to avoid the temptation to put it in your keyboard in the first place. Rather than sending an email then deleting it, pick up the phone. Take care to not write anything in an email that you're not ready to read in a newspaper. And on that topic, consider the use of �Ӱɴ�ý emails for personal business. While it is generally allowable under regent's policy, it's not always the best idea. �Ӱɴ�ý emails are subject to public records requests, and unless there's a statutory shield that protects them, they may have to get delivered into the hands of a third party. It isn't precluded to use �Ӱɴ�ý for emails for personal reasons, but it may not be the best practice overall.

05:26

Do you have any pointers for supervisors to help implement solid access controls, to limit who can access the sensitive information? For example, to ensure that employees only have access to the data that they need for performing their duties for the university? Also what can supervisors do to make sure that access is removed as their employees transfer to different departments or leave the university?

Absolutely. Supervisors can establish solid access controls, as I mentioned earlier, by establishing departmental policies that outline how their department will manage their data.It'll identify the roles surrounding data management and conducting regular reviews of access permissions, thereby aligning them with their employees' specific roles and responsibilities. That way they're ensuring that their employees are only accessing the data that is required for their job tasks.

They can also develop departmental policy on onboarding and offboarding, which creates a systematic process for granting and revoking access when employees first join or when they transition to other departments, or if they leave the university entirely. We would suggest as part of the departmental policy to set up a schedule -- such as every 12 months -- to review these permissions even if they are still employed, because this would capture any role changes within the department.

06:44

In closing, we cannot really over-stress how important it is to really understand what data you're generating.

For instance the music department data is going to be completely different from research data, however they both might both deal with student related data. So if you're understanding what you're managing and the requirements of that data, is critical to managing data access wisely.

If you need further assistance including individualized help please contact OIT Security Operations at ua-oit-security@alaska.edu or visit OIT's website.

I'm joined by Bill Anker, executive director of strategic programs at the University of Alaska system Office for information technology.

00:13

We're discussing social engineering using AI.
 
In recent headlines Forbes declared that AI is revolutionizing social engineering and likened generative AI to "social engineering on steroids." AI's use of automation and stealthy techniques dramatically raises the stakes of cyber security.

00:34

What used to amount to a peppering of emails with some clumsy grammar and misspelled words, now is really sophisticated.

It feels like we're entering into an alternative reality where you just don't know what's fake and what's real.

00:47

It’s a real problem. We're now living in the intersection of AI and social engineering and that's dangerous territory.

For example, threat actors can now create flawless, convincing messages in perfect English using tools like chat GPT that makes detecting fraudulent messages really challenging.

01:04

There are also voice mimicking and phone-based attacks. As many of you know, AI tools can generate lifelike spoken words that mimic specific individuals. This capability opens the door to phone calls that can convincingly imitate anyone, such as the head of finance, a chancellor or the university president. Threat actors generally use a two-pronged approach. They start with credible emails and follow that by voice calls, adding a layer of deception to social engineering attacks.

01:30

That's troubling. I know that in addition to email and voice attacks, picture and video can also be AI generated. Are these so-called deep fakes a concern for the university?

01:41

Absolutely. You may have seen deep fakes in the news recently. For example, as recently as this past February, a finance worker paid out more than $25 million in response to fake video requests from someone impersonating the Chief Financial Officer of the company.

Concern about election year deep fakes is in the news quite a bit and is leading to the introduction of AI related legislation to combat attempts to mislead voters during the 2024 election.

AI can be used to create deep fakes using pictures, video, and audio footage found in the public space. And with that they can pretty easily make completely realistic fake videos and fake virtual identities.

02:18

What are the big risks related to social engineering using AI for the University?

With AI's hyper-speed ability to analyze an employee's digital behavior, scams can take on an unsettling personalization, increasing the likelihood of successfully tricking our employees into providing access or sharing private information.

02:36

Beyond social engineering AI also accelerates the detection of vulnerabilities in systems, potentially leading to rapid breaches even before staff recognize a threat.

AI tools can autonomously probe defenses,learn from mistakes, distribute malware and extract sensitive data often bypassing traditional security alarms. Adaptive AI-powered malware can dynamically create real-time countermeasures against the university's defenses resulting in more prolonged and disruptive attacks.

03:03

What are some countermeasures that we can take against AI fueled attacks?

This can be broken down into three main strategies. First, training our users to detect social engineering. Second, implementing improved authentication. And third, deploying AI based security controls.

Employee awareness and vigilance is by far the most powerful tool in our arsenal. The use of multi-factor authentication can reduce account compromises by up to 99%.

