SID – Information Security

Information security refers to the development and implementation of comprehensive strategies aimed at establishing and maintaining protection for all of an institution’s information. The focus here is on the institution’s processes, systems, applications and premises. A key factor for the university in this regard is, amongst other things, the so-called ‘IT Basic Protection’, as defined by the BSI (see also: Link). Unlike data protection, this primarily concerns the institution itself, whereas data protection focuses on individuals’ data. The two issues are, however, closely interlinked.

IT Grundschutz is a comprehensive set of standards, recommendations and guidance issued by the BSI (Federal Office for Information Security) to ensure information security in institutions and organisations, as set out in the IT Grundschutz Compendium (Link).

As well as the user’s general handling of hardware and software, the hardware level is likely to be the most fundamental starting point for any security strategy. Hardware should be replaced at regular intervals, particularly whilst it remains connected to the internet for operational purposes. The reason for this is security vulnerabilities, which inevitably come to light over time (e.g. Spectre and Meltdown). Whilst these vulnerabilities may be fixed in software, this can sometimes – particularly with older systems – result in significant, long-term performance losses. Furthermore, it may also be the case that the vulnerabilities need to be addressed at the BIOS level (i.e. a BIOS update usually has to be initiated manually), which means that, as a rule, manufacturers no longer provide such BIOS updates for older hardware, leaving it vulnerable. If, on the other hand, such a security vulnerability can only be fixed at the hardware level (i.e. a new product with a new ‘design’ must be created), then it is quite obvious that all current and older hardware is outdated in terms of security and should be replaced as soon as possible.

Generally speaking, however, a degree of judgement is required here too, depending on the severity of the vulnerability and how up-to-date the hardware is. Thus, it runs counter to a certain approach to sustainability to replace hardware that is only a few months old straight away – particularly in the case of a vulnerability that is extremely difficult to exploit. Conversely, in the case of a widely known and exploitable vulnerability, combined with an old device (e.g. >5 years), an upgrade is strongly recommended.

Generally speaking, the older a system is, the greater the likelihood that it contains known and widespread vulnerabilities. If a system is no longer covered by the manufacturer’s support period (BIOS updates, etc.), consideration should be given to replacing it.

After the BIOS/UEFI and the most basic firmware, the operating system (including Windows, macOS and Linux) is usually the lowest level of software. As with hardware, security gaps or vulnerabilities inevitably come to light here over time. Operating system updates should therefore be installed promptly to keep the operating system secure and up to date.

Videos from the BSI:

Fix security vulnerabilities with updates

Security updates

Just as there is malware, there is also software designed to track it down and neutralise it. This software, known as a virus scanner, is constantly evolving in a race against the development of malware. Hardly any other software is therefore more dependent on staying up to date.

Virus scanners are often already included as built-in programmes in the operating system (e.g. in Windows, the so-called Windows Defender). If the operating system does not include one, or if you do not wish to use it, you can also install a different virus scanner. These separately installed antivirus programmes are sometimes criticised because they interfere deeply with the system and exert a great deal of control over it, meaning that they may, under certain circumstances, impair the system’s functionality, in the event of poor programming, they may even damage the system itself, or – if there are vulnerabilities in the antivirus programme itself – they may exacerbate the effects of malware. However, such cases are considered rather unlikely with reputable providers.
Where an existing, built-in virus scanner is already in place, the installation of an additional virus scanner should be considered carefully, as this involves trusting yet another provider, as well as potentially introducing further people (programmers) as factors who may make – or have made – errors during operation (updates) and development of the antivirus programme. It is therefore advisable to weigh this up against the benefits one hopes to gain from it.

The provider generally plays a very significant role.
Not every piece of software labelled or described as a virus scanner is worthy of the name. Sometimes, it may even conceal malware! For this reason, you should only use virus scanners from reputable and well-known providers that have been tested by independent bodies. Further information on this is available from the BSI: Link.

