CUNY Login Account
IT SUPPORT
- Request Services*
- Report Incidents*
- LehmanQ (Live Support)
- Lehman IT Knowledge Base
Cybersecurity Awareness Month (October 2026)
October is Cybersecurity Awareness Month, an international initiative that helps everyone take simple steps to stay safe online. This year's theme is “Don't Make It Easy for Them” — a reminder that building good cybersecurity habits and practicing them consistently can make life more difficult for cybercriminals.
CUNY is proud to support this effort in partnership with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA).
Throughout October, we will highlight five simple defensive behaviors across four weekly topics to help you stay safer online — no expertise required:
- Week 1 – Use Strong, Unique Passwords and a Password Manager (Oct 5)
- Week 2 – Enable MFA Everywhere (Oct 13)
- Week 3 – Keep Software Updated (Oct 19)
- Week 4 – Scrutinize Every Message (Oct 26)
Additional Resources
Here are some helpful resources to strengthen your online safety practices:
- Cybersecurity Awareness Month 2026 – National Cybersecurity Alliance (NCA)
- Secure Our World – CISA
- Secure Our World: Cybersecurity Awareness Month Resources – CIS
- CUNY Cybersecurity Best Practices
- CUNY Information Security Resources
- Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 – NCA & CybSafe
Facts and Figures
Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:
- Awareness of multi-factor authentication (MFA) increased from 52% in 2021 to 77% in 2025, yet regular MFA use was only 53% in 2025.
- Concern about cybercrime increased from 57% in 2022 to 68% in 2025.
- 31% of participants believe losing money online is unavoidable, up from 25% in 2022.
- Phishing accounted for 40% of reported cyber incidents in 2025.
Week 1 : Use Strong, Unique Passwords and a Password Manager (Oct 5)
This week, we focus on "Use Strong, Unique Passwords and a Password Manager," an essential step in protecting your accounts and personal information. Strong passwords are a foundation of online security. Using a strong, unique password for every account helps prevent one compromised password from putting your other accounts at risk. CUNY's Cybersecurity Best Practices recommend choosing strong and unique passwords for every account or application and never sharing your password.
A password manager can also make it easier to manage multiple strong, unique passwords by securely creating and storing them.
Helpful Password Tips
- Make passwords long: at least 13 characters (longer is better).
- Use random strings or passphrases: combine unrelated words or mix letters, numbers, and symbols.
- Create unique passwords for every account: never reuse the same one.
- Create a memorable but strong password: Consider using a long passphrase made up of unrelated words that is easy for you to remember but difficult for others to guess.
- Check for reused passwords: Review your important accounts and replace any passwords you have reused. Each account should have its own unique password.
- Consider using a password manager: It can help generate and securely store strong, unique passwords.
- Never Share Your Credentials: Never share your password, MFA codes, or any other authentication credentials with anyone, under any circumstances, including fellow students, faculty, staff, supervisors, subordinates, executives, contractors, vendors, or IT personnel. Legitimate support staff will never ask for your password or MFA code. If anyone requests or pressures you to provide your credentials, report the incident immediately to Student Affairs, Human Resources, or your Information Security Office.
Password Resources
Here are some helpful resources to strengthen your online safety practices:
- CUNY Cybersecurity Awareness Month – Password Guidance
- CUNY Cybersecurity Best Practices
- How to Create Strong Passwords (and Remember Them!) – NCA
- What Is a Password Manager? Time to Log in Safer – NCA
- Secure Our World – CISA
Facts and Figures
Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:
- 62% of respondents report regularly creating unique passwords, a decline from the previous year.
- 41% of respondents never use a password manager.
Helpful Cybersecurity Tips
Week 2: Enable MFA Everywhere (Oct 13)
This week, we focus on Enable MFA Everywhere - including your personal accounts.
A password alone may not be enough to protect your accounts. Multi-factor authentication provides an additional layer of security by requiring another method of verification when you sign in.
At CUNY, MFA helps protect University systems and services. CUNY Login MFA is used for applications such as CUNYfirst and Brightspace, while Microsoft MFA protects access to Microsoft 365 services. Whenever MFA is available for your personal accounts, enable it there as well.
Helpful MFA Tips
- Enable MFA wherever it is available, particularly on accounts containing personal, financial, or sensitive information.
- Never share your password or MFA passcode with anyone.
- Never approve an MFA request you did not initiate, and carefully verify any number, location, or application information displayed before approving the request. For example, if you receive an MFA approval request when you are not trying to sign in, deny the request and report it to your college IT office. This could mean someone is attempting to access your account.