And finally, AI-based defenses can react and adapt to attacks in real time dramatically speeding up our response times. �Ӱɴ�ý is already implementing the first two and is currently investigating the third.

03:38

Remember there is always time to verify the authenticity of a request. If you have any doubts, aren't expecting this type of communication, or aren't sure if you should proceed, reach out to the requester directly, using an alternate communication method.

For urgent matters contact your local service desk and if you need further assistance including individualized help do not hesitate to contact OIT security operations at ua-oit-security@alaska.edu or visit OIT's website.

04:07

Thanks Bill. I'm impressed with the work that you and the entire OIT team are doing on behalf of the university to protect our online security.

Everyone thanks for joining this compliance chat. If you have any further questions, please feel free to contact OIT security operations.

0:04

Hello I'm Mary Gower and today I'm joined by Sean Hagan, University of Alaska system’s Chief Information Security Officer and Aaron Menshouse, �Ӱɴ�ýF's Export Control/Research Security Officer, to discuss the secure usage of smartphones and laptops during travel. We'll explore key strategies to safeguard your device and data while on the move.

Sean, first let's take a look at traveling in the United States. When I travel for work I always bring my laptop with me. What about the physical security of the laptop? For example on days where I don't need it at the conference, do I just lock it in the hotel safe?

0:38

First, only bring what you absolutely need. Try to minimize the number of devices and the amount of data that you carry with you while traveling.

You may wish to consider using a loaner laptop or even going so far as getting a temporary cell phone, especially if you're traveling overseas. Aaron will discuss traveling abroad further in a minute. Other things you can do: store your data in the cloud and not on your laptop, or you might store it on a secure USB stick, and we have those available for checkout from the IT units.

Before departure ensure your device is well prepared by updating the software. You may wish to set a temporary password that you would change when you return from your travels. You will want to review Wi-Fi or bluetooth settings to make sure that the device will not automatically connect to unknown or untrusted wireless networks.

1:26

Always maintain physical possession of your devices while traveling, and you may wish to avoid using public Wi-Fi unless you're certain that the wireless network is trustworthy. Instead you could rely on a secure Wi-Fi hotspot from your cell phone. Or you may be able to check out, or rent, a portable hotspot device. You can also use the �Ӱɴ�ý VPN while you're traveling for added security.

If you plan to work on �Ӱɴ�ý data while you're traveling, consider whether sensitive data may be visible to people -- say while you're crunched up in an airplane seat working on an airplane, or if you're in a lounge or hotel conference area or something like that. If you intend to work in those environments, or think you might, you may wish to purchase a screen protector which can make it harder for others to "shoulder surf" or view sensitive information on your screen behind you.

2:16

For international trips it's essential to contact your Export Control Representative in all cases before travel commences. This ensures compliance with regulations, and addresses any specific considerations related to foreign travel and those you may meet while you're on travel status. Contact information for these professionals can be found on the website following this video. If your device is lost or stolen during travel take immediate action. Report the incident to law enforcement and if you're traveling abroad the nearest U.S. Embassy.

If your device is �Ӱɴ�ý owned or managed, or if it has any �Ӱɴ�ý data potentially involved, please promptly report the loss or theft to the �Ӱɴ�ý Information Security and Assurance team so that we can do necessary followup and mitigation work as needed. Contact information for our group can also be found after this video.

3:05

Aaron, Sean shared a couple of tips for international travel. What other considerations are there about device security when traveling internationally for the university?

3:13

Additional cybersecurity considerations come into play. Firstly acquaint yourself with the specific regulations of the host country, which may differ from domestic standards. OIT can assist you with how to do this.

Be cautious of potential internet access restrictions and bolster data security with a VPN for encrypted connection. Internationally, prioritize device security by implementing robust measures like strong password encryption and multi-factor authentication. Stay vigilant about physical device security utilizing locks or secure bags to deter theft.

3:46

When accessing public Wi-Fi ensure a secure connection using a trusted VPN. Be aware of potential device inspections at borders and comply with local regulations. Sean mentioned using a loaner laptop from the university or a temporary burner device for international trips. You can get the loaner laptop from OIT. Prepaid cell phones and international SIM cards can be purchased for use of temporary devices at local retailers.

Familiarize yourself with the university's emergency response plan for international travel knowing whom to contact in the event of the cybersecurity incident. You can access it using the link below. Lastly, keep IT support informed of your travel plan.

4:24

As we travel on behalf of the university it introduces new dimensions to online physical security. To mitigate these risks effectively it's crucial for us to stay informed and implement proactive measures as outlined here. 

