The things that make the University of Melbourne such an attractive place to study and work also make us a target for cybercrime. Our world-leading research, valuable intellectual property and the many personal and financial details the University holds make both individuals and the institution vulnerable to the impacts of cyberthreats.
Our Approach to Cybersecurity
The University is working to continuously evolve our cybersecurity capabilities to prevent, detect, disrupt and respond to existing and emerging cyberthreats. As a key centre for innovation within our community, the University pushes the boundaries of conventional use of technology but we do so with a focus on protecting our systems and information.
A cybersecure University of Melbourne is one where we’ve reduced our vulnerability to cyberthreats while balancing our need for openness, autonomy and collaboration. A risk-based approach to cybersecurity means we can better meet these needs while still managing our exposure to cybersecurity risk.
Student Cybersecurity quiz competition
Win one of two AirPods Pro by taking the Cybersecurity quiz below!
To enter:
1. Take the following Cybersecurity quiz or you can copy and paste the following link in your preferred browser: https://go.unimelb.edu.au/w6xe
Competition runs 16 May 2022 - 26 May 2022
Terms and Conditions
-
Schedule to the terms
1. Competition
Cybersecurity Quiz for Students
2. University
The University of Melbourne [ABN 84 002 705 224], of Parkville, Victoria 3010, Australia
3. Competition website (clause 1)
4. Time Zone
Victoria, Australia
5. Competition Period (clause 4)
Competition Period commences: 9:00am on Monday 16 May 2022
Competition Period ends: 11:59pm on Thursday 26 May 2022
6. Entry Restrictions (clause 5)
- Eligibility: entry is only open to individuals who, during the Competition Period, are current students of The University of Melbourne.
- Ineligibility: employees of The University of Melbourne are not eligible to enter this Competition.
7. Entry Method (clause 6)
To enter the Competition, entrants must: take the Cybersecurity quiz that will be provided.
Each entrant may only enter the Competition once.
Maximum Number of Entries (clause 7)
There is no limit to the number of times that each entrant may enter the Competition.
Use of Personal Information(clause 9(d)
No additional purposes.
Privacy Laws (clause 9)
Privacy and Data Protection Act 2014 (Vic)
11. Privacy Policy (clause 9)
12. Privacy Contact Details (clause 9)
The University of Melbourne
Department: Legal and Risk, University Services
Name: Privacy and Data Protection Officer
Telephone number: 13 63 52
Email address: privacy-officer@unimelb.edu.au13. Content (clause 10)
Any materials submitted by an entrant via the Competition including but not limited to videos, photos, responses, written material, presentations, comments, recordings, images, and prototypes.
14. Use of Competition Entry (clause 11(b))
In addition to clause 11, each entrant licenses and grants the University and its affiliates a non-exclusive, fee-free, royalty-free, perpetual, world-wide, irrevocable and sub-licensable right to use, reproduce modify, adapt, publish and display their entry (including Content):
- for all the University’s ongoing promotional activities (such as regramming, advertising, marketing material, media releases, printed material, use on the University’s website and social media channels), and includes promotional purposes not related to this Competition;
15. Judging Details (clause 14)
GAME OF CHANCE
This is a game of chance. The Winner will be determined by a randomly selected prize draw. The prize draw will take place on Friday 27 May 2022 at The University of Melbourne, Victoria 3010.
16. Winner(s) (clause 14)
Two Competition Winners
17. Prize (clause 15)
2 x Apple AirPods Pro headphones of equal value (AU$399)
18. Winner(s) Notification (clause 16)
Each Winner will be contacted in writing via their submitted contact details on 30 May 2022.
19. Claim Prize
(clause 17)Each Winner must contact the University by 3 June 2022 and:
- confirm their mailing address to receive the Prize; or
- collect the Prize in person by presenting proof of identity at an agreed time and location.
20. Replacement Winner(s) (if required)
(clause 18)The re-selection of the Winner(s) (if required) will take place in accordance with the same Judging Details as specified in item 15 of the Schedule on 14 June 2022.
21. Replacement Winner(s) Notification (if required) (clause 18)
Any Replacement Winner(s) will be contacted via their submitted contact details by 17 June 2022.
22. Replacement Winner(s) Claim Prize (if required) (clause 18)
Any Replacement Winner(s) must contact the University in accordance with the same Claim Prize requirements as specified in item 19 of the Schedule by 1 July, 2022.
-
General Terms
ENTRANTS
- By entering the Competition, you agree to be bound by the Terms of the Competition. The Terms governing the Competition include these General Terms, the Schedule to these Terms and any instructions relating to the Competition on the Competition Website. Only entries that comply with the Terms will be considered valid entries to this Competition.
