Upgrade Notice: K2/Everest Production Environment Update to Version 5.6

• April 1st, 2024
• in Uncategorized

On April 7, 2024, we will be upgrading to Version 5.6 to enhance system performance, security, and functionality.

Key Upgrade Details:

• Date and Time: The upgrade is scheduled for April 7, 2024.
• Affected System: K2/Everest production environment.
• Upgrade Version: We will be updating to Version 5.6.
• Expected Downtime: Minimal downtime is anticipated; however, there may be brief interruptions in service during the upgrade process.

Important Notes for Users:

• Plan Ahead: Please plan your work accordingly, considering the upgrade timeline.
• Save Work: We advise saving any important work or documents prior to the upgrade to avoid potential data loss.
• Post-Upgrade Support: Our IT support team will be available to assist with any issues or queries following the upgrade. Please don’t hesitate to reach out if you encounter any difficulties.

We understand the importance of uninterrupted access to our systems, and we assure you that every effort will be made to complete the upgrade process efficiently and minimize any disruptions. If you have any questions or concerns regarding the upcoming upgrade, please contact the IT Service Desk at ITSD@ua.edu or (205) 348-5555.

Upgrade Windows 10 – 22H2

• April 1st, 2024
• in Uncategorized

Beginning in April 2024, faculty and staff with Windows computers will begin receiving announcements on their computers to upgrade Windows 10 to the newest supported version, 22H2.

Faculty and staff have the option to upgrade when they receive the announcement or schedule the upgrade for another time. OIT recommends that faculty and staff perform the update at the end of the workday, as the upgrade will require 90 minutes of downtime.

This upgrade will not delete any applications or data, but as always, OIT recommends backing up before performing any OS upgrade. Windows 11 users will not be affected.

Please perform this upgrade at a time convenient to you. OIT suggests starting the upgrade or scheduling it to occur just before you leave for the end of the day. OIT also recommends performing the upgrade while on campus, connected to power, and connected to the UA network. Below is an example of the announcement faculty and staff can expect to see.

Machines that are not upgraded by September will automatically receive the update from OIT. OIT recommends that faculty and staff schedule the upgrade for this summer and perform it at a time of their choosing.

macOS Sonoma 14.3 is Now Available

• January 24th, 2024
• in Uncategorized

The University of Alabama’s Office of Information Technology (OIT) is pleased to inform the faculty, staff, and students that macOS Sonoma 14.3 is now available for installation on all OIT-managed machines campus-wide. It is highly recommended to opt for the most recent version for improved performance and security. Before updating, please ensure that you have an up-to-date backup of your data. Users can easily install the update by navigating to “System Preferences,” selecting “Software Update,” and following the on-screen instructions. For any assistance or queries during the installation process, individuals are encouraged to reach out to the OIT Help Desk at ITSD@ua.edu or 205-348-5555.

Xfinity Outage – Tuesday, January 16

• January 24th, 2024
• in Uncategorized

A letter from Xfinity –

Dear Residents:

We’re writing to apologize for the service slowdowns and disruptions that occurred last Tuesday on campus. This is definitely not the experience our customers should have. You deserve better, and together, in partnership with your university leadership team, we have put a plan in place to ensure this doesn’t happen again.

As you can appreciate, we continue to deal with irregular weather patterns which have a direct impact on utility services across the board – cable and internet included. The extreme cold temperatures we all saw over the past several weeks severely damaged our network and caused the issue. Again, we can do better…and we are!

We’re taking steps to prevent an issue like this from happening again and to make sure that even in  adverse weather or if there’s damage to our network, your Wi-Fi service will remain at full strength.

We’re committed to providing excellent service on campus and making sure you have what you need to meet your academic and personal connectivity needs.

If you have any issues regarding your WiFi, please contact us using the Xfinity Assistant Live Chat at xfinityoncampus.com. You will be connected with a real Xfinity representative. If you’re unable to use the real-time chat support, [please call 833-455-2678.

Email Forwarding

• January 22nd, 2024
• in Uncategorized

The University of Alabama has a policy in place to ensure the security of its digital communications and data. The policy requires adherence to the minimum security standards, which state employees, contractors, and non-student affiliates are explicitly prohibited from configuring mail clients to automatically forward UA email to personal accounts or other companies or institutions without prior, documented approval from OIT Information Security. Additionally, the use of personal or other external accounts or services to store or transmit official University data and communications or to conduct official University business is strictly forbidden. This policy aims to safeguard sensitive information, maintain data integrity, and mitigate the risks associated with unauthorized access or data breaches.

Please reach out to security@ua.edu if you have any questions.