As a general rule, it is strongly recommended that you have some form of antivirus software on your system (from a trusted provider!) – whether it is the built-in antivirus programme or one you have installed yourself.

Software (in this context, specifically application software) must, just like the operating system, be kept up to date at all times to avoid providing a target for attacks. This ranges from simple office programmes, through browsers (Chrome, Firefox, Safari) and email programmes, to software that interacts deeply with the system (e.g. virtualisation). Application software is handled differently by various operating systems. On Linux, for example, software is usually obtained from so-called package repositories and can then be updated all at once with just a few clicks. With Windows, on the other hand, you often have to check for updates yourself, either within the programme itself or by regularly checking the manufacturer’s website manually for the latest versions.

It is important to note that application software must also be updated regularly. Depending on the system and software, it is possible that the user will have to carry out this process entirely on their own, without the system prompting them to do so!

Videos from the BSI:

Fix security vulnerabilities with updates
Security updates
Using apps safely

Further links:

s-u-p-e-r.ch: How do I carry out an update?

E-mails (electronic mail) are electronic messages sent via the Internet. The messages are sent between two (or more) accounts, which in turn must be set up on a server (put simply: (virtual) hardware units with the relevant software, accessible via the internet). The email servers are set up and administered by various providers. Users who wish to send emails generally need an account with one of these email providers or on their server. (Note: Users are, of course, free to set up and run their own email server, although this involves a considerable amount of effort and expense). If a user wishes to send an email or check the emails received in their account, they must log in to their account on the email provider’s server. Access to this is generally possible from any internet-enabled device. Generally speaking, however, a screen and peripherals (mouse/keyboard) prove helpful, so the most common devices can be narrowed down to laptops, PCs and smartphones.

Important: EmailThey are generally not encrypted – without any manual intervention!
Confidential data should therefore not be sent via Emails to be dispatched!

Further information on this and on the principles of encrypted emails can be found on the BSI’s website: Link.

Under Phishing This refers to password theft carried out via emails that bear a striking resemblance to legitimate emails. The perpetrators send the victim emails specifically designed to mimic standard correspondence from, for example, a bank, an insurance company or an employer, and these typically contain requests for login details. These requests are usually phrased subtly and often involve external platforms. Common (simplified) Examples are:

• "Click on this link to update your bank details ..."
• "Please call this telephone number if you do not agree with the following debit ..."
• "Your account has been deactivated. To reactivate it, please send your current username and password ..."

Unfortunately, such messages are often successful, particularly because they incorporate genuine or very similar logos and, where applicable, sender addresses that appear legitimate in the preview.

The immediate or indirect disclosure of login details is not always the main issue here. Often, it is simply a matter of Interaction to trick the victim into reloading or executing further malware!
It is precisely in this context that Appendices and images, as well as formatting It makes a difference!

• Appendices To begin with, they simply contain files attached to the text message. Opening attachments automatically results in them being saved on the device. This also means that an attachment may contain any kind of malware or may itself be attached to a file (see the entry ‘Viruses’). As it is usually difficult to tell exactly what an attachment contains without opening it, the following rule applies: you should only open or save an attachment if the sender is known and absolutely trustworthy (here, the actual email sender’s address applies, not just the displayed name or preview)!
• Formatting (i.e. the type and appearance of the message text beyond the basic options, e.g. emojis, special paragraph formats, line breaks and much more) usually consist of what is known as HTML code. However, all sorts of other commands may also be hidden within this code, which can therefore make the system more vulnerable to malicious code, execute malicious code directly, or even constitute malicious code in their own right. Email clients such as Thunderbird offer the Option EmailDisplay this as plain text and thus prevent HTML code from being executed when the message is displayed.
• External elements and images: Pictures They may appear as an attachment (in which case, as explained above, they should be treated in the same way as any other attachment, as images can also contain viruses) or they may appear within the email itself. In this context, they may either form a direct part of the message or be included simply as a link. In the former case, it is also helpful here to use the ‘EmailShow as plain text" in your email programme, as this prevents any malicious code hidden within the image’s file structure from being executed.
  In the latter case (an image as a link within the text), this corresponds to what is known as the external elements. These refer to any type of content that is downloaded from an external server when an email is opened. Here, too, any kind of malware can be downloaded at the same time! To address this, the most common email clients also offer a Option to block this external content across the board, i.e. they will not be loaded.