- Any capitalised terms used in these General Terms have the meaning given in the Schedule, unless stated otherwise. In the event of any inconsistency between the Schedule to the Terms (Schedule) and these General Terms, the Schedule will take precedence.
- Time Zone. All times and dates in the Terms refer to the Time Zone in operation at the time of the Competition.
- Competition Period. The Competition will be conducted during the Competition Period. The University is not responsible for any entry that is not received by the University during the Competition Period, for whatever reason. Incomplete or indecipherable entries will not be accepted.
- Entry Restrictions. Eligibility to enter the Competition is subject to the Entry Restrictions. If entrants under the age of 18 are eligible to enter this Competition, they must have the consent of their parent or guardian to enter the Competition.
- Entry Method. To enter the Competition, entrants must enter the Competition in accordance with the Entry Method (and any other entry details provided by the University on the Competition Website) during the Competition Period. If entrants are required to enter the Competition via a social media platform, each entrant must have an applicable social media account set to public during the Competition Period and must comply with the relevant social media terms and conditions.
- Maximum Number of Entries. Entrants can enter the Competition up to the Maximum Number of Entries. Entries must be submitted separately and entry must individually meet the requirements in the Schedule and are subject to the Entry Restrictions.
- Each entrant is responsible for their own travel and other costs associated with entering the Competition.
- Use of Personal Information. By entering this Competition each entrant agrees that:
(a) the University may use their name and contact details for the purpose of conducting the Competition, including complying with its relevant regulatory obligations;
(b) the University may publish the Winner’s name in compliance with its regulatory obligations in conducting this Competition;
(c) at the University’s request, the Winner will take part in the University promotional activities which may include their name and image published in the University’s promotional materials (such as the University’s website, marketing materials, advertising, printed materials and social media channels) and for ongoing promotional activities not related to this Competition; and
(d) the University may use their personal information for the additional purposes identified in Use of Personal Information (item 9 of the Schedule).
Privacy Laws and Privacy Policy. Under Privacy Laws, ‘personal information’ means any recorded information or opinions (whether true or not) that identify an individual or allow an individual to be identified. The University is committed to protecting personal information provided by you in accordance with Privacy Laws. The University has a comprehensive privacy policy addressing issues relating to the use, collection, security and access to personal information available at the Privacy Policy. All information collected by the University is governed by the Privacy Policy. For further information about how the University deals with personal information, please refer to the Privacy Policy or contact the University’s Privacy Officer at privacy-officer@unimelb.edu.au.
Privacy Contact Details. You may access any personal information you have provided by contacting the University staff member identified in the Privacy Contact Details.
- Content. Entrants agree that they are fully responsible for any Content. The University is not liable in any way for such Content to the full extent permitted by law and may remove or decline to publish any Content without notice for any reason whatsoever. Entrants warrant and agree that:
(a) they will not submit any Content that is unlawful or fraudulent, or that the University may deem in breach of any intellectual property, privacy, publicity or other rights, defamatory, obscene, derogatory, pornographic, sexually inappropriate, violent, abusive, harassing, threatening, objectionable with respect to race, religion, origin or gender, not suitable for children under 14, or otherwise unsuitable for publication;
(b) their Content shall not contain viruses or cause injury or harm to any person or entity;
(c) they will obtain prior consent from any person who, or from the owner(s) of any property that, appears in their Content;
(d) the Content is the original work of the entrant that does not infringe the rights of any third party or otherwise they will obtain full prior consent from any person who has jointly created or has any rights in the Content to the uses contemplated by these Terms, and the Content does not infringe the rights of any third party;
(e) they consent to any use of the Content which may otherwise infringe the Content creator’s/creators’ moral rights pursuant to the Copyright Act 1968 (Cth) and warrant that they have the full authority to grant these rights; and
(f) they will comply with all applicable laws and regulations, including without limitation, those governing copyright, content, defamation, privacy, publicity and the access or use of others' computer or communication systems.
Without limiting any other terms herein, the entrant agrees to indemnify the University for any breach of the above terms.
- Use of Competition Entry. As a condition of entering this Competition, each entrant licenses and grants the University and its affiliates a non-exclusive, fee-free, royalty-free, perpetual, world-wide, irrevocable and sub-licensable right to use their entry (including Content) for:
(a) the purposes of conducting and promoting the Competition; and
(b) the additional purposes identified in Use of Competition Entry (item 14 of the Schedule).
The University will not enter into commercial arrangements or directly profit from the licence.
