It is hardly news that all Wageningen UR’s incoming mail has to go through a spam filter. But from December, the Facilities and Services IT department (FB-IT) will be going one step further. Then IT will also be able to check the mailboxes of staff and students for harmful messages. This might sound like the kind of thing that worries Edward Snowden but IT security manager Raoul Vernède says it is not that bad. According to him, mailboxes will only be searched if users report a malicious email. A program will then scan all mailboxes, checking for messages with the same subject and putting them in quarantine. ‘This script is fully automated and the IT staff themselves don’t open any mailboxes.’
The measure is in response to the emergence of new, more sophisticated forms of phishing. Criminals traditionally sent vast numbers of emails full of spelling mistakes that asked for bank details or login data. But these days, emails often contain links drawing the recipients to professional-looking sites designed to resemble banks, for example, and maybe even Wageningen UR. The trapped accounts are then used to send spam, but possibly also for stealing research data or intellectual property. ‘China, Russia and the United States conduct industrial espionage all over the world,’ says Vernède. ‘Our organization is a potential victim too.’
Even university staff turn out to be vulnerable to professional phishing. Last October, the IT department at the University of Groningen sent a very professional fake phishing email to 6000 employees. Nearly half (2800) clicked the link in the email and about 1000 then even gave away their password. Wageningen UR receives about 70,000 regular emails a day. This includes about one per cent of spam that slips through the filter. The filter picks up hundreds of thousands to millions of spam emails every day. According to FB-IT, one or two people a month get caught by phishing. ‘They tend to be older, more digitally illiterate members of staff,’ says Vernède, ‘or students who don’t speak the language that well.’