Opportunity: Azure Fundamentals Class

• October 27th, 2023
• in Uncategorized

The local Microsoft Account Team will be providing an AZ-900 (Azure Fundamentals) class at the University of Alabama on November 9^th from 9:00am – 4:00 pm. The cost of the training is FREE. Room for this event will be limited to 40 participants. The agenda and Registration link are below. Additional general details will be forthcoming to registered attendees.  Please let me know if you have any questions.

Azure AZ-900 Class  

Azure Fundamentals introduces cloud services, and how these services are provided by Microsoft Azure. Take this course as a first step towards learning about cloud computing and Azure, before taking further courses. 

This course covers:

• General cloud computing concepts, models, and services such as: 

• Public, Private, and Hybrid clouds
• Infrastructure, Platform, and Software as a Service

• Core Azure products, services and tools for security, privacy, compliance, and trust
• Azure pricing and support options

Registration Link for University of Alabama AZ-900 course on November 9^th

Azure AZ-900 Microsoft Azure Fundamentals     

Candidates for this exam have skills and experience working with an area of information technology (IT), such as infrastructure management, database management, or software development.

·        Describe cloud concepts (25–30%)

·        Describe Azure architecture and services (35–40%)

·        Describe Azure management and governance (30–35%)

Describe cloud concepts (25–30%)

Describe cloud computing

·        Define cloud computing

·        Describe the shared responsibility model

·        Define cloud models, including public, private, and hybrid

·        Identify appropriate use cases for each cloud model

·        Describe the consumption-based model

·        Compare cloud pricing models

·        Describe serverless

Describe the benefits of using cloud services

·        Describe the benefits of high availability and scalability in the cloud

·        Describe the benefits of reliability and predictability in the cloud

·        Describe the benefits of security and governance in the cloud

·        Describe the benefits of manageability in the cloud

Describe cloud service types

·        Describe infrastructure as a service (IaaS)

·        Describe platform as a service (PaaS)

·        Describe software as a service (SaaS)

·        Identify appropriate use cases for each cloud service (IaaS, PaaS, and SaaS)

Describe Azure architecture and services (35–40%)

Describe the core architectural components of Azure

·        Describe Azure regions, region pairs, and sovereign regions

·        Describe availability zones

·        Describe Azure datacenters

·        Describe Azure resources and resource groups

·        Describe subscriptions

·        Describe management groups

·        Describe the hierarchy of resource groups, subscriptions, and management groups

Describe Azure compute and networking services

·        Compare compute types, including containers, virtual machines, and functions

·        Describe virtual machine options, including Azure virtual machines, Azure Virtual Machine Scale Sets, availability sets, and Azure Virtual Desktop

·        Describe the resources required for virtual machines

·        Describe application hosting options, including web apps, containers, and virtual machines

·        Describe virtual networking, including the purpose of Azure virtual networks, Azure virtual subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute

·        Define public and private endpoints

Describe Azure storage services

·        Compare Azure Storage services

·        Describe storage tiers

·        Describe redundancy options

·        Describe storage account options and storage types

·        Identify options for moving files, including AzCopy, Azure Storage Explorer, and Azure File Sync

·        Describe migration options, including Azure Migrate and Azure Data Box

Describe Azure identity, access, and security

·        Describe directory services in Azure, including Azure Active Directory (Azure AD), part of Microsoft Entra and Azure Active Directory Domain Services (Azure AD DS)

·        Describe authentication methods in Azure, including single sign-on (SSO), multi-factor authentication (MFA), and passwordless

·        Describe external identities in Azure, including business-to-business (B2B) and business-to-customer (B2C)

·        Describe Conditional Access in Azure AD

·        Describe Azure role-based access control (RBAC)

·        Describe the concept of Zero Trust

·        Describe the purpose of the defense-in-depth model

·        Describe the purpose of Microsoft Defender for Cloud

Describe Azure management and governance (30–35%)

Describe cost management in Azure

·        Describe factors that can affect costs in Azure

·        Compare the pricing calculator and the Total Cost of Ownership (TCO) Calculator

·        Describe cost management capabilities in Azure

·        Describe the purpose of tags

Describe features and tools in Azure for governance and compliance

·        Describe the purpose of Microsoft Purview in Azure

·        Describe the purpose of Azure Policy

·        Describe the purpose of resource locks

Describe features and tools for managing and deploying Azure resources

·        Describe the Azure portal

·        Describe Azure Cloud Shell, including Azure Command-Line Interface (CLI) and Azure PowerShell

·        Describe the purpose of Azure Arc

·        Describe infrastructure as code (IaC)

·        Describe Azure Resource Manager (ARM) and ARM templates

Describe monitoring tools in Azure

·        Describe the purpose of Azure Advisor

·        Describe Azure Service Health

·        Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Application Insights

Registration Link for University of Alabama AZ-900 course on November 9^th.

