CSUSB Cyber Security Awareness Month 2026

Something wicked may be making its way through your social media feed. From deceptive messages and fake profiles to malicious links and oversharing, digital threats can appear when you least expect them. This week is all about how to stay safe and secure when using social media apps and platforms. 

Spooky Social Media Risks to Avoid:  

 🕷️ Phantom Profiles

Cybercriminals often create fake profiles that imitate classmates, coworkers, staff and faculty members, university leaders, recruiters, or trusted organizations. They may use a real person’s name, photo, and public information to make the account look convincing. Once they are accepted as part of your friend list, they can collect information about you, send malicious links, request money, or attempt to steal your login credentials.

Spooky Tip: Examine the account before connecting. Look for warning signs such as a recently created profile, very few posts, unusual spelling, limited connections, or a slightly altered username.

🕷️ Bewitched Links

Not every link is safe to click. Cybercriminals use shortened URLs, fake login pages, misleading advertisements, QR codes, and compromised accounts to trick people into visiting malicious websites. Clicking one of these links could expose your password, install malware, or give an attacker access to your social media or university account.

Spooky Tip: Navigate through an official source. Instead of opening a link from an unexpected post or message, visit the organization’s official website or mobile app directly. If you clicked a suspicious link or entered your password, change it immediately and report the incident with the social media app. 

🕷️ Tagging Terrors

It’s not always you! Photos and posts shared by other people can expose your location, activities, workplace, school, or personal relationships—even when you did not post the content yourself. Unwanted tags may also connect your profile to spam, scams, or inappropriate material.

Spooky Tip: Adjust your privacy settings so you can approve tagged posts and photos before they appear on your profile.

🕷️ Deepfake Doppelgängers

Artificial intelligence can create convincing images, videos, and audio recordings that impersonate real people. Cybercriminals may use this content to spread false information or make fraudulent requests appear legitimate.

Spooky Tip: If a video, voice message, or post makes an unusual or urgent request, verify it with the person through a trusted communication channel.

🕷️ Digital Footprint Frights

 Once you share something on social media, you may lose control over where it goes and who sees it. Others can save, copy, or repost your content—even if your account is private or you later delete the original. One careless post can reveal personal information or create consequences that last far beyond the moment.

 Spooky Tip: Regularly check your past posts, tagged photos, privacy settings, and publicly visible profile information.

Spook-Proof Your Social Media

To avoid falling for these tricks, remember: 

• Examine profiles before accepting the friend request. 
• Navigate to pages through an official source. 
• Enable tag review. 
• Confirm any unusual messages before you provide any information. 
• Review your digital footprint. 

🎃 Spooky Week Challenge 🎃 

Think you can spot the spooky social media risks? Review the image in this week’s challenge, identify the cybersecurity and privacy concerns, and submit your answers through the Qualtrics survey. Complete the challenge by 12:00 p.m. on Monday, October 12, for a chance to be entered into the weekly raffle. 

>> Complete the Spooky Social Media Risk Hunt <<

👻Data Classification Levels 👻 

Did you know that CSUSB assigns data classification levels to all information that is (or will be) gathered, processed, transmitted, or stored by its IT assets? This VERY important exercise typically happens prior to the acquisition, purchase, or implementation of an IT resource.  In accordance with CSU Systemwide policy, CSUSB utilizes three classification levels, and each requires specific controls for handling: 

• Level 1 – Confidential Data (Highest Protection Required)
• Level 2 – Data for Internal Use 
• Level 3 – General Information (Publicly Accessible)

Level 1 data is information that is sensitive and confidential to the university, its students, employees, or customers.  This level presents the highest level of risk and damage if compromised. Examples include (but are not limited to): 

• Passwords or credentials that grant access to Level 1 or Level 2 data 
• Social Security Number (SSN) and name 
• Birth date combined with last four digits of SSN and name 
• Medical records related to an individual 
• Biometric information 
• Electronic or digitized signatures 

Level 2 data is private information that is handled for the purpose of “internal use.” This level presents a moderate level of risk if accessed or disclosed without proper authorization. Examples include (but are not limited to): 

• Photos (taken for identification purposes) 
• Student information/education records not defined as “directory” information, including, but not limited to grades, courses taken, schedule, test scores, advising records, educational services receive, disciplinary actions, student photo) 
• Trade secrets or intellectual property such as research activities 
• Licensed software 
• Employee information, including, but not limited to employee net salary, home address, personal telephone number, personal email address, payment history, employee evaluations, pre-employment background investigations, mother’s maiden name, race and ethnicity, gender, marital status, physical description 

Level 3 data is general information that is publicly available and/or meant for public consumption. As the least “riskiest” classification standard, this level does not require specific protective measures but is still subject to University review and use procedures.  

