Don't feed the phish: Simple habits, safer research
This post was written by Becky Ortinez, Security & Compliance Lead at the CHPC. Becky recently received the 2026/2027 Trusted CI (NSF Cybersecurity Center of Excellence) Fellowship.
October is Cybersecurity Awareness Month, which makes it a great time for a quick security check-in. The good news is that you do not have to be a cybersecurity expert to help keep CHPC secure. A few simple habits can make a big difference for your account, your research, and the systems we all rely on.
Think before you Duo.
If you receive a Duo prompt you were not expecting, do not approve it. An unexpected MFA request may mean someone else is trying to access your account. Deny the request and take a closer look. A few seconds of caution can save a lot of trouble later.
Give suspicious emails the side-eye.
Phishing emails are getting harder to spot. They can look like they came from a colleague, University leadership, or a service you use every day. Be especially cautious when a message creates a sense of urgency or asks you to click a link, open an attachment, enter your password, or share sensitive information.
When something feels off, it probably deserves a second look.
Know where your research data belongs.
Not all research data has the same security requirements, and not every CHPC environment is designed for every type of data. Before moving, storing, or sharing sensitive or regulated information, make sure you are using the right environment.
Not sure? Ask us. We would much rather help you figure it out before the data moves.
Patch it or let us help you find another path.
Software updates may not be the most exciting part of research computing, but they are important. Keeping operating systems, applications, and research tools current helps close known security gaps before someone has an opportunity to take advantage of them.
We also know research computing is complicated. Sometimes your work depends on specialized, legacy, or vendor-controlled software that simply cannot be patched or upgraded without breaking something your research relies on.
There is a process for that.
The University’s Policy 4-004: University of Utah Information Security Policy allows for approved exceptions to information security requirements, and Procedure P4-004P: Exceptions to Policy outlines how those requests are handled.
If you cannot patch a piece of software your research depends on, reach out to helpdesk@chpc.utah.edu. We will gladly help you document the situation, draft an exception-to-policy request, identify appropriate mitigating protections, and submit it to the correct University team. Our goal is to help you keep your research moving while managing the security risk appropriately.
See something strange? Tell us.
Suspicious login? Odd email? Unexpected system behavior? Accidentally shared something you shouldn't have? Let us know. Reporting something early gives us the best opportunity to investigate and help.
You are never bothering us by asking.
Report suspicious activity, security concerns, or questions to helpdesk@chpc.utah.edu.
This October, remember that cybersecurity does not have to be complicated. Stop, check, and ask when something does not look right. Those small habits help protect your account, your research, the CHPC community, and the University of Utah as a whole.