If you have further questions, please contact:

• �Ӱɴ�ýF Export Control: Aaron Menshouse, acmenshouse@alaska.edu, (907) 474-7832
• �Ӱɴ�ýA Export Control: George Kamberov, gkamberov@alaska.edu, (907) 786-5472
• Information Security and Assurance (ISA), oit-security@alaska.edu, (907) 450-8300

00:12

I’m here with Jeanette Okinczyc the manager of Security Operations for the University of Alaska system OIT. Today we’ll discuss the realm of phishing attacks; exploring essential strategies to detect and counteract these cyber threats.

00:20

How to recognize phishing attempts:

When it comes to identifying phishing attempts it’s crucial to understand that phishing succeeds because we’re human beings, and that we are all at risk for becoming victims of a cyber attack. My advice is for people to know that they can always take the time to verify, trust their gut instincts, and when something doesn't seem right, pause and reconsider.

Phishing preys on our vulnerabilities, but by being proactive and cautious, we can significantly reduce the risk of falling victim to these deceptive tactics. If you suspect a phishing attempt, please mark it as phishing in the Google interface. This sends a message to the security operations team so they can assess whether the circumstances warrant warning other employees to be on the lookout for parallel attempts. And if you’re not a Google user, please forward the email to ua-phishing@alaska.edu. 

01:51

Motives behind phishing attempts:

Let’s explore the aim of phishing attempts. Phishing has diverse objectives including stealing sensitive information, financial gain, and gaining unauthorized system access. Recognizing these motivations is crucial for better protection.

Phishing aims to steal sensitive information, enticing individuals to disclose personal details. This requires a cyber security culture emphasizing security measures, user education, and constant vigilance. Financial gain is another motivation prompting caution when faced with requests for financial information. Strengthening financial cyber security defenses is vital.

Phishing also targets unauthorized system access, demanding a comprehensive defense strategy with regular updates, robust password policies, and employee training. Understanding these motives helps tailor defenses fostering resilience against cyber threats.

2:57

Examples of various phishing methods:

Phishing is not limited to just email, it can manifest through phone calls, text messages and other channels. For instance deceptive emails may contain malicious links or attachments, and phone calls can be impersonations of trusted entities, and text messages might attempt to trick you into divulging sensitive information. Being aware of these methods empowers our employees here at the University to stay vigilant across different communication channels.

Phishing is a pervasive threat that exploits human tendencies. By stressing verification, intuition and caution, we can thwart phishing. Stay informed, be proactive, and we can reduce the risk of falling victim to these cyber threats.

Feel free to contact OIT Security Operations at 907-450-8900 for more information.

00:03

Hello everyone I’m Mary Gower. Today we’re joined by Kaitlyn Malloy, �Ӱɴ�ý Security Analyst at the University of Alaska system, Office of Information Technology to discuss password security.

Exploring password security is more than just creating easy-to-remember passwords, especially now that the era of using something like "123456" is far behind us.

As we recognize the growing sophistication of hackers, including their use of AI, it's essential that we understand what truly makes a password strong and secure. This is even more urgent and concerning with so much personal identity information ending up on the dark web.

Kaitlyn, how does all this impact our approach to crafting passwords, and could you provide key tips to ensure our information remains as secure as possible?

00:16

Yes, this is really important. When it comes to creating passwords, it's more than just picking any old combination of letters and numbers. We need to think about what makes a password really strong and safe.

Recently, hackers have become more adept and are leveraging advanced technology to infiltrate various systems. Here at the university, these systems contain valuable data such as research findings, student records, and intellectual property. Hackers use artificial intelligence to exploit weaknesses in security protocols and gain unauthorized access. 

And, as you mentioned, this can also be a big worry personally because our own identity information can end up on the dark web.

So, let's talk about a couple of tips to keep your information safer.

The length of your password is crucial. While a 12-letter password may seem lengthy, it might not be sufficient to deter hackers. Aim for longer passwords, ideally 14 characters or more, for enhanced security. 

Additionally, incorporate symbols like exclamation points or hashtags to add a layer of protection. For instance, a 12-character password using only letters is quickly crackable, but a 14-character password incorporating numbers, symbols, uppercase, and lowercase letters is currently estimated to take millions of years to crack. Integrate a special character within the password itself, such as replacing an A with the @ sign, or a zero for an O.

Be unique. Yes, it is absolutely a security risk to use the same password for all your accounts. Never reuse a password, even if it has been unused for some time. And, I know most of us have done this, but just adding a new number to an old password is not sufficient. 

