Welcome to Cyber Awareness Month!
Throughout Cyber Awareness Month, the Goose will guide us through a series of cybersecurity lessons inspired by life in the gaggle. Anyone who has encountered a nesting goose knows how seriously they take protecting their home, their young, and their community. Who better to guide us through building a safer Waterloo digital home than one of campus's most dedicated protectors?
Tip 1: Secure Your Digital Environment at Waterloo and Beyond
This week, the Goose focuses on the nest. A secure home doesn't happen by accident. Geese carefully build their nests, protect what matters most, and maintain them throughout the season. Our digital homes require the same approach through the three Ds of a Secure Nest: Security by Design, Security in Depth, and Security Detailing.
Security by design
Consider the risks first
Before building a nest, a goose evaluates its surroundings. Although many of us have encountered a goose nesting in a location that seems completely impractical, geese don't choose their nests at random. They prefer locations where they can see potential threats coming and protect what matters most. Security starts long before the first twig is placed.
The same principle applies at the University of Waterloo. Before introducing a new application, AI tool, service, or process that will access University information, consider the risks first. What information will it collect? Where will that information be stored? Who will have access to it? At Waterloo, if a tool will access restricted, highly restricted, or personal information, additional review may be required. If you're unsure how information is classified, refer to Waterloo's Information Confidentiality Classification Guidance. For initiatives involving these types of information, Information Risk Assessments (IRAs) and Privacy Impact Assessments (PIAs) help identify and address risks before implementation.
The same mindset applies beyond Waterloo. Before signing up for a new online service, mobile app, or AI tool, review the privacy practices and consider whether the service really needs access to your contacts, photos, location, or other personal information. The Office of the Privacy Commissioner of Canada provides guidance on protecting your privacy online. A few minutes of research before adopting a new tool can help prevent privacy and security issues later.
Cybersecurity works the same way. Whether you're protecting your WatIAM account, a University service, or a personal account beyond Waterloo, no single security control can protect everything.
Start with strong, unique passwords. Waterloo's Password Standard recommends passwords of at least 15 characters for WatIAM accounts. Consider using a memorable passphrase, such as Cobra*Chickens!, rather than a shorter password, and avoid reusing passwords across multiple services. Password managers can help generate and securely store unique credentials for your WatIAM account, University services that do not use single sign-on (SSO), and your personal accounts. Once you've set up a password manager, consider removing passwords saved in browsers, notes, spreadsheets, or other locations that may not provide the same level of protection.
Add another layer with two-factor authentication (2FA). WatIAM accounts are protected by Duo 2FA, which can also be used to secure many personal accounts. Whether at Waterloo or beyond, enable 2FA wherever it is available and choose the strongest authentication method offered. App-based authenticators, security keys and passkeys generally provide stronger protection than email or text message (SMS) verification. Never share your passwords, 2FA codes, or authentication approvals with anyone.
Finally, protect the device itself. Device encryption provides yet another layer of protection by helping safeguard information if a laptop, phone, or storage device is lost or stolen, whether that device is University-managed or personally owned.
Security in depth
No single security control can protect everything
A goose doesn't build a nest from a single twig. Nests are constructed using grasses, reeds, moss, twigs, and down feathers, with each layer contributing to the strength and protection of the nest. While each material serves a different purpose, together they create a safer nest than any one material could provide on its own.
Security detailing
Updates often address vulnerabilities before they can be exploited
Building a nest is only the beginning. Throughout the season, geese repair damage, replace worn materials, remove debris, and deal with pests before they become a larger problem.
Whether you're using a University-managed or personal device, keeping software up to date is one of the simplest and most effective ways to maintain a healthy digital environment. Apply operating system, browser, application, and mobile device updates promptly, including optional security updates when recommended. These updates often address vulnerabilities before they can be exploited.
Behind the scenes, University-managed workstations and servers are also monitored using vulnerability management tools such as Tenable, which help identify systems that may require updates or remediation. Together, vulnerability management and timely patching help keep Waterloo systems healthy and secure.
Just as geese remove debris from their nests, periodically review applications and online accounts you no longer use. Removing unnecessary software and closing dormant accounts reduces your digital footprint and eliminates opportunities for attackers to exploit forgotten accounts.
And then there are the pests. A goose would never ignore signs that insects or other unwelcome visitors had moved into its nest. Malware behaves much the same way. Left unchecked, malicious software can spread, steal information, disrupt work, or provide attackers with access to systems.
To help detect and respond to these threats, University-managed devices use SentinelOne Endpoint Detection and Response (EDR) technology, which helps identify suspicious activity and malicious behaviour. For personally managed devices, consider using one of Waterloo's recommended endpoint security products for home use, pay attention to security warnings, and investigate unusual activity as soon as it is detected.
The Goose's Secure Digital Environment Checklist
Security by Design
-
Understand the risks before introducing a new tool, application, or AI service.
-
Complete an IRA or PIA when required.
Security in Depth
-
Use long (15+ characters), unique passphrases for your accounts.
-
Set up a password manager.
-
Enable 2FA and use the strongest method possible.
-
Enable device encryption.
Security Detailing
-
Install operating system, application, browser, and mobile device updates promptly.
-
Use a reputable endpoint protection for Waterloo and personal devices.
-
Remove applications and close accounts you no longer use.
