January 1, 2016

This is a forgery example of a commonly used service provider, PayPal. The intent is to fool the recipient into clicking the link directed to a malware infected webpage.

December 15, 2015

A remote code execution vulnerability has been discovered in Joomla versions 1.5.0 to version 2.4.5. Exploits for this vulnerability have been observed in the wild. Patches are available and users are advised to upgrade immediately.

December 10, 2015

This phishing message was forged to appear to come from the UCB Human Resources office. Beware of "URGENT" message from HR concerning "Your New Salary Notification".

November 13, 2015

A serious vulnerability in Apache Commons, a library that contains a widely used set of Java components maintained by the Apache Software Foundation, puts thousands of Java applications and servers at risk of remote code execution attacks.

November 3, 2015

As part of a UC system-wide effort to address the increasing threats to the security of our information systems and data, a comprehensive security awareness training program is being rolled out by UCOP for all staff and faculty.

October 1, 2015

You may have noticed changes to the Information Security and Policy website beginning October 1st!

We've migrated our site to the Open Berkeley platform. The new site includes:

September 22, 2015

On October 20th, 2015, the CalNet login page will undergo important cosmetic and security changes. Read the announcement and preview the new look before the change!

June 1, 2015

Effective July 14th, 2015 Microsoft is discontinuing extended support for its Windows Server 2003 operating system. Please read our bulletin to prevent your Windows Server 2003 systems from being blocked on campus networks.

May 8, 2015

Learn how to detect the authentic CalNet login page and avoid entering your CalNet credentials on bogus web sites!

March 12, 2015

Alex Stamos, Yahoo’s Vice President of Information Security and Chief Information Security Officer, will present "Ethics and Opportunities in Cybersecurity" at Banatao Auditorium (Room 310), in Sutardja Dai Hall (the CITRIS building) on Monday, March 30, 2015 at 10:30am. Register now!

November 19, 2014

Beginning this December, Information Security and Policy will launch the SANS Securing the Human Phishing project. Approximately each month for one year we will send out a simulated phishing email that looks and smells like a real phish.

October 15, 2014

A critical vulnerability that can be exploited remotely without authentication has been discovered in Drupal 7.

October 14, 2014

A major flaw, dubbed POODLE, has been discovered by Google in the design of SSL version 3.0.

September 24, 2014

A remotely exploitable flaw has been discovered in GNU Bash that allows code execution through specially-crafted environment variables.

August 22, 2014

Charlie Miller, of the Application Security Team at Twitter, will present "Failures of the InfoSec Community" and "Getting Owned in 100 Different Ways" at Booth Auditorium, Boalt Hall, on October 17, 2014. Register now!

July 1, 2014

On September 30, 2014, all UCB campus Symantec Endpoint Protection (SEP) licenses will expire, and SEP client security software must be removed from campus systems by October 1, 2014.

April 10, 2014

A widely reported critical security flaw, called “Heartbleed,” has been discovered that affects not only some campus systems, but also many information systems worldwide. We are asking you to take some voluntary precautions.

April 8, 2014

A critical information disclosure flaw dubbed "Heartbleed" has been discovered in the OpenSSL library.

March 1, 2014

Effective April 8, 2014, Microsoft is discontinuing support for its Windows XP operating system. After April 8th of 2014, there will be no security patches for this operating system from Microsoft. All Windows XP machines must be upgraded or removed from the network by April 8th of 2014.

July 5, 2013

A draft of a proposed updated campus information security strategy is now available for review.  The draft document is attached in both MS Word and PDF formats at the bottom of this page.

We welcome your comments and discussion!  Please send feedback to Paul Rivers ( or Larry Conrad (