Increased Cybersecurity Threat from Russian State-Sponsored Actors

Please be aware of the increased risk of malicious cybersecurity activity targeted at higher education institutions in recent weeks as a result of the increased geo-political tensions between Russian, Ukraine and Ukraine’s western allies (including Canada).

Below you will find the measures Queen’s has in place to protect against such threats, and the actions you can take to further minimize risk. 

Measures Queen’s has in place

Queen’s works in partnership with national cybersecurity groups such as the Canadian Centre for Cyber Security (CCCS) and the Canadian Shared Security Operations Centre (CanSSOC) to stay fully informed about emerging cybersecurity threats, to ensure we are proactively applying best practices, and to take recommended actions against specific threats to minimise our threat exposure and to be able to respond effectively to attacks. 

The volume of suspicious traffic from Russia has increased significantly over the past two weeks. In addition to existing cyber controls, IT Services, in collaboration with other IT units at Queen’s, has taken proactive steps to protect against this new threat; for example, a number of Russian IP addresses confirmed as malicious have been blocked at our perimeter. 

Actions you can take to minimize risk

In order for Queen’s defenses to be as effective as possible, there are also steps that you as a community member should take: 

• Enrol your work device in the endpoint protection program. This secures endpoint devices (e.g., desktops, laptops, mobile devices) from being exploited by malicious actors and campaigns, and ensures that only healthy devices connect to the Queen’s network to access data and applications. 
• Take Queen’s Cybersecurity Education and Awareness Course.
• Stay vigilant against phishing and social engineering attacks (i.e, tricking users into making security mistakes). You can refer to this infographic on how to identify a phishing email for guidance. 

Additional information

• Canadian Centre for Cyber Security (CCCS): 
  • [2022-01-20] https://cyber.gc.ca/en/guidance/cyber-threat-bulletin-cyber-centre-urges-canadian-critical-infrastructure-operators-raise
     
• US Cybersecurity and Infrastructure Agency (CISA): 
  • [2022-01-11] https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
     
• Media: 
  • [2022-01-24] https://globalnews.ca/news/8533835/global-affairs-hit-with-significant-multi-day-disruption-to-it-networks-sources
  • [2022-01-24] https://abcnews.go.com/Politics/dhs-warns-russian-cyberattack-us-responds-ukraine-invasion/story?id=82441727

 
If you have security concerns or would like assistance with any of the recommended actions, contact the IT Support Centre by calling 613-533-6666 or by visiting the online Service Portal and clicking on Get IT Help (log in with your NetID and password to fill out the form). 
 
Cybersecurity is everyone’s responsibility, please take the necessary steps to protect your intellectual property, Queen’s systems and data, from this active threat.

Thank you for your prompt action.
Nancy Ross Vice-Principal (Research) 

Marie-Claude Arguin Chief Information Officer and Associate Vice-Principal (Information Technology Services)