Cybersecurity Contests for Faculty and Staff
As part of Cybersecurity Awareness Month, Toronto Metropolitan University (TMU) is offering prizes to encourage faculty and staff to adopt safer online habits.
Reporting phishing emails
As a big thank you for practicing how to recognize and report phish in our simulated phishing exercises this October, we’re giving all faculty and staff a chance to win great prizes.
Faculty and staff can enter the contest by reporting simulated phishing emails instead of clicking on their links.
Note, there is a maximum of one Amazon eGift Card available to be won by each employee.
All TMU faculty and staff who are employed as of October 31, 2023 are eligible to participate, with the exception of those in the Computing and Communications Services (CCS) department and the Administration and Operations Communications team.
Throughout Cybersecurity Awareness Month in October, all eligible faculty and staff will be sent fake phishing emails. To participate in the contest, you’ll need to:
- Report at least three fake phish to firstname.lastname@example.org using the “forward” function in your email (please do not use the “forward as attachment” option); and
- Avoid clicking the malicious link in more than two of our fake phish.
TMU receives a number of phishing emails each day that are designed to deceive you into giving away data like your TMU username and password, credit card number or bank account details.
Many phishing emails include common traits that can make them easy to catch once you learn what they are.
Even though these emails are coming from CCS, the goal is for you to identify the email and not respond by clicking a link or opening an attachment.
A cybersecurity awareness software will be used to help track the success of employees in learning how to recognize phish and malware emails and report them to CCS. Our goal is to teach everyone how to respond to phishing emails, now and in the future. Your dean/chair/supervisor/manager will not be notified of how or if you interact with these emails.
You will be notified immediately with a message on your screen and offered information on how to avoid phishing emails in the future.
Your name and results will be kept confidential—this training is designed to help you learn.
If you do not wish to receive fake phish at all, you are required to successfully complete four campaign opt-out quizzes to demonstrate your understanding of cybersecurity best practices. Please note that completing a quiz and receiving a passing grade revokes your eligibility for TMU's 2023 Cybersecurity Awareness Month employee contest. You will still receive all other campaign messages.
- Week 1 Simulated Phishing Campaign Opt-Out Quiz (external link)
- Week 2 Simulated Phishing Campaign Opt-Out Quiz (external link)
- Week 3 Simulated Phishing Campaign Opt-Out Quiz (external link)
- Week 4 Simulated Phishing Campaign Opt-Out Quiz (external link)
How opting out works
During the first four weeks of October, TMU community members will begin to receive simulated phishing emails to their TMU email addresses. To be removed from each week’s simulated phishing mailing list, you must complete that week’s quiz and receive a passing grade by the deadlines listed below.
Quizzes may be completed weekly or completed all at once.
Quiz completion deadlines
- Week 1 quiz deadline: Thursday, September 28, 2023 by 5 p.m.
- Week 2 quiz deadline: Thursday, October 5, 2023 by 5 p.m.
- Week 3 quiz deadline: Thursday, October 12, 2023 by 5 p.m.
- Week 4 quiz deadline: Thursday, October 19, 2023 by 5 p.m.
What is a passing grade?
A passing grade is 80% or 8 of 10 questions answered correctly.
Contest rules and regulations
- CONTEST. Toronto Metropolitan University (“Toronto Metropolitan”), through Computing and Communications Services (“CCS” or the “Contest Sponsor”), is holding an Employees Phish and Malware Reporting Contest (the “Contest”) to encourage faculty and staff to learn how to recognize phish and malware emails and to report them to CCS.
- CONTEST PERIOD. The Contest is open for Contest Entry (defined below) submissions between 12:00 a.m. on October 1, 2023, and 11:59 p.m. on October 31, 2023, Eastern Standard Time (the “Contest Entry Period”). All Contest Entries must be submitted during the Contest Entry Period. The Contest Sponsor’s server machine is the official timekeeping device for the Contest.