02:33

Three key ways passwords get hacked are by credential stuffing, dictionary attack and by brute force.

In credential stuffing, an attacker takes login credentials obtained from a breached account and tries the same email and password combination across various accounts and websites. This technique is particularly potent because many individuals reuse passwords, and if one password is leaked in a data breach, it can be exploited across multiple platforms. This is why it is SO important to not reuse the same password.

In the next way, brute-force uses a program to systematically try different combinations of letters, numbers, and symbols at a much faster rate than a human could ever manually attempt. A hacker can test up to 100 billion potential passwords per second. If your password is simple or commonly used, it is likely to get hacked.

Next, and similar to brute-forcing but more intelligent, a dictionary attack checks words from dictionaries, company names, sports teams, and other common terms. This method allows hackers to crack passwords even more rapidly by leveraging known words and phrases.

03:39

Change your passwords at least every six months and consider using a password manager like Keeper or other available options to help encrypt, store, and manage your passwords. More information on password managers is available at the OIT website /securitymatters/training/password_managers.php.

03:51

If you need further assistance, including individualized help, contact the Office of Information Technology (OIT) Security using the provided contact number (907-450-8900) or visit the OIT’s website /oit/.

00:03

Hello everyone, I'm Mary Gower and today I'm joined by Joshua Craft at the University of Alaska system office of Information Technology. Josh is a security analyst. So today we're going to be talking about social engineering and we'll have a follow-up chat where we talk about social engineering using artificial intelligence. In a nutshell social engineering is using psychological tactics to manipulate people.

In an information security context, social engineering is the use of deception and or manipulation intended to essentially cause a person to divulge information they normally wouldn't -- and it's usually used for fraudulent purposes. So unlike a cyber attack, bad actors gain the trust of their targets so they give up that personal information.Imagine now at the University we have a researcher -- let's call him Greg -- who routinely communicates online with colleagues. And a hacker will target Greg and meticulously research his communication patterns.

Then posing as an IT support specialist this hacker begins to send three seemingly legitimate emails over the span of a couple of weeks. These emails discuss routine system updates, software patches, upcoming security measures, and project work. Each message is crafted to mirror the University's communication style. So what this does, is it makes it challenging to discern any malicious intent. After establishing a sense of familiarity and trust with Greg, the hacker sends a fourth email this time containing a link that appears to be a program specifically associated with Greg's research. Trusting the routine nature of the communication Greg clicks on the link redirecting him to a convincing but fake login page where he enters his credentials and unbeknownst to Greg his username and password are now in the hands of the hacker.

02:23

Another common scenario takes advantage of certain events or transitions for setting up an attack -- like at tax time or when employees are first starting a job. For example, a hacker carefully monitors departments within the university, pinpointing recently hired employees in financial aid for example. After identifying the targets the hacker sifts through all this information about their recent office events, gathered from the campus newsletters, student newspapers or even the office's Facebook account. The hacker then will craft a personalized phishing email posing as a human resource employee. The email prompts the new employee to click on a link for university onboarding training -- however that link actually leads to a phishing site designed to capture these log-in credentials allowing the hacker to gain unauthorized access to the new employee's sensitive financial aid data.

03:40

To prevent this from happening, start with being skeptical. Always approach unexpected emails, 

messages or calls with caution. Verify the identity of the sender through established and trusted communication channels before sharing sensitive information or clicking on links. If you're ever in question, reach out to that colleague. Send them an email, make a phone call, verify maybe they did or did not send those suspicious messages.

Additional counter measures could include training employees on recognizing phishing attempts and implementing Two Factor Authentication -- also known as TFA -- to add an extra layer of security beyond just the password.

Keep tabs on what's happening in security awareness and take training to learn to recognize and respond appropriately to social engineering attempts. You can check out the cybersecurity trainings at my�Ӱɴ�ý. The simplest way to locate them is to search “data security” once you've logged in to my�Ӱɴ�ý.

04:44

The best resource for learning the latest about all of these kinds of changes in the landscape are usually cybersecurity news articles. The principles of social engineering do not necessarily change through time -- it's their core kind of inner workings to hack the human psychology and get users to divulge information by exploiting them. There's a really great article called “Social engineering: definition, examples, and techniques”; on an online resource named CSO that I recommend looking up. It talks about many different elements of social engineering and examples as well.

For urgent matters, contact your local service desk. If you need further assistance including individualized help contact the Office of Information Technology Security at ua-oit-security@alaska.edu or visit the OIT's website.