1. A Windows 8.1 computer (or even older) is not only unsuitable for working with confidential data, such a computer has no place on the Internet.
2. A Windows computer that is also used by other family members is not suitable for working with confidential data.
3. A Windows computer that contains at least one non-legally purchased program or game or file-sharing software is not suitable for working with confidential data.
4. Before starting the computer brain up - never vice versa.
5. When the computer starts Windows and at some point has finished booting - immediately press "Windows Update", then update the virus scanner - but pronto! - to the latest version.
6. Before opening Outlook, use your brain and process this causal conclusion: "TUGRAZonline never sends out emails in which members of Graz University of Technology are requested to enter data in online forms".
   Therefore, "If I receive an email from TUGRAZonline asking me to enter data into online forms, this email does not come from TUGRAZonline, but from a gang of scammers."
7. Repeat process.

(translated from: Futurzone, modified for TU Graz)

1. Be constantly aware that cyber criminals could try to gain access to TU Graz systems with your help at any time.
   Participate in training sessions on a regular basis. At TU Graz, participation in annual awareness training courses on cybersecurity is mandatory for all employees in accordance with rectorate decision 027 of 9 April 2024.
2. If you are unsure whether you might have become a victim of a phishing attack, please report it immediately to your "EDV-Beauftragte", to it-support@tugraz.at or to it-security@tugraz.at) and forward the corresponding email.
   If the email is not marked as spam or suspicious, report the email.
   Also inform them if you have shared critical information over the phone.
3. Never share personal information such as passwords, credit card or transaction numbers via email, messaging service, social media or over the phone.
   This sounds obvious, but you are more vulnerable to manipulation, influence and deception in the home office.
4. In general, avoid clicking on links in emails that lead to log-in pages.
   Instead, save addresses to frequently visited pages in your browser's favorites list or surf to the page mentioned in the email from the organization's home page.
5. Do not click on any links that you receive via SMS.
   It is especially easy to fake the sender here. Smishing is a method of attack via text message or SMS calling to follow a link or call a number.
   It is better to surf the sender's site directly in the browser.
6. Never launch a download link directly from an email unless you are 100% sure.
   Instead, if possible, always start downloads directly from the provider's website or from the homepage or ftp server of TU Graz.
7. Before you open files attached to an email, make sure that the email really comes from a trustworthy sender.
   In case of doubt, contact the sender by phone to make sure that the email really comes from him or her and point out the possibility of digital email certificates.
   Do not use the telephone number given in the email, but check the official homepage of the organisation! The telephone numbers displayed for TU Graz have also been faked; if you are not sure, call the number.