- ELIGIBILITY. The Contest is open to any resident of Canada excluding Quebec who: (i) has reached the legal age of majority in their province/territory of residence at the time of entry; and (ii) who is a Toronto Metropolitan employee (full-time or part-time) , excluding CCS employees and Administration and Operations Communications employees, at the time of Contest Entry (each an “Entrant”).
- HOW TO ENTER. No purchase necessary. Between 12:00 a.m. on October 1, 2023, and 11:59 p.m. on October 31, 2023, CCS will send to all Toronto Metropolitan employees a series of simulated phishing email messages containing simulated malicious links and/or attachments (each an “Email” and collectively “Emails”). The Entrant may enter the Contest at any time during the Contest Entry Period by forwarding using the “forward” function in your email (and not the “forward as attachment” option) three (3) Emails sent to the Entrant’s Toronto Metropolitan email account to email@example.com (together “Contest Entry”). For clarity the three (3) forwarded Emails together make one Contest Entry. If an Entrant clicks on any simulated phishing link(s) and/or opens any simulated phishing attachments and follows malicious directions in more than two (2) Emails, such Entrant will be disqualified from participating in the Contest and will forfeit all rights to a Prize (described below).
- CONTEST ENTRY CONDITIONS. There is a limit of one (1) Contest Entry per Entrant during the Contest Entry Period. Additional Contest Entries submitted by an Entrant will not be counted for the purposes of this Contest. Use of any automated system to enter is prohibited and will automatically result in disqualification. By entering the Contest, you agree that you will comply with these Contest Rules and with the decisions of the Contest Sponsor, which are irrevocable and are legally binding in all matters related to the Contest.
- PRIZES. There are up to ten (10) prizes available to be won in this Contest by up to ten (10) potential winners, each consisting of a pre-paid Amazon eGift Card valued at $100 CAD before applicable taxes (each a “Prize” and collectively “Prizes”). Each Entrant is eligible to win a maximum of one (1) Prize.
- WINNER SELECTION PROCESS.
- On or about November 1, 2023, at 9:00 a.m. Eastern Standard Time in Toronto, Ontario, the Contest Sponsor will select at random ten (10) Contest Entries from all eligible Contest Entries submitted during the Contest Entry Period (the “Selection”). The Contest Sponsor will validate the selected Contest Entries by comparing and confirming the email logs against the message submitted. In the event that, upon validation, a selected Contest Entry is not eligible, the Contest Sponsor will randomly select an additional Contest Entry and validate it until such time as ten (10) validated Contest Entries have been selected and ten (10) potential winners have been identified (each an “Eligible Winner” and collectively “Eligible Winners”). Selected Eligible Winners will each be eligible to receive a maximum of one (1) Prize.
- Within twenty-five (25) business days of the Selection, the Contest Sponsor, or its designated representative, will make a maximum of three (3) attempts to contact the Eligible Winners by emailing the Eligible Winners at the corresponding email address used to submit the eligible Contest Entry. Each Eligible Winner must accept the Prize as awarded by the Contest Sponsor within five (5) business days of the Selection or the Prize will be forfeited and awarded to an alternate Entrant in accordance with the foregoing provisions of this section, at the Contest Sponsor’s sole discretion.
- The Prize is not transferable or substitutable unless authorized in writing by the Contest Sponsor before the transfer or substitution is made.
- The odds of winning a Prize are dependent on the total number of eligible Contest Entries received.
- DECLARATION OF ELIGIBLE WINNER.
- NO ONE IS A WINNER UNLESS AND UNTIL THE SPONSOR OFFICIALLY CONFIRMS THEM AS A WINNER IN ACCORDANCE WITH THESE RULES BEFORE BEING DECLARED A CONFIRMED PRIZE WINNER. Before an Eligible Winner is declared a winner (after declaration, referred to as a ”Winner” and collectively “Winners”), the Eligible Winner must sign and return, within five (5) business days of notification, a declaration of compliance and release of liability prepared by the Contest Sponsor (the “Release”). The Release also requires the Eligible Winner to correctly answer a mathematical skill-testing question without mechanical or other aid.