Many antivirus programmes are capable of automatically scanning emails for malware. If you are unsure whether your antivirus programme supports this feature or whether it is enabled, please check its settings.
However, if you are experiencing problems sending or receiving emails, it may be that the feature has not been implemented correctly or is incompatible with the email software and provider you are using. In that case, we recommend changing your antivirus programme or even switching to a different email programme and/or provider.

Phishing emails, just like spam emails, are sent out in large numbers or automatically; however, in the case of phishing, their content and appearance are tailored to everyday situations (banks, insurance companies, etc.). As a result, the perpetrators always manage to target a certain number of victims simply by virtue of the sheer volume of emails sent. Spear Phishing refers to a highly targeted approach, tailored to a specifically chosen victim. Spam or junk On the other hand, it refers to the widespread, mass sending of emails that have hardly been customised and which generally contain advertising (often dubious and/or malicious). However, spam is also often used to test the legitimacy or validity of email addresses (belonging to the victims). You should therefore never reply to spam emails!

• Never blindly trust the content of emails, links, sender addresses or file attachments. If in doubt, do not open or click on them, as this alone can cause damage.
• In the event of a suspected or actual IT security incident, in accordance with the Emergency card proceed.
• In the event of misdirected messages, delete the message in question.
• If you have sent a message or confidential information to the wrong person, inform your line manager and ask the recipient of the misdirected message to delete it.
• Furthermore, if personal data is sent to the wrong recipient, the Data Protection Officer be consulted to assess the situation
• Only send confidential data over the internet in encrypted form.

Further information on email at the University of Koblenz:

Email Usage Policy

Phishing Early Warning System from the University of Koblenz

How can I spot phishing?

Blackmail by email

Setting up a spam filter

The correct way to use attachments in mass emails

Problems with the Outlook spam filter

Links from the BSI:

Spam, phishing and the like

Password theft through phishing

How can I spot phishing emails?

Do you use email securely?

Brochure: ‘Tips for Better Email Security’

Brochure: ‘Phishing – A Checklist for Emergencies’

Videos from the BSI:
Encrypting emails
Spot phishing emails!
Communicating securely online

Videos from the SECUSO Research Group:
NoPhish Video I: Checking the sender & spotting dangerous attachments
NoPhish Video II: Spotting dangerous links
NoPhish Video III: Take a close look, even when you’re stressed, pressed for time or feeling euphoric

The Internet is a network comprising many millions of computers that communicate with one another and exchange data via this network. The network comprises not only traditional end devices (PCs, laptops, smartphones, etc.) but also servers, switching centres and much more. A connection between two computers (e.g. required to send an email) or from a computer to a server (e.g. when visiting a website or using the cloud) does not usually take place directly, but via several intermediate stations. The transmission of information is not necessarily encrypted, meaning that important information may be read or intercepted by third parties whilst passing through these intermediate stations!
When a website is accessed, data is exchanged (e.g. the transmission of the website’s content to the user, or the transmission of the user’s password to the website) via the HTTP or HTTPS protocols. In the case of HTTP, the data exchanged is unencrypted – with HTTPS, it is encrypted.

