IT Security

Passwordless authentication using passkeys provides a more secure and convenient way to access your Okanagan College account without relying on traditional passwords. 

A passkey is a secure credential stored on your device that lets you sign in using biometrics, a PIN, or a trusted app. Enabling this significantly reduces the risk of account compromise by removing the need to enter a password, thereby minimizing the likelihood of it being intercepted, stolen, or misused.

Okanagan College currently supports passkeys through the Microsoft Authenticator app and FIDO2 security keys, providing a simple and efficient way to get started with passwordless authentication in just a few minutes.

Set Up Passwordless Authentication with a Passkey

1. Go to: https://aka.ms/mysecurityinfo
2. Sign in using your Okanagan College credentials.
3. Select Add sign-in method.
4. Choose a passkey-enabled option such as Passkey in Microsoft Authenticator or Security Key.
5. Follow the prompts to complete setup on your device.
6. Set your new method as your default sign-in option.

For more information related to passkeys, please read our "Passwordless Authentication Using Passkeys" article.

Ensure that your personal devices like laptops, smartphones, and tablets are secure. Here's how:

• Updates: keep your operating system and applications updated to protect against known vulnerabilities.
• Antivirus software: use antivirus software and enable automatic updates.
• Lock your devices: lock your devices when not in use.
• Password protection: use strong, unique passwords for your devices and accounts. Consider using a password manager to keep track of your passwords.
• Apps & downloads: only install apps and download files from trusted sources to avoid malicious software.

Phishing is a type of online scam where criminals send an email that appears to be from a legitimate company and ask you to provide sensitive information. This is usually done by including a link that will appear to take you to the company's website to fill in your information – but the website is a clever fake and the information you provide goes straight to the crooks behind the scam. Phishing emails are a common method used by cybercriminals to steal sensitive information. Here are ways to recognize phishing emails and how to protect yourself.

Recognizing phishing emails:

• Unsolicited emails: be wary of unsolicited emails, especially those asking for personal information or urging immediate action.
• Poor grammar and misspellings: look for signs of phishing such as poor grammar, misspellings, and unofficial email addresses.
• Check the sender's email address: make sure the email is from a legitimate source.
• Urgent action required: phishing emails often try to create a sense of urgency or demand immediate action. The goal is to get you to click on a link and provide personal information — Right Now!
• Generic greetings: phishing emails are usually sent in large batches. To save time, Internet criminals use generic names like "Hi Student" or "Hi Professor" so they don't have to type out names. Be skeptical of such emails.
• Fake links: always check where a link is going before you click on it. You can hover over a link with your mouse to see the actual URL.
• Emails that ask for personal information: legitimate companies will never ask for personal credentials via email.

Protecting yourself:

• Don't click on links in an email unless you are sure of the sender.
• Update your computer's anti-virus software regularly.
• Never give out personal information over email.
• Contact the company directly if you are unsure.

For more information on how to protect yourself from phishing please view our "A Friendly Guide to Outsmarting Cyber Baddies: Phishing, Smishing, and Vishing" and "IT Security: Simulated Phishing Email Campaigns" articles.

Multi-Factor Authentication (MFA) is a security measure that requires multiple types of credentials for user authentication. It significantly enhances the security of your accounts by requiring at least two forms of identification: 

• Something You Know: this could be a password, a PIN, or answers to secret questions.
• Something You Have: this could be a physical device like a phone or a hardware token.
• Something You Are: this includes biometrics like fingerprints, facial recognition, or iris scans.

Here's how you can use MFA: 

• Enable MFA: most online services offer MFA. Check the security settings of your accounts and enable MFA where available.
• Use authenticator apps: authenticator apps generate time-based one-time passwords (TOTP) for MFA. They are more secure than SMS-based codes.
• Backup codes: when you enable MFA, you'll often get backup codes. Save these in a secure place. They'll help you access your account if you lose your second factor.

Remember, no security measure is perfect, but using MFA makes it significantly harder for cybercriminals to access your accounts. It's one of the most effective ways to protect against unauthorized access and safeguard your data and Okanagan College's digital assets.

Want to learn more about MFA and how it applies to your OC account? Checkout our full "Multi-Factor Authentication (MFA)" article.

Always connect to secure networks when accessing Okanagan College's resources. Here's what you can do:

• Avoid public Wi-Fi: avoid using public Wi-Fi for activities that require sensitive information.
• eduroam: Okanagan College is part of eduroam. Use it! It's a secure, worldwide roaming access service for the research and education community.
• VPN: consider using a virtual private network (VPN) for an added layer of security.
• HTTPS: when browsing, look for the padlock symbol in your browser and "https://" in the URL. This indicates that your connection to the website is encrypted.

In the era of digital connectivity, working remotely has become a common practice. However, it's crucial to ensure the security of your home network. Here are some steps you can take:

• Change default passwords: your router comes with a default password set by the manufacturer. Changing this to a strong, unique password adds an extra layer of security to your home network.
• Enable WPA3 encryption: Wi-Fi Protected Access 3 (WPA3) is the latest and most secure encryption standard for wireless networks. Enabling this on your home network ensures that your data is encrypted and less vulnerable to hackers.
• Physical security: while digital security is important, don't overlook physical security. Keep your devices in a secure location to protect them from theft or unauthorized access.

Learn more security tips about working remotely by viewing our full "How To Stay Secure While Working Remotely" article.

When you're on campus, it's equally important to be vigilant about protecting sensitive information. Here's what you can do:

• Lock your workstation: it's easy to step away from your desk for a moment, but remember to lock your workstation. This simple action can prevent unauthorized access to your computer.
• Be cautious about shoulder surfing: "shoulder surfing" refers to someone looking over your shoulder to see what's on your screen. Be aware of your surroundings and dispose of sensitive information properly.

Traveling can pose additional risks to the security of your devices and data. Here are some precautions you can take:

• Avoid public charging stations: public charging stations can be compromised with "juice jacking", where malware is installed on your device or data is stolen through the USB port. Use your own charger whenever possible.
• Use a VPN: a Virtual Private Network (VPN) encrypts your internet connection, making it safer to use public Wi-Fi networks.
• Keep your devices with you: never leave your devices unattended in public places. Keeping them with you at all times reduces the risk of theft or tampering.