The University experienced a number of phishing attacks this summer, some of which compromised some employees’ personal information in HRMS. To better protect the University from such attacks, University IT will introduce two new security measures in October.

Phishing Email Protection

On Wednesday, October 2, University IT will launch a new service called Proofpoint Targeted Attack Protection to better protect most University email systems from phishing attacks. This will supplement the existing PureMessage spam filtering service.

In emails from external email addresses to University email addresses, Proofpoint will rewrite suspicious hyperlinks to clarify where links are actually directed. When recipients click a rewritten link, they will be redirected to Proofpoint, which will evaluate the security of the linked site. If Proofpoint determines it to be safe, recipients will be redirected automatically to the linked site. Users may notice a 1-2 second delay for the webpage to load as Proofpoint scans it first. If Proofpoint determines the site to be malicious, recipients will be notified that the site has been blocked.

This phase of the Proofpoint implementation will not change the current spam filtering process. In the near future, Proofpoint will replace PureMessage as the University’s spam filtering service. University IT anticipates that this transition will reduce the number of spam messages delivered to University inboxes.

Alternative Secure Access to HRMS

To protect personal information stored in Human Resources Management System (HRMS), starting in July, users outside the University network were required to use a Virtual Private Network (VPN) to access HRMS. Starting Thursday, October 3, employees can enter their NetID and employee ID number as an alternative to using VPN when logging in from off-site.

After entering their NetID and password, employees will see a new page requesting three random digits of their employee ID. They will then have three attempts to enter the correct digits. After three incorrect attempts, the account will be locked for one hour. Employees that do not know their employee ID can retrieve it by logging in to HRMS from the University network or through VPN.

Please contact the IT Help Desk at 275-2000 or univithelp@rochester.edu with any questions.