The connection to the internet is generally established in two ways: via cable (DSL ‘copper’ / FTTH ‘fibre optic’ / HFC ‘cable’) or via LTE/5G (mobile networks).
LAN (wired) and Wi-Fi (wireless) generally first establish connections to a local network (i.e. a separate network cell that acts as a single unit when connecting to the outside world – the internet). From this local network, requests and responses from the internet are then forwarded to or administered by the individual devices.
A local network can be set up in many different ways by any user with the appropriate hardware (router, smartphone (hotspot) and much more). There are also use cases where an internet connection on the device responsible for network administration is not even necessary – if this local network serves solely to exchange data between devices within it. If, on the other hand – which is likely to be the classic use case – you wish to connect to the internet using the devices on the local network, this connection (device responsible for network administration <-> internet) is, of course, absolutely essential.
It should generally be borne in mind that the operator/creator of a local network can, in principle, view the data traffic (provided it is unencrypted) and – depending on the connection and firewall settings (more on this in section 4.2) – may also, where applicable, cause damage to the device.
As a general rule: only connect to local networks whose operators or creators you know and trust!
Whilst, in the case of a LAN cable, it is typically quite straightforward to identify the operator or creator of the local network, or to draw conclusions about them, this is somewhat more difficult in the case of Wi-Fi. Even if a Wi-Fi network is called, for example, ‘Deutsche Bahn Hotspot’, this does not necessarily mean that it actually belongs to that company – the name of a Wi-Fi network can be chosen at will!
As the person setting up a local network, it is, however, more difficult to monitor who is connecting to the network in the case of a Wi-Fi network. It is therefore important always to secure a local network you have set up yourself (e.g. a hotspot) with a password!
Public Wi-Fi networks are particularly important in this context. These are generally provided by large organisations or companies to offer customers access to the internet (e.g. rail stations, airports, hotels, cafés, etc.). Even if the provider is generally trustworthy, it is best to avoid these public Wi-Fi networks (where possible), as other users or devices on the same local network may, under certain circumstances, cause damage to your device (e.g. in the case of devices already infected with malware) and it may be that the creator or operator has configured the Wi-Fi network inadequately (e.g. outdated or missing encryption, etc.). If you do need to connect to a Wi-Fi network that is available to the general public, we recommend using a VPN (you can find out more about VPNs on the BSI website: Link). Generally speaking, from a safety perspective, a wired connection is always preferable to a wireless connection.

The role of a firewall is to control data traffic with other devices. This control typically operates at various levels. At the local network level (e.g. a router), the focus is on protection against attacks from the internet (as well as detecting and containing an infection if a device within the local network has already been compromised). To this end, the firewall checks, for example, the authorisation and routing of data packets, as well as connections to and from specific device addresses.
At the computer level (personal firewall), the focus is again on protection against attacks via the network connection – also by monitoring and controlling the flow of data.
Generally speaking, stricter settings are always more advisable from a security perspective, but may also impose restrictions in very specific use cases. If you do not have the knowledge to know exactly what these use cases might be, you will not be affected by any restrictions and should always use the stricter firewall settings.

If in doubt, you should always use the stricter setting for the firewall (e.g. on Windows: ‘public network’).

Broadly speaking, browsers are applications that enable website content to be displayed clearly (note: modern browsers offer a wide range of additional features and options that go beyond their core functionality). There are essentially three different types in use today: Chromium (Chrome, Microsoft Edge, Vivaldi, Brave...), Gecko (Firefox, Tor, Librewolf...) and WebKit (Safari), developed by Google, Mozilla and Apple respectively. For many people, the browser – alongside their email programme – is, in a sense, the ‘gateway to the internet’. This makes it all the more important to have the browser configured correctly, as regardless of type or developer, most modern browsers offer a wide range of settings that are well worth taking a closer look at. For instance, the default settings usually allow user statistics to be sent to the developer, or for all website data and browsing history to be stored locally. However, the settings typically allow you to simply disable the former and configure the latter in great detail. In addition, you can also specify how cookies, fingerprinting and similar technologies are handled, as well as how the browser behaves when visiting websites that do not support the HTTPS protocol (i.e. HTTP only). You can also change your choice of search engines or your preferred default search engine here, and specify how login details (usernames and passwords) are handled.
Particular attention should be paid here to the use of add-ons. Add-ons generally serve to extend or modify the browser’s functions and behaviour. This ranges from superficial customisations (e.g. tab administration) to the addition of entirely new functional areas that alter usage behaviour (calendars, price trackers, SEO tools, and much more). The problem, however, is that almost all add-ons require a wide range of permissions (access to and analysis of traffic data, device storage, contacts and much more). As add-ons in particular are made available in large numbers on the respective add-on platforms, it is all the more important – particularly in view of the permissions usually required – to take a closer look at the developers. After all, it is not uncommon for an extension that appears useful on the surface to actually conceal malware.
Only install add-ons from official platforms! Even if you find an add-on on an official platform, that is no guarantee that you can trust the developer.