- If this Competition is interfered with in any way or is not capable of being conducted as reasonably anticipated due to any reason beyond the reasonable control of the University, including but not limited to technical difficulties, unauthorised intervention or fraud, the University reserves the right, in its sole discretion, to the fullest extent permitted by law:
(a) to disqualify any entrant; or
(b) to modify, suspend, terminate or cancel the Competition, as the University deems appropriate.
- Except for any liability that cannot by law be excluded, including any statutory consumer guarantees provided under the consumer protection laws of Australia, the University (including its respective officers, employees and agents) excludes all liability (including negligence) for any personal injury, or any loss or damage (including loss of opportunity), whether direct, indirect, special or consequential, arising in any way out of the Competition.
WINNER
- Judging Details and Winner. The Winner will be determined from the valid Competition entries received by the University in accordance with the Judging Details.
- Prize. The Prize will be awarded as specified in the Schedule. The Prize values are the recommended retail value as provided by the relevant supplier, are in Australian dollars, are correct as at the time of the commencement of the Competition Period and are inclusive of all taxes. If the Prize is in the form of a gift voucher the Winner must comply with the gift voucher’s terms and conditions. The Winner must claim the Prize in accordance with Claim Prize. Please allow at least 28 days from the date of notification for the delivery of the Prize. Transport to claim the prize is not part of the prize and is the sole responsibility of the Winner. The Prize cannot be exchanged or redeemed for other goods, services, cash or credit. If, for some reason the Prize is unavailable, the University reserves the right to substitute the Prize for a prize of equal or greater value.
- Winner Notification. The Winner will be notified in accordance with Winner Notification. The Winner may also be announced in accordance with clause 9(b) above.
- Claim Prize. If the Winner does not comply with these Terms and/or does not claim the Prize in accordance with Claim Prize, the University reserves the right to select a replacement winner from the remaining valid entries in accordance with clause 14 above.
- Replacement Winner. If a winner re-selection is required, the selection of the replacement winner will be conducted by the University in accordance with Replacement Winner. The Replacement Winner will be notified in accordance with Replacement Winner Notification. The Replacement Winner may also be announced in accordance with clause 9(b) above. The Replacement Winner must claim the Prize in accordance with Replacement Winner Claim Prize.
- The entrants are not agents of The University of Melbourne and must not convey that impression to anyone.
- The result of the Competition is final and no correspondence will be entered into.
Multifactor Authentication (MFA)
Multifactor Authentication (MFA) is an additional security step to verify your identity when you login to key University applications. This extra layer of security protects your user account from unauthorised access.
How Multifactor Authentication works
-
When you'll be prompted to verify
MFA may prompt you at any time to confirm it’s really you logging in:
- The first time you login to a browser that you have not logged into before
- The first time you access your applications from a device that you have not logged into before
- Any time you login from a country that is different to the country of your last login
-
Security benefits of MFA
MFA helps protect accounts by adding an additional verification step to confirm the identity of users so that even if a cyber-criminal knows an individual’s password, the added layer will stop them accessing user accounts and key information such as:
- Your name
- Your address
- Bank Details
- Medical Records
- Your work and files
Your MFA options
 Okta Verify app (Primary factor for staff and students) |  Google Authenticator app (Recommended backup factor) | |
|---|---|---|
| What's required? | Okta Verify app downloaded to smartphone or tablet | Google Authenticator app downloaded to smartphone or tablet |
| How it works | User accepts a push notification sent in the app or User types in a six-digit verification code generated by the app when offline | User types in a six-digit verification code generated by the app |
| Supports push notifications | Yes | No |
| Minimum Mobile device requirements | Yes - iOS 13.0 compatible device - Android version 7.0+ - Windows Phone version 8.0+ | Yes - Android version 2.3.3+ - iOS version 7.0+ |
| Available offline | Yes | Yes |
| Works with VPN | Yes | Yes |
| Can be installed on more than one smart device | No | Yes The University recommends using Google Authenticator as a backup factor |
Ready to Enrol?
Visit the Enrolling for MFA page using the button below to quickly and easily enrol your smartphone for MFA.
Staff Support
Chat with a Service Centre agent
+61 3 834 40888
(7:30am - 7:30pm weekdays)
Student Support
13 Melb (13 6352)
(Within Australia)
+61 3 9035 5511
(Outside Australia)
Enrolling for MFA
Here you will find out how to quickly and easily enrol for Multifactor Authentication.
At the University of Melbourne, your online security is important to us. To help protect your information we use multifactor authentication (MFA), which requires both a password and secondary means (factor) to verify your identity, in order to login to University applications. Please refer to the information below to set up multi-factor authentication (MFA) on your smartphone.
