FAQs

Please check out our phishing awareness page on how to report incidents and protect yourself from phishing attacks.

In general, it is safe to click the "unsubscribe link" from known and reputable senders. However, remain cautious when encountering unknown sources since they might be phishing attempts. When in doubt, mark the email as spam.

Configure the mail filtering options of your CWRU email system to mark unwanted emails as spam. Stay cautious when sharing your email address and read the privacy policies of websites and forms when you provide your email.

In general, QR codes are safe but they can be misused. Always check for signs of tampering and avoid scanning codes that seem out of place. Be cautious of QR codes that lead to login pages or request your personal information.

Yes, but follow best practices for security:

• Use different user accounts for personal and university work
• Store university data in approved, secure cloud services
• Ensure your personal device has updated antivirus software and a strong firewall
• Never leave your device unattended in public places

To protect university data and ensure accountability, manual password sharing is never recommended and Multi-Factor Authentication (MFA) is encouraged for all accounts. The Information Security Office does not support or endorse the sharing of credentials under any circumstances.

What is the difference between a Shared and a Service account?

• Shared Accounts: An account where multiple people use the same login for a departmental function. Because credential sharing is discouraged, these accounts should only exist as delegated access (discussed below).
• Service Accounts: Non-human accounts used exclusively by applications, servers, or scripts to communicate with other systems (e.g., automated nightly data pulls).

If password sharing is prohibited, how do staff access a departmental inbox or system?

• University Email and Internal Systems: You must use delegated access through delegated accounts. [U]Tech will configure the inbox or system so authorized users can log in with their own personal credentials and personal MFA, then toggle to the shared resource.
• Third-Party Vendors and Websites: Departments must require vendors to provide individual, named accounts for each staff member. Sharing a single vendor credential across a team is a security violation.

What are the security requirements for Service Accounts?

• Designate a Sponsor: Every service account must have an active faculty or staff Sponsor who is responsible for authorizing access and maintaining the account.
• No Human Login: Service accounts should be blocked from interactive human login (e.g., web browsing).
• Enforce Least Privilege: Grant only the exact minimum permissions needed for the automated task.
• Restrict Access: Lock down service accounts to specific IP addresses or servers, and use API keys or authentication tokens instead of traditional passwords whenever possible.