- By participating in the Contest and accepting a Prize, each eligible winner hereby: (i) confirms compliance with these Rules; (ii) acknowledges acceptance of the applicable Prize (as awarded); (iii) releases Toronto Metropolitan from any and all liability in connection with the Contest, their participation therein and/or the awarding and use/misuse of the applicable Prize or any portion thereof; and (iv) agrees to the publication, reproduction and/or other use of their name, address, voice, statements about the Contest and/or photograph or other likeness without further notice or compensation, in any publicity or advertising carried out by or on behalf of the Contest Sponsor in any manner or medium whatsoever, including print, broadcast or the internet.
- The Eligible Winner will be disqualified and forfeits all rights to the Prize if the Eligible Winner: (i) fails to correctly answer the skill-testing question; (ii) fails to return the properly executed Release within the specified time; (iii) violates any of TMU's policies, procedures, standards, or guidelines during the Contest Period; or (iv) cannot be declared a Winner in accordance with these Contest Rules for any reason. If an Eligible Winner is disqualified, the Contest Sponsor reserves the right, in its sole and absolute discretion, to select another Entrant via random draw (in which case the provisions of Section 7 apply to such new Eligible Winner).
- RIGHT TO SUSPEND/MODIFY/TERMINATE. If for any reason the Contest is not capable of running as planned, including infection by computer virus, bugs, tampering, unauthorized intervention, fraud, technical failures, strike or any other causes which corrupt or affect the administration, security, fairness, integrity or proper conduct of the Contest, the Contest Sponsor reserves the right to cancel, suspend and/or modify the Contest, or any part of it, and disqualify any individual or entity who is responsible for such action. If terminated, the Contest Sponsor may, in its sole discretion, determine the winners from among all eligible Contest Entries received up to time of such action using the procedures outlined herein.
- LIABILITY AND RELEASE. No responsibility or liability is assumed by the Contest Sponsor for: any technical malfunction or other problems of any nature whatsoever, including, without limitation, those relating to the telephone network or lines, computer on-line systems, servers, access providers, computer equipment or software; the failure of any Contest Entry or other information to be received, captured or recorded for any reason whatsoever, including, but not limited to, technical problems or traffic congestion on the internet or at any website; or unauthorized human or non-human intervention of the operation of the Contest, including without limitation, unauthorized tampering, hacking, theft, virus, bugs, or worms.
- GENERAL CONDITIONS
- The decisions of the Contest Sponsor with respect to all aspects of this Contest are final and binding on all entrants without right of appeal. ANYONE DEEMED BY THE CONTEST SPONSOR TO BE IN VIOLATION OF THE LETTER AND/OR SPIRIT OF THESE RULES FOR ANY REASON IS SUBJECT TO DISQUALIFICATION IN THE SOLE AND ABSOLUTE DISCRETION OF THE CONTEST SPONSOR AT ANY TIME.
- In the event of any discrepancy or inconsistency between the terms and conditions of these Rules and disclosures or other statements contained in any Contest-related materials, the terms and conditions of these Rules shall prevail, govern and control to the fullest extent permitted by law.
- The invalidity or unenforceability of any provision of these Rules shall not affect the validity or enforceability of any other provision. In the event that any provision is determined to be invalid or otherwise unenforceable or illegal, these Rules shall otherwise remain in effect and shall be construed in accordance with the terms as if the invalid or illegal provision were not contained herein.
- All issues and questions concerning the construction, validity, interpretation and enforceability of these Rules or the rights and obligations of participants, Contest Sponsor or any of the other the Released Parties in connection with the Contest will be governed by and construed in accordance with the domestic laws of the Province of Ontario. The parties hereby consent to exclusive jurisdiction and venue of the courts located in Ontario in any action to enforce (or otherwise relating to) these Rules or relating to this Contest.