HONK! Welcome back to Cyber Awareness Month!
Last week, the Goose taught us how to build a secure digital home through security by design, in depth, and detailing. This week, the Goose is back with another lesson from the flock: the importance of a campus watch!
Tip 2: Campus Watch | Stay alert, PAUSE, and honk for the flock!
Every spring, members of the University of Waterloo community become familiar with another well-known goose behaviour: vigilance. Whether protecting a nest, grazing with the flock, or watching over goslings, geese are constantly aware of what is happening around them. A strong digital community works the same way. Cybersecurity is more than individual security habits. It depends on all of us staying alert, recognizing threats, and helping protect the broader Waterloo community.
Stay alert
Most attempts rely on the tactics of impersonation, deception, or pressure.
Geese don't watch for just one type of threat. They stay aware of anything unusual that could put the flock at risk. While phishing remains one of the most common threats facing the Waterloo community, modern attacks often use AI, reference real Waterloo systems, and may even come from compromised University accounts.
- Impersonation: Attackers pretend to be a trusted person or entity.
- A message appears to come from Workday, Quest, LEARN, Microsoft 365, or another University service.
- A Business Email Compromise (BEC) message appears to come from a colleague, manager, instructor, researcher, Dean, or Department Chair.
- AI-generated audio, video, or messages impersonating real people.
- Emails, phone calls, or text messages claiming to be from law enforcement, immigration services, or the Canada Revenue Agency (CRA).
- Deception: Attackers trick you into giving away information or access.
- Fake WatIAM login pages designed to steal credentials or Duo verification codes.
- Text messages and phone calls claiming to be from technology support, financial institutions, delivery companies, employers, or government agencies.
- Phony receipts for services you supposedly purchased, sent via email or text message, encouraging you to call or email to discuss the charge.
- Pressure: Attackers try to rush your decision-making.
- Urgent requests to approve a Duo 2FA login.
- Messages claiming your account will be suspended.
- Requests to purchase gift cards, transfer funds, or bypass normal processes.
A vigilant goose doesn't react to every movement immediately. It watches, assesses the situation, and decides whether a threat is present. The same principle applies when you receive an unexpected email, message, attachment, login request, or financial request. Use the PAUSE framework:
- P – Pause: Take a breath and interrupt the urge to react immediately. A message demanding immediate action is often trying to influence your decision-making.
- A – Awareness: Pay attention to how the message makes you feel. Does it create urgency, fear, excitement, or pressure? Emotional reactions can be warning signs that someone is trying to manipulate you.
- U – Unpack the Message: Look beyond the request. Is the sender legitimate, does the request make sense, and are you being asked to do something unusual, urgent, or outside your normal role?
- S – Select the Next Step: Decide how to respond. Verify through a trusted channel, navigate to a known website, seek a second opinion, or choose not to proceed. Don't let the attacker decide your next step.
- E – Escalate: Report suspicious emails, scams, fraud, or account compromises to the Security Operations Centre (SOC) or appropriate organization immediately. Early reporting protects both you and others who may be affected.
PAUSE before you act
Before clicking, replying, downloading, or approving access, use the PAUSE framework.
HONK for the flock
Early reporting helps contain the problem and protect others.
One of the most recognizable things about geese is how they communicate. When a goose detects danger, it honks, alerts nearby geese, and helps protect the flock.
Reporting suspicious emails, unexpected Duo prompts, unusual account activity, fake WatIAM login pages, or other security concerns helps protect the Waterloo community in the same way. A threat reported by one person may prevent many others from being affected.
If something seems suspicious, report it to the Security Operations Centre (SOC). Whenever possible, submit phishing messages as an attached email, so investigators can review the original message and technical details.
Whether or not you clicked the link, opened the attachment, entered information, or approved a login request, report it anyway.
The Goose's Campus Watch Action Plan
- Learn how to defend against phishing at Waterloo.
- Practice the PAUSE framework before responding to unexpected requests.
- Save the SOC contact information so you know where to report concerns.
- Report suspicious emails, Duo prompts, or account activity when you encounter them.
- Learn how to submit suspicious emails as attachments.
- If you think you've made a mistake, report it anyway!
Want to learn more about Canada's most secure campus residents?
Tip 1: Secure Your Digital Environment at Waterloo and Beyond
This week, the Goose focuses on the nest. A secure home doesn't happen by accident. Geese carefully build their nests, protect what matters most, and maintain them throughout the season. Our digital homes require the same approach through the three Ds of a Secure Nest: Security by Design, Security in Depth, and Security Detailing.
