Required course assignment emails from SAS-LMS@SAS.COM are legitimate and should also appear in your Learning Management System plan. Future SABA emails will now arrive as verified emails.
In case you missed it, here's what Brian Wilson, SAS Chief Information Security Officer, communicated on InsideSAS last week:
As the challenges to stay in front of threats change from day to day, the target remains the same: YOU.
The number of potential cyber threats against our infrastructure and data grow every day, and this reiterates the need to have security-conscious employees who can be champions for security awareness and models for others.
SAS is taking a multifaceted approach to educating our employees about security policy changes and practices as we apply updates and align to shifting compliance requirements and industry changes. To ensure that all employees are aware of our current policies and prepared against such security threats, SAS strives to provide training opportunities that are designed to better help you understand your role in protecting yourself, SAS and our customers. These education opportunities may come as direct employee emails, InsideSAS articles, Yammer discussions or required training modules.
As part of this multi-faceted approach, and to help reinforce some of the more common scenarios utilized to infiltrate companies like SAS, we will begin releasing targeted, internal phishing campaigns with the goal of helping employees spot situations that should arouse suspicion. Our goal is to eventually gamify these campaigns to make them something people look forward to rather than viewing them as punitive.
As an employer, we have a responsibility and contractual obligations to better prepare employees to identify and respond to security threats should such an event take place. Ensuring employees have access to proper security awareness training can positively reduce the potential impact that a phishing or social engineering event could cause. This training will occur on an annual basis to adapt our policies around current security issues and to keep security top of mind.
Employees and select contractors will continue to see automated assignments, including emails from SAS-LMS@SAS.COM, for both Acceptable Use Policy (AUP) Training and Phishing & Social Engineering Training courses, each requiring completion within 90 days. You’ll find these assigned courses in your Learning Management System plan. The AUP training outlines SAS’ rules in place to protect SAS, SAS’ workforce and our customers worldwide, while the Phishing & Social Engineering training targets the most common avenue that an attacker can use to gain access to SAS data.
Thank you again for doing your part to help keep SAS secure!
Learn more about phishing scams and how to report a suspected phishing attempt.
Thanks for the kind reminder 
