Data Security

Only allow those who are working with data to access that data. Users should not be able to access/edit data that they don’t need to.  

Review who has access when people join, change role or leave. 

Know the classification of your data before you store or share it. AU has four classification levels (Classification of data). 

Do not use AI for confidential or sensitive data (Your guide to using GAI responsibly  ) 

Do not use the same password for all platforms.  

Change passwords semi regularly, especially if in the case of a suspected leak.  

Try to use a long passphrase or a complex password instead of names, birth dates, simple sequences or short combinations of numbers. 

Never share your login and avoid writing passwords down. 

Activate two-factor authentication wherever possible. AU recommends the Microsoft Authenticator app ( Useful information about two-factor authentication at AU  ) 

If you get a login approval request or a verification code you didn’t ask for, don’t approve it and let IT know. 

Time pressure: We get many emails and texts every day, and cybercriminals count on us replying before we have read the message properly. Be careful with messages that push you to act quickly, such as “your account will be closed today”. Stop and think before you reply. 

Fear of missing out: Cybercriminals play on the fear of losing a privilege or access to a system. A real example from AU was a message telling staff to check MitHR or risk losing their holiday. 

Prospect of gain: Be especially careful with big discounts or the promise of money, whether in emails or on websites. If it seems too good to be true, it probably is. 

Authority: The sender pretends to be your bank, your employer, the tax office or another institution you trust. No legitimate sender will ask for login information, MitID details, account details or other confidential information by email or text.  

The sender claims to be Aarhus University, Microsoft or another third party you trust, but the email address belongs to a different domain. Watch for lookalikes, such as a changed letter in au.dk. For colleagues, check that the address matches their contact on their PURE profile. 

The text has spelling or punctuation mistakes, or phrasing that feels unusual. 

You are greeted by your email address instead of your name. 

You are asked to click a link in an email or text message. These links can lead to fake pages built to collect your personal information. 

You are asked to scan a QR code. Be careful, especially in emails that appear to come from the public sector. QR codes are used a lot, but they can easily hide a malicious link. 

Take a moment to check the sender’s email address, not just the display name. Watch for lookalike domains, such as a changed letter in the address. For colleagues, check that the address matches their contact on their PURE profile.  

Do not open suspicious links or attachments from unfamiliar sites.  

Hover over a link to see where it really goes before clicking. 

If an email asks for something unusual, such as sensitive data, a payment or a change of bank details, check with the person through another channel, like a call or Teams, even if it appears to come from a colleague or manager. 

Be wary of any website or message that asks you to copy a command and run it yourself, for example by pressing Windows + R or opening a terminal and pasting something. Fake “verify you are human” or “fix this error” pages use this trick a lot. 

Privacy filter: If working with sensitive and/or confidential data and sitting in an open/shared office, or if having an advisory function with lot of different people visiting your office, consider if a privacy screen filter for your computer monitor is necessary to avoid disclosing sensitive and/or confidential data to students, guests, or employees without access authentication. Order privacy filters from AU IT webshop.  

Printed documents: Also make sure that AU documents are not lying around so they can be seen by visitors or passers-by. You can request a non-transparent folder for sensitive and/or confidential documents on your desk from your secretariat. 

Do not walk away from your laptop with it unlocked. Even if it’s in your own office.  

Do not leave your office unlocked/open while away for a long period of time, if it has equipment with data on it (or just generally).  

Do not throw documents with sensitive information in a normal bin. Shred them, and use secure printing so they don’t end up on the wrong printer. 

Store data online on secure and reliable platforms.  

When in doubt, ask! Contact IT or find your local data manager and double check when you’re unsure, or things don’t feel right. It’s better to be safe than sorry.  

Recommend using Privacy Screen Filters, both for laptops and mobile phones, if working in public spaces or for external meetings where relevant. Privacy Screen Filters AU IT webshop 

Do your best to keep equipment holding your data with you at all times. Do not leave your equipment unattended in public places, especially not while unlocked/logged into.  

Use safe internet transfer protocols, like sftp, rather than using physical hardware to move data. If physical hardware is required, only use reputable and safe methods. Consult with IT if you are unsure.  

On public Wi-Fi, it's a good idea to use VPN. Only join networks that need a password and delete the network from your device afterwards. 

Travelling to a high-risk country? AU requires a travel computer and phone. Take as little data as possible and contact IT support before the trip.