Security by design
Consider the risks first
Before building a nest, a goose evaluates its surroundings. Although many of us have encountered a goose nesting in a location that seems completely impractical, geese don't choose their nests at random. They prefer locations where they can see potential threats coming and protect what matters most. Security starts long before the first twig is placed.
The same principle applies at the University of Waterloo. Before introducing a new application, AI tool, service, or process that will access University information, consider the risks first. What information will it collect? Where will that information be stored? Who will have access to it? At Waterloo, if a tool will access restricted, highly restricted, or personal information, additional review may be required. If you're unsure how information is classified, refer to Waterloo's Information Confidentiality Classification Guidance. For initiatives involving these types of information, Information Risk Assessments (IRAs) and Privacy Impact Assessments (PIAs) help identify and address risks before implementation.
The same mindset applies beyond Waterloo. Before signing up for a new online service, mobile app, or AI tool, review the privacy practices and consider whether the service really needs access to your contacts, photos, location, or other personal information. The Office of the Privacy Commissioner of Canada provides guidance on protecting your privacy online. A few minutes of research before adopting a new tool can help prevent privacy and security issues later.
Cybersecurity works the same way. Whether you're protecting your WatIAM account, a University service, or a personal account beyond Waterloo, no single security control can protect everything.
Start with strong, unique passwords. Waterloo's Password Standard recommends passwords of at least 15 characters for WatIAM accounts. Consider using a memorable passphrase, such as Cobra*Chickens!, rather than a shorter password, and avoid reusing passwords across multiple services. Password managers can help generate and securely store unique credentials for your WatIAM account, University services that do not use single sign-on (SSO), and your personal accounts. Once you've set up a password manager, consider removing passwords saved in browsers, notes, spreadsheets, or other locations that may not provide the same level of protection.
Add another layer with two-factor authentication (2FA). WatIAM accounts are protected by Duo 2FA, which can also be used to secure many personal accounts. Whether at Waterloo or beyond, enable 2FA wherever it is available and choose the strongest authentication method offered. App-based authenticators, security keys and passkeys generally provide stronger protection than email or text message (SMS) verification. Never share your passwords, 2FA codes, or authentication approvals with anyone.
Finally, protect the device itself. Device encryption provides yet another layer of protection by helping safeguard information if a laptop, phone, or storage device is lost or stolen, whether that device is University-managed or personally owned.
Security in depth
No single security control can protect everything
A goose doesn't build a nest from a single twig. Nests are constructed using grasses, reeds, moss, twigs, and down feathers, with each layer contributing to the strength and protection of the nest. While each material serves a different purpose, together they create a safer nest than any one material could provide on its own.
Security detailing
Updates often address vulnerabilities before they can be exploited
Building a nest is only the beginning. Throughout the season, geese repair damage, replace worn materials, remove debris, and deal with pests before they become a larger problem.
Whether you're using a University-managed or personal device, keeping software up to date is one of the simplest and most effective ways to maintain a healthy digital environment. Apply operating system, browser, application, and mobile device updates promptly, including optional security updates when recommended. These updates often address vulnerabilities before they can be exploited.
Behind the scenes, University-managed workstations and servers are also monitored using vulnerability management tools such as Tenable, which help identify systems that may require updates or remediation. Together, vulnerability management and timely patching help keep Waterloo systems healthy and secure.
Just as geese remove debris from their nests, periodically review applications and online accounts you no longer use. Removing unnecessary software and closing dormant accounts reduces your digital footprint and eliminates opportunities for attackers to exploit forgotten accounts.
And then there are the pests. A goose would never ignore signs that insects or other unwelcome visitors had moved into its nest. Malware behaves much the same way. Left unchecked, malicious software can spread, steal information, disrupt work, or provide attackers with access to systems.
To help detect and respond to these threats, University-managed devices use SentinelOne Endpoint Detection and Response (EDR) technology, which helps identify suspicious activity and malicious behaviour. For personally managed devices, consider using one of Waterloo's recommended endpoint security products for home use, pay attention to security warnings, and investigate unusual activity as soon as it is detected.
The Goose's Secure Digital Environment Checklist
Security by Design
-
Understand the risks before introducing a new tool, application, or AI service.
-
Complete an IRA or PIA when required.
Security in Depth
-
Use long (15+ characters), unique passphrases for your accounts.
-
Set up a password manager.
-
Enable 2FA and use the strongest method possible.
-
Enable device encryption.
Security Detailing
-
Install operating system, application, browser, and mobile device updates promptly.
-
Use a reputable endpoint protection for Waterloo and personal devices.
-
Remove applications and close accounts you no longer use.