This message was sent to all University of Washington (UW) students, faculty and staff and UW Medicine employees.
Husky Community,
October is National Cybersecurity Awareness Month. As cyber threats continue to evolve, this month is a good time to revisit the practices that help protect both your personal information and the University of Washington’s institutional data.
Artificial intelligence (AI) is transforming cybersecurity for both defenders and attackers. Adversaries increasingly use AI to identify vulnerabilities, create convincing phishing messages, automate attacks, and evade traditional security controls. Strong cybersecurity habits are more important than ever.
UW continues to invest in technologies and services that strengthen our security posture, but cybersecurity remains a shared responsibility. An informed and vigilant community is one of our most effective defenses.
This month and throughout the year, we encourage you to follow these practices to help safeguard the information entrusted to us.
Phishing remains one of the most common ways attackers gain access to accounts and data. These attacks may rely on social engineering, using urgency, curiosity, fear, or trust to persuade people to take actions they normally wouldn’t. AI is making phishing messages more professional, convincing and free of the spelling and grammatical errors that once made scams easier to spot.
Be particularly cautious of:
- Messages creating a sense of urgency or requesting immediate action
- Requests for passwords, multi-factor authentication (MFA) codes, or personal information
- Messages claiming to be from a trusted colleague, supervisor, vendor, or organization and asking you to bypass normal procedures
- Unsolicited job offers or employment opportunities
- Giveaways, prizes, or gift card offers
Verify unexpected messages before clicking links, opening attachments or sharing information.
CAPTCHAs help keep websites and accounts safe by distinguishing humans from bots. They may ask you to type distorted characters or identify objects in images. Security teams are seeing more “ClickFix” attacks that use fake CAPTCHAs, browser extensions, software updates and error messages to trick users into running malicious commands.
If a website or pop-up instructs you to:
- Press keyboard shortcuts such as Windows + R,
- Open Terminal on a Mac or Command Prompt on Windows,
- Copy and paste commands into a system window, or
- Perform unusual steps to “verify” your identity or “fix” a problem,
Stop immediately. These actions are never part of a legitimate CAPTCHA and may install malware or give attackers access to your device. If a CAPTCHA asks for these, report it immediately to UW Medicine Information Technology Services (ITS) Security or help@uw.edu.
Attackers routinely use automated tools to test stolen credentials across multiple services. Reusing passwords can allow a single compromised account to lead to many others.
To help protect your accounts:
- Never use your UW NetID password for another service
- Use long, unique passwords for every account
- Enable multi-factor authentication (MFA) whenever it is available
- Be cautious of websites that unexpectedly prompt you to enter MFA codes
MFA remains one of the most effective security controls, but attackers increasingly attempt to steal credentials and authentication codes through phishing campaigns. Staying alert is essential.
Security updates protect against known vulnerabilities that attackers actively exploit. As adversaries increasingly use AI to identify and exploit weaknesses, timely patching is more important than ever.
Regularly install updates for:
- Operating systems
- Web browsers
- Mobile devices
- Applications and productivity software
If you manage University-owned systems, patch them promptly according to UW and departmental guidance.
University-owned devices should use approved security controls to detect and respond to threats. For UW-owned computers, ensure that CrowdStrike Falcon Endpoint Detection and Response (EDR) is installed and functioning properly. CrowdStrike Falcon helps identify suspicious activity and provides an additional layer of protection against emerging threats.
For personal devices, make sure your antivirus is updated and running, whether it’s built-in or an add-on product. Keeping operating systems updated helps ensure built-in antivirus protections work effectively.
When working on campus, from home or other remote locations, use the following tools for a secure connection:
- eduroam: Use this free, encrypted Wi-Fi network wherever you are on campus
- Husky OnNet VPN: Protect your home network when accessing UW resources remotely
- UW Medicine (UWM log in required): Securely connect to the UW Medicine VPN to access business resources remotely
Secure your home networks by keeping your router updated, accepting firmware updates, and using complex passwords.
- Use UW devices and systems when working with UW information
- Physically protect devices from theft or inappropriate access
- Don’t share your devices with family members
- Encourage family members and roommates to practice safe online habits
- Review privacy and security settings on social media accounts to minimize unwanted access or exposure
Report suspicious activity
If you see something suspicious, report it. Whether it’s an unexpected email, unusual account activity, a suspicious website or a potential security incident, timely reporting helps our security teams respond before broader harm occurs.
If something doesn’t seem right, trust your instincts and contact help@uw.edu.
The UW community plays a key role in protecting UW against cyber threats. Thank you for reporting suspicious incidents and for being cyber aware.
David McMorries
UW Chief Information Security Officer
Information Security
UW Information Technology
Augie D’Agostino
UW Medicine Chief Information Security Officer
Information Technology Services
UW Medicine