Data Privacy Week is a reminder that protecting personal and university data isn\u2019t just IT\u2019s responsibility\u2014it\u2019s something we all do every day. Universities handle sensitive information like student records, financial aid, research data, and HR info. Small actions, like clicking a link or approving a login prompt, can put that information\u2014and your peers\u2019\u2014at risk.<\/p>\n
Below, we break down practical ways to protect your data<\/strong>, explain why they matter, and give you actionable steps.<\/p>\n Strong passwords and proper account security are your first line of defense. Even a single reused password can allow attackers to access multiple accounts.<\/p>\n Why it matters:<\/strong> Do:<\/strong><\/p>\n Use strong, unique passwords<\/strong> for all campus and personal accounts. Consider a password manager if you have trouble remembering them.<\/p>\n<\/li>\n Enable Duo Verified Push<\/strong> instead of phone or SMS. Verified Push requires you to confirm a number on your screen, which prevents MFA fatigue attacks.<\/p>\n<\/li>\n Lock devices when unattended and log out of shared computers.<\/p>\n<\/li>\n<\/ul>\n Don\u2019t:<\/strong><\/p>\n Reuse passwords<\/strong> across multiple accounts.<\/p>\n<\/li>\n Approve Duo prompts you didn\u2019t initiate<\/strong>.<\/p>\n<\/li>\n Share passwords<\/strong> with anyone\u2014even a friend or coworker.<\/p>\n<\/li>\n<\/ul>\n Example:<\/strong> Attackers often manipulate people rather than systems. Emails, text messages, and fake notifications can look official and urgent.<\/p>\n Why it matters:<\/strong> Do:<\/strong><\/p>\n Pause before clicking links or downloading attachments. Hover over links to verify destinations.<\/p>\n<\/li>\n Use the Phish Alert Button (PAB)<\/strong> to report suspicious emails\u2014it sends them directly to Information Security.<\/p>\n<\/li>\n Verify unexpected requests via a trusted method, like a known phone number or official campus portal.<\/p>\n<\/li>\n<\/ul>\n Don\u2019t:<\/strong><\/p>\n Reply to messages asking for personal info or credentials.<\/p>\n<\/li>\n Approve logins you didn\u2019t start.<\/p>\n<\/li>\n Assume a familiar name or department guarantees a message is safe.<\/p>\n<\/li>\n<\/ul>\n Examples to watch for:<\/strong><\/p>\n Fake DocuSign or eSignature requests with generic greetings.<\/p>\n<\/li>\n Account expiration warnings that create urgency.<\/p>\n<\/li>\n HR or payroll messages that ask you to confirm personal info.<\/p>\n<\/li>\n<\/ul>\n Information shared publicly online can help attackers craft convincing scams.<\/p>\n Why it matters:<\/strong> Do:<\/strong><\/p>\n Regularly review privacy settings on all social media accounts.<\/p>\n<\/li>\n Limit sharing schedules, roles, or location details online.<\/p>\n<\/li>\n Pause and think before posting personal information about yourself or others.<\/p>\n<\/li>\n<\/ul>\n Don\u2019t:<\/strong><\/p>\n Post sensitive details that could help attackers guess passwords or security questions.<\/p>\n<\/li>\n Accept connection requests from unknown people who ask for personal information.<\/p>\n<\/li>\n<\/ul>\n Tip:<\/strong> Small, routine actions can add up to big risks if not managed carefully.<\/p>\n Why it matters:<\/strong> Do:<\/strong><\/p>\n Keep devices, browsers, and apps up to date.<\/p>\n<\/li>\n Review app permissions and revoke unnecessary access.<\/p>\n<\/li>\n Double-check before sharing sensitive info or clicking \u201cAllow.\u201d<\/p>\n<\/li>\n<\/ul>\n Don\u2019t:<\/strong><\/p>\n Forward sensitive info via email unless necessary.<\/p>\n<\/li>\n Ignore repeated or unexpected login notifications.<\/p>\n<\/li>\n<\/ul>\n Data privacy isn\u2019t a one-week event\u2014it\u2019s an ongoing practice.<\/p>\n Do:<\/strong><\/p>\n Follow the Phish Files<\/strong> for real examples and tips.<\/p>\n<\/li>\n Follow IT Instagram<\/strong> for alerts and reminders.<\/p>\n<\/li>\n Report suspicious activity using the Phish Alert Button (PAB)<\/strong>.<\/p>\n<\/li>\n<\/ul>\n Don\u2019t:<\/strong><\/p>\n Assume protecting data is only IT\u2019s job.<\/p>\n<\/li>\n Delay taking action on suspicious messages.<\/p>\n<\/li>\n<\/ul>\n Bottom Line:<\/strong> National Cybersecurity Alliance | Data Privacy Week<\/a><\/p>\n National Cybersecurity Alliance | Data Privacy Week Webinars<\/a><\/p>\n NordVPN | National Privacy Test<\/a><\/p>\n White & Case | New Jersey Enacts Comprehensive Data Privacy Law<\/a><\/p>\n
\nPasswords and Account Security<\/strong><\/h2>\n
Reusing passwords or approving an unverified Duo prompt can let attackers access email, cloud storage, and personal accounts\u2014sometimes without you realizing it until it\u2019s too late.<\/p>\n\n
\n
Last semester, a Montclair community member accidentally approved a phone-based Duo request that came from an attacker trying to log into their email. Switching to Verified Push could have prevented it.<\/p>\n
\nPhishing and Social Engineering<\/strong><\/h2>\n
A single click on a phishing link can compromise your account, exposing sensitive student, research, or HR data. These attacks are often targeted using information pulled from social media or publicly available sources.<\/p>\n\n
\n
\n
\nSocial Media and Oversharing<\/strong><\/h2>\n
Attackers gather data from profiles, posts, or event calendars to impersonate people or organizations. Oversharing can make phishing attacks appear legitimate.<\/p>\n\n
\n
Even seemingly harmless posts, like class schedules or club leadership info, can be used by scammers to make phishing emails more convincing.<\/p>\n
\nEveryday Digital Habits<\/strong><\/h2>\n
Lost devices, outdated software, or accidental oversharing can create vulnerabilities that attackers exploit\u2014often without the victim realizing.<\/p>\n\n
\n
\nStay Informed and Engage<\/strong><\/h2>\n
\n
\n
\n
Data privacy is a shared responsibility. Small, thoughtful actions\u2014like using Verified Push, reporting suspicious emails, and practicing password hygiene\u2014protect not only your data but the entire campus community.<\/p>\nWant to Know More?<\/h2>\n