Paty Hall & Ridgecrest South Wi-Fi Outage – Oct. 13, 2023

• October 13th, 2023
• in Uncategorized

UA-Xfinity residential wireless internet experienced an outage in Paty Hall and Ridgecrest South on Friday, Oct. 13, that began at 5:00 PM and ended at 7:30 PM. Paty Hall recovered as of 5:30 PM and Ridgecrest South recovered at 7:30 PM.

If you have any questions or concerns, contact Xfinity at 833-455-2678.

You can track updates on this issue here: oit-status-page.oitapps.ua.edu/issueHome

Duo Verified Push

• October 4th, 2023
• in Uncategorized

OIT is deploying a risk-based verified push feature in Duo that will help cut down on compromised accounts and improve cybersecurity all across campus.

What is a DUO Verified Push? Examples Below

Verified Push is a more secure version of Duo Push that requires users to enter a numeric code from the authentication prompt on their mobile device. When Duo detects an anomaly in your login pattern, it will display a code on the screen the person is using to log in. You will simultaneously get a request to answer the code in your Duo app. The code will be a mandatory step to log in the first time you use the device, but will happen less frequently the more you use the device.

Duo’s Risk-Based Authentication automatically detects and mitigates commonly known attack patterns and high-risk anomalies. Risk-Based Authentication consists of two key capabilities: Risk-Based Factor Selection and Risk-Based Remembered Devices.

How is risk assessed by DUO?

• User marked fraud: A user has indicated they weren’t responsible for a login by marking it as suspicious in the Duo Mobile app.
• Push harassment: A pattern of failed authentications is consistent with an adversary performing a targeted push harassment attack against a single user.
• Push spray: A pattern of failed authentications is consistent with an adversary performing a non-targeted push attack against multiple users.
• Unrealistic travel: A user attempts to authenticate from a new location that would be impossible to reach based on the past authentication time and location.
• Country code mismatch: The authentication device and access device appear to be in two different countries.
• Novel ASN: A user attempts to authenticate from an autonomous system number (ASN) not seen in the organization’s recent history of successful authentication.

What is the point?

Verified Duo Push automatically adds a separate layer of security on top of the push by asking the user to complete an action that requires them to interact with both the access and the authentication devices.

Limitations

• Apple Watch experience is degraded. The full QWERTY keyboard makes entering the code a challenge. You are able to illustrate or narrate your code as an alternative.
• In iOS, the numeric keyboard is only launched in the Duo app. If you attempt to approve directly from notification, you will have QWERTY. The approval still works, just less smoothly.
• Verified Push only works when combined with the Duo mobile app. Phone call and SMS authentication are unsupported. Hardware token usage is unchanged as well. If a phone call is the only way to authenticate due to accessibility reasons, we can add the user to an exception group.

Want to learn more?

You can find out more about Verified Push on Duo’s website: CLICK HERE

Paty Hall Wi-Fi Outage – Sept. 20, 2023

• September 20th, 2023
• in Uncategorized

UA-Xfinity residential wireless internet experienced an outage in Paty Hall on Wednesday, Sept. 20 that began at 2:00 PM and ended at 7 PM. On Sept. 21 at 5 AM Xfinity replaced some equipment that supports your Wi-Fi network in your building to ensure a better experience moving forward.

If you have any questions or concerns, contact Xfinity at 833-455-2678.

Artificial Intelligence Increases Threat of Extortion

• June 7th, 2023
• in Uncategorized

The Federal Bureau of Investigation (FBI) warns about a growing trend of malicious individuals using deep fake technology for explicit extortion attacks. This brand of extortion involves threatening victims with publicly releasing explicit images or videos unless they pay a ransom. Previously, the compromising content used in extortion was often fake, but now threat actors are scraping publicly available images from social media platforms. They use these images as input for deep fake content creation tools, generating AI-generated explicit content that looks highly realistic. The FBI has observed an increase in extortion victims reporting the use of fake images or videos created from their social media posts or captured during video chats.

Bad actors are achieving this with content creation tools available online, including free ones, that can generate realistic videos using just a single image of a person’s face. While some of these tools have built-in protections, those sold on underground forums and the dark web may not.

The FBI’s alert mentions two common demands made by malicious actors: demanding payment with threats to share the images/videos with family or social media friends if funds are not received or forcing the victim to send real sexually-themed images or videos. The created explicit content may be posted directly to pornographic websites, exposing victims without their consent. This media manipulation activity has unfortunately affected minors as well.

To protect oneself, OIT recommends practicing safe habits online, considering the risks of sharing personal media, restricting access to personal content, and reporting any deep fake content or threats to OIT Security, UAPD, and hosting platforms.

Link to FBI Article