So the rule is: the fewer add-ons you add to your browser, the better!

And: always check the developer of an add-on carefully. Only install it if you can trust the developer!

Unfortunately, the prevalence of adverts has also increased over time. This is problematic in that adverts can often be accompanied by malware.
It is therefore also highly recommended that you install an ad-blocker add-on. You should, however, continue to exercise caution regarding the developer.

Videos from the BSI:
Browser security

Generally speaking, it is a good idea to stick to websites you are familiar with when browsing. Unfamiliar addresses and unusual domain extensions (e.g. .to, .su, etc.) or spelling errors (e.g. payyyyypal.de) are signs of websites with malicious intent.
Important: Even website names that sound plausible can conceal a malicious website. You should therefore always check that the address of the website you wish to visit is correct!
The reason for this is that a company often reserves only a few variations of its actual address. The smaller the company, the fewer such variations there usually are. Unfortunately, the rest of the possible variations are often reserved by attackers who use them to target unsuspecting users (phishing, installation of malware, etc.)
You should therefore always take particular care when entering your login details. Make sure you use an encrypted connection (HTTPS rather than HTTP; see section 4.1) and check that the address is correct!

Note: Most browsers display the address of a link when you hover over it with the cursor (i.e. without clicking). The address is then displayed, for example, in the bottom left-hand corner.

Links from the BSI:

Brochure: ‘Using the Internet Safely’

Videos from the BSI:
Secure data transmission
Protect your accounts effectively

AI (artificial intelligence) refers to the simulation of human intelligence using electronic systems (to the extent permitted by technological and conceptual capabilities). The following explanations are intended merely to provide a general overview.
Particularly widespread are LLMs (Large Language Models – i.e. with a language orientation), as well as image generators and interpreters. What they all have in common is the fundamental process of training a corresponding base model (neural network) using data. The model/network determines HOW it learns and is applied, whilst the data determines WHAT is learnt. This results in the finished AI model, with which a user can interact.
A distinction is made between local AI and cloud-based/online AI.
With local AI, the model runs locally on the user’s device, meaning all data is processed locally. With online AI, the AI model runs on the provider’s server, and the user sends queries to this AI model via the internet and receives the answers or results in the same way. Data processing takes place on the provider’s server.

Whilst the use of local AI systems tends to cause few problems for reasons of security and data protection (apart from general provisions on data processing, e.g. relating to third parties, etc.), particular caution is required when using cloud-based or online AI. The vast majority of the better-known AI models (e.g. ChatGPT, Copilot, Gemini...) are cloud-based. What already applied when using the cloud to store files applies all the more here. As AI systems in particular are heavily influenced and improved by data sets, both during development and ongoing operation, providers have an intrinsic interest in utilising user data (interaction with the AI, data/phrases entered, user profile creation and processing, etc.). If in doubt, be sure to read through the providers’ terms and conditions and privacy policies. As a general rule, when using cloud-based or online AI systems, you must assume that anything you share with the AI in any form (chat history, uploaded documents, etc.) will also be stored and utilised by the provider.
You should therefore never disclose confidential information to a cloud-based or online AI!

Links from the BSI:

Brochure: ‘Using Artificial Intelligence Safely’

Videos from the BSI:
Artificial Intelligence