Go to main content | Go to main menu

Cybersecurity minimum for Masaryk University Employees

Welcome to the support website for the Cybersecurity basics training for MUNI employees. The training is available on a voluntary basis to selected faculties of Masaryk University in IS MU. If you are interested in accessing the training, please contact vzdelavani@csirt.muni.cz.

On this page you will find a summary of additional materials and links to guides that will enable you to implement the recommendations and measures we have selected.

The training has been developed in relation to the obligations arising from Act No. 181/2014 on Cyber Security and Directive No. 10/2017, Use of Information Technology. However, theoretical knowledge and passing the test in IS MU is not enough to increase your level of cybersecurity and it is necessary that you actively invest your time in increasing your level of cybersecurity. This page is designed as a collection of links, to the topics covered in the actual IS MU training.

If you would like to refresh your theoretical knowledge as well, download the text support in PDF.

For each of the topics covered, the most important recommendations, related links, and tutorials are summarized below to help you successfully complete the individual tasks.

Passwords

Takeaways

  • Your primary and secondary passwords should be different and you should not use them on other sites and services
  • Create and use phrase passwords
  • Use a password manager, trust him with your passwords, he will take care of managing them and creating new ones
  • Do not store passwords directly in the browser
  • Never share your passwords, never pass on shared passwords (e.g. for systems) in open form
  • Have unique passwords for important systems (IS, INET, e-banking) and definitely don't use them for less important services and sites such as e-shops and social networks

Relevant Resources

  • You can read about the differences between primary and secondary passwords at it.muni.cz
  • Our article about password managers
  • Bitwarden password manager
  • The Bitwarden extension for your browser can be downloaded here.
  • KeepassXC password manager - an alternative to Bitwarden, but rather for more advanced users

Tasks

  • My primary and secondary MU passwords are different and I don't use them elsewhere
    • You can change these passwords in IS MU.
  • I have a password manager installed and I use it, its master passphrase password is unique

Multi-Factor Authentication

Takeaways

  • Use multi-factor authentication at least for key services (IS, INET, e-banking)
  • To increase security when using one-time authentication codes (TOTP), disable the display of message previews on the lock screen of your mobile device.
  • If possible, prefer a security key over a one-time code
  • Use a password manager

Relevant Resources

Tasks

  • I have activated multi-factor authentication for IS, INET and university M365
  • I use multi-factor authentication for at least three other services
    • You are definitely fulfilled for your e-banking, other suitable services are e.g. social networks (Facebook, Instagram, X)

Device Security

Takeaways

  • Do not leave your devices unattended or lend them to other people
  • Set a screen lock not only on your mobile devices, but also on your computer. PIN is the minimum, biometrics (fingerprint, face scan) are even better
  • Don't use gesture screen unlocking on mobile devices
  • When installing apps, check what they require access to and don't delay updates; the same applies to browser extensions
  • Use antivirus on Windows, macOS and Android devices

Tasks

  • I have screen lock set up on both my mobile devices and my computer 
  • My system and all applications are up to date, I have automatic updates enabled in the operating system settings
  • I have an antivirus program installed on Windows/macOS (or I have Linux ;)
  • I have checked what accesses are requested by at least three apps on my phone

Data Handling

Takeaways

  • Use only university-provided storage for work data
  • Set up sharing conservatively, only to authorized individuals
  • Never share confidential or sensitive documents through public repositories
  • Establish the "golden rule" of 3-2-1 backups
  • Set up backups of work files to OneDrive, personal data to Google Drive or iCloud
  • Activate disk encryption on your computers

Relevant Resources

Tasks

  • My work files are only on the university's OneDrive/Sharepoint or one of the university-provided storage sites, not private (Dropbox, personal Google Drive)
    • OneDrive is primarily personal storage, useful also for backups.
    • SharePoint is suitable for sharing documents with the team members or across the organization
  • For at least one week, I have consistently focused on setting up file sharing only with relevant people
  • I have set up regular backups of work or personal data (preferably both)
  • I have disk encryption activated on my computer (BitLocker, FileValut or similar solution)

Secure Communication

Takeaways

  • Communicate work-related matters exclusively through university communication channels
    • Do not forward work mail to personal emails, if you have this forwarding activated cancel it.
    • Do not share work-related information on personal communication platforms (Messanger, WhatsApp, etc.) or on your social networks
  • Use personal certificates at least in work email communications
  • If you are connecting from unknown and open networks (without a password), use a VPN

Relevant Resources

  • Information about personal certificates at MU
  • Information about VPN at MU
  • If possible, use Eduroam wi-fi; you can find it at many other schools, universities, institutions around Europe and even at some railway stations in Czechia ;)

Tasks

Phishing

Takeaways

  • Instead of sending attachments, share links to files located on the university repository
  • Be consistent in checking the sender's address and links
  • Do not open unknown or suspicious attachments; if you are unsure of the authenticity, contact the originator of the message through another channel
  • It is a good idea to use a VPN on unfamiliar networks. The university offers VPN free of charge. Using it will allow you to access services that are only available on the university network

Relevant Resources

Tasks

  • I tried to detect phishing emails on Phishing Quiz by CSIRT-MU
  • For at least one week, I have consistently focused on checking the sender's address and links when reading emails
    • Look for apparent typos (v/u, i/l, m/n) or mixed up letter order
    • Try to be more sensitive to psychological manipulations such as time or emotional pressure, unexpected behaviour and demands, suspiciously advantageous (even unrealistic offers) or other extreme insistence.

Incident Reporting

Takeaways

  • Do not hesitate to report suspicious messages
    If you need advice or consultation on cyber security issues, CSIRT-MU team members are here to help.

Relevant Resources

Tasks

  • I have reported at least one phishing email, either by clicking directly in the mail client or by forwarding it to csirt@muni.cz.

Final Remarks

In today's digital world, a basic understanding of cybersecurity is an essential piece of equipment for everyone. We simply have no choice if we do not want to expose ourselves to unnecessary risk and the threat of data loss. No technical measure is 100% and so it is always necessary to proactively go the extra mile for your security. Whether it's one-off measures like activating disk encryption or a carefully built habit of checking email addresses.

As you may have noticed, even with just a few precautionary steps, you can achieve "small victories" and increase your level of cybersecurity with relative ease. We hope this training has helped you and that you have increased your own level of cybersecurity. After all, it's your data too...

You are running an old browser version. We recommend updating your browser to its latest version.

More info