We ALL play a role in safeguarding the information that we handle! 

🎃 Spooky Week Challenge 🎃 

This week’s challenge is a spooky word search on this week’s theme: Data Classification! Review the word search and submit your answers through the Qualtrics survey. Complete the challenge by 12:00 p.m. on Monday, October 19, for a chance to be entered into the weekly raffle. 

>> Complete the Data Classification Word Search <<

👻Spooky AI Threats to Watch 👻 

AI platforms like ChatGPT, Gemini, and Claude can boost your productivity, but it also may introduce new risks like data leakage, deepfakes, AI-enhanced phishing, prompt injection, model “hallucinations” and bias. A little caution goes a long way. 

The below list explores a few AI threats and provides helpful tips for each.

🪦 DATA LEAKAGE

• What Is It? Anything you paste into an AI tool may be stored or shared with vendors.
• Tip: Limit the amount of sensitive information you input into your AI tool of choice. Sensitive information could include home addresses, phone numbers, social security numbers, and similar. 
• Example: Student researchers enter a spreadsheet containing student names, contact information, and sensitive mental- and physical-health responses into an AI model.

🪦DEEPFAKES & SYNTHETIC MEDIA

• What Is It? Realistic but fake audio/video that can impersonate university leaders and department heads.
• Tip: Verify via a second channel before acting upon an "urgent" request.
• Example: A deepfake video of a university leader requests "urgent payment processing" for a new project.

🪦AI-ENHANCED PHISHING

• What Is It? Cyber criminals use AI to craft flawless emails and messages.
• Tip: Scrutinize email links, sender email addresses, urgency, and unusual requests.
• Example: An email from "IT Support" that looks perfectly written and personalized asks you to "confirm your login" on a cloned website.

🪦PROMPT INJECTION

• What Is It? Web content or files can steer an AI to exfiltrate data or run unsafe actions.
• Tip: Don't follow instructions that come from untrusted content.
• Example: You ask AI to summarize a webpage, but hidden text on the page instructs the AI to share your confidential notes instead.

🪦HALLUCINATIONS & BIAS

• What Is It? AI can output confident, yet incorrect or skewed information.
• Tip: Always verify with reliable sources (i.e., check the AI's sources).
• Example: An AI report generator "quotes" a non-existent CSUSB policy about password sharing, which could mislead others if unchecked.

Spook-Proof Your AI Use

Follow these best practices to keep your data (and reputation) safe from lurking AI threats:

• Protect Prompt Inputs: Never paste passwords, SSNs, student/employee records, medical info, or other sensitive data.
• Use Approved AI-Tools: Stick to campus-approved platforms and disable data retention when possible.
• Verify Outputs: Cross-check facts; cite sources.
• Stay Updated: AI platforms and models evolve quickly. Where possible, regularly review privacy settings and data policies to ensure your information is protected.

• Enable Multifactor Authentication (MFA) – Enable Multifactor Authentication (MFA) to add a level of security to work and/or personal accounts by using a password to protect a password. View Multifactor Authentication Tips.
• Create and use strong passwords – Use strong passwords to prevent compromise/breach to work or personal information. Safety is the name of the game. View Passwords Tips. 

• Setup Password Managers – Use a password manager to store all passwords to digital accounts. Create, store, and save passwords that can be automatically filled in for future use and keep accounts safe. View Password Managers Tips.
   

   

• Update software – Update software frequently, or use scheduled software updates that are often included with software apps, etc. This will ensure you have the latest security for your device and use of new features. View Software Update Tips.

   

• Recognize and report phishing – Recognize and report suspicious emails and links.  Never click on suspicious links sent via email, and or text especially from people you do not know. Report phishing emails received at work to your Information Technology Services Department (ITS) or utilize personal email platforms such as Google to report phishing events. View Phishing Tips.