University of Reading cookie policy

We use cookies on reading.ac.uk to improve your experience, monitor site performance and tailor content to you.

Read our cookie policy to find out how to manage your cookie settings.

Campaigns

Simulated Phishing emails

The University periodically sends simulated phishing emails to employees to see how they react upon receipt of a scam or phishing email i.e., if malicious domains are flagged, if users spot social engineering, and know not to enable macros or unexpected files. These phishing vulnerability assessments help us to evaluate our security posture and identify key areas to help protect the university from future (genuine) attacks.  

Why do we run phishing awareness campaigns?

We have gathered together information from these campaigns so you can see real life examples, as well as find out how well we all did at spotting them.

December 2022 Phishing Campaign #10

On Thursday December 8th the Cyber Security team in DTS ran our 10th phishing campaign. 7727 emails were sent out to all staff (with an active Microsoft 365 account) on Thursday 8th.  The results will be published after Christmas.

Phishing campaigns are not designed to catch you out, we want everyone to learn how to spot one! The takeaway messages from this campaign are:

  • Be aware of the red flags of this particular phishing email so you know what to look out for in future attacks
  • Report the phish as soon as possible, even if you are unsure, to DTS so that in the event of real phish attack we can stop spread by automatically removing similar emails from other users' inboxes and we can check your account for compromise.
  • This was a Social Engineering scam, where your desire to get something quickly (as there were only a limited number of "vouchers" available for a limit amount of time) overrides any normal checking you might do. These scams exploit human nature, so do not be disheartened if you fell for it. 

Training

Digital Skills training (UoR Learn, search for digital skills - security)

Cyber Security Awareness - Social Engineering (Linked In Learning, video with quiz, 1h)

National Cyber Security Centre Social Engineering (NCSC, slides)


May 2022 Phishing Campaign #9

Between Tuesday May 24th and Tuesday May 31st 2022, the Cyber Security team in DTS ran a phishing campaign. 7829 emails were sent out to all staff (with an active Microsoft 365 account) on Tuesday 24th, and the phishing website was kept open until the following Tuesday.

Learning actions

Phishing campaigns are not designed to catch you out, we want everyone to learn how to spot one! The takeaway messages from this campaign are:

Results

For security purposes, the results are on a separate page only accessible using your UoR sign on: DTS Cyber Security: May 2022 Phishing campaign results and analysis. Do not share this information outside of the University.

Training

Digital Skills training (UoR Learn, search for digital skills - security)

Avoid Phishing scams (LinkedIn Learning, video, 8mins)

Cyber Security Awareness - Phishing (LinkedIn Learning, video, 1h)


Updated by lm920207 on 09/01/23

What to do with a suspect email?

If you've received an email that you think is suspicious report to DTS straight away.

Do not be tempted to click on any links or open any attachments in the email.