Why is Multifactor Authentication important?
You will need:
- Internet access on a web browser.
- A compatible smartphone with data connection.
Compatible Smartphone or Tablet Operating Systems
- iOS 13.0 compatible device
- Android version 7.0+
- Windows Phone version 8.0+
MFA Enrolment Quick Reference Guides
For more information on Multifactor Authentication, please select any of the previews or links below to download a useful visual step-by-step guide:
Getting Started
How to
How to
How to Setup
MFA Enrolment Video Guides
Apple Devices
Android Devices
First Time Log In
MFA Support
Have a question or need help?
Visit the MFA Support & FAQ page for frequently asked questions and additional support:
Staff Support
Chat with a Service Centre agent
+61 3 834 40888
(7:30am - 7:30pm weekdays)
Student Support
13 Melb (13 6352)
(Within Australia)
+61 3 9035 5511
(Outside Australia)
Staff Support
Chat with a Service Centre agent
+61 3 834 40888
(7:30am - 7:30pm weekdays)
Student Support
13 Melb (13 6352)
(Within Australia)
+61 3 9035 5511
(Outside Australia)
Privacy Collection Notice
The collection of personal information by the University of Melbourne (University) is governed by the Privacy and Data Protection Act 2014 (Vic) and Health Records Act 2001 (Vic) (together, Privacy Laws). The University is also considered to be a data controller for the purposes of the EU General Data Protection Regulation 2016/679 (GDPR)regarding the collection of personal information from individuals located in the EU, when conducting certain activities. The University is committed to protecting your privacy and processing your personal information fairly and lawfully in compliance with the Privacy Laws and the GDPR, as applicable.
The information you provide will be collected by the University for the legitimate interest of administering your University IT access. The University is using third-party service provider, Okta, to assist in administering multi-factor authentication. Okta has established a privacy policy to help users understand how Okta collects and uses personal information. Please refer to Okta’s Privacy Policy for details: https://www.okta.com/privacy-policy/.
The information may also be used by the University or Okta for analysis, quality assurance and planning purposes. We may be unable to provide you with IT access if you do not provide the personal information requested. The provision of your biometric data is voluntary and based on your consent.
The information you provide will be used by authorised staff for the purpose for which it was collected. It will not be transferred outside Australia unless to an entity operating under substantially similar privacy obligations. We will not disclose your personal information to anybody else without your consent, unless we are authorised or required to do so by law. We take all reasonable steps to ensure that the information we hold is accurate and complete, and that appropriate technical and organisational security measures are in place and maintained to protect personal information that is transmitted, stored or otherwise processed, from accidental or unlawful destruction, misuse, loss, alteration, unauthorised access or disclosure.
We will only retain your personal information for as long as required for the purpose for which it was collected and in accordance with our legislative obligations. This information will then be securely destroyed in accordance with the University’s retention and disposal authority.
You may also request access to, or correction of your personal information held by the University, or exercise data subject rights under the GDPR or withdrawal of your consent if applicable. To do so, students may contact 13 MELB (13 6352) or Staff can log a request with Staff Services https://unimelb.service-now.com/sp.
For further information about how the University manages personal information, to make an enquiry or complaint, or for contact details of the University’s Privacy and Data Protection Officer, please view the University’s Privacy Policy, visit our Privacy Webpage, or contact the University’s Privacy Office at privacy-officer@unimelb.edu.au.
For students, any issues regarding system access or queries prior to completing online forms should be directed to 13 MELB (13 6352) or Stop 1 https://students.unimelb.edu.au/stop1.
For staff, any issues regarding system access should be directed to the University of Melbourne Service Centre on (03) 8344 0888. If you have any queries about this application prior to completing your online form please contact your supervisor or their nominated administrator.
Reporting a Security Vulnerability
The University of Melbourne is committed to ensuring the security and privacy of its information, systems, and services, and we value the help of security researchers in reducing cyber risks.
If you suspect you have found a security issue that could be used to compromise the integrity, availability, or confidentiality of University of Melbourne information, systems or services, please share the details with us by using the web form below.
We will acknowledge receipt of all vulnerabilities reported via this process, conduct a thorough investigation, and then take appropriate action for resolution.
The following types of activities should not be undertaken:
- clickjacking
- social engineering or phishing
- network or service denial of service (DDoS or DoS)
- physical attacks
- modify or destroy data (or attempt to do this)
The University has processes to handle the below issues and they should not be reported:
- weak or insecure SSL ciphers and protocols
- expired or self-signed certificates and certificate vulnerabilities
- open ports