- For Microsoft MFA at CUNY, set up more than one authentication method when possible so you have a backup if your primary method is unavailable. CUNY lists Microsoft Authenticator as the most convenient second-factor option.
MFA Resources
- CUNY Microsoft Multi-factor Authentication (MFA)
- CUNY Cybersecurity Awareness Month
- CISA – Turn On MFA
Facts and Figures
Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:
- Awareness of multi-factor authentication (MFA) increased from 52% in 2021 to 77% in 2025.
- Despite increased awareness, regular MFA use was only 53% in 2025.
Helpful Cybersecurity Tips
- CUNY Cybersecurity Best Practices
- Secret Shopper, Personal Assistant, and Other Online Scams
- CUNY Information Security Resources
- CUNY Security Awareness
- CUNY IT Security Awareness Course
Students, faculty, and staff should log into Brightspace and complete the latest cybersecurity awareness training course under the Compliance or Organization tab.
If you have any questions about any of this information, please contact Alexis Veras, Information Security Manager.
Week 3: Keep Software Updated (Oct 19)
This week, we focus on Keep Software Updated.
Keeping your software updated is an important part of protecting your devices and information. Updates often include security patches that address newly discovered vulnerabilities. CUNY's Cybersecurity Best Practices recommends installing software updates as they are released, including Microsoft and Apple software security updates, and maintaining up-to-date antivirus and antimalware software.
Don't put off important updates. Keeping your operating system, applications, web browsers, and security software current helps protect both your personal information and University data.
Helpful Software Update Tips
- Turn on automatic updates whenever possible.
- Install updates promptly instead of repeatedly selecting “Remind me later.”
- Keep your operating system, applications, web browsers, and security software current.
- Download software and updates only from trusted sources, such as official vendor websites or app stores. Avoid clicking on unexpected or suspicious pop-ups that claim your software needs to be updated.
Software Update Resources
- CISA - Understanding Patches and Software Updates
- National Cybersecurity Alliance - Why You Should Update Software for Security and How to Do It
- CISA – Secure Our World
- Cybersecurity Awareness Month Resources
Facts and Figures
Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:
- The percentage of respondents who reported always installing software updates declined from 44% in 2021 to 31% in 2025.
- The five-year study found that routine cybersecurity maintenance habits, including installing software updates, weakened over time despite increased cybersecurity awareness.
Helpful Cybersecurity Tips
- CUNY Cybersecurity Best Practices
- Secret Shopper, Personal Assistant, and Other Online Scams
- CUNY Information Security Resources
- CUNY Security Awareness
If you have any questions about any of this information, please contact Alexis Veras, Information Security Manager.
Week 4: Scrutinize Every Message (Oct 26)
This week, we focus on Scrutinize Every Message.
Phishing and online scams remain common ways cybercriminals try to steal personal information, credentials, or gain access to accounts. Be cautious with unexpected emails, texts, and other messages, especially those that ask you to act urgently, provide sensitive information, open an attachment, or click a link.
Before responding or taking action, check the sender, examine links carefully, and consider whether the request makes sense. If a message appears suspicious, don't click the link or open the attachment. At CUNY, suspicious emails should be reported directly through Outlook using the Report Phish button. The button's appearance and location may vary depending on your version of Outlook.
Helpful Message Safety Tips
- Be cautious with unexpected messages, especially those requesting personal, financial, or account information.
- Check the sender carefully and examine links before clicking.
- Be suspicious of urgency or pressure designed to make you act without thinking.
- Don't open unexpected attachments or click suspicious links.
- Verify questionable requests another way by contacting the person or organization using contact information you already know or find independently—not the information provided in the suspicious message. If you believe you clicked a suspicious link or entered your credentials on a suspicious website, contact your college IT office immediately.
- Report suspicious emails: Select the suspicious email in Outlook, click the Report Phish button, and confirm if prompted. Try to avoid forwarding suspicious emails to your campus help desk, IT staff, or colleagues for review. For step-by-step instructions, see the Knowledge Base Article.
Phishing and Message Safety Resources
- CISA – Recognize and Report Phishing
- National Cybersecurity Alliance – What Is Phishing? How to Spot and Avoid Phishing Scams
- National Cybersecurity Alliance – Reporting Cybercrime
Facts and Figures
Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:
- In 2025, phishing accounted for 40% of reported cyber incidents.
- The five-year study found that confidence in identifying phishing messages increased, even as cybercrime victimization continued to rise.
Helpful Cybersecurity Tips
- CUNY Cybersecurity Best Practices
- Secret Shopper, Personal Assistant, and Other Online Scams
- CUNY Information Security Resources
- CUNY Security Awareness
If you have any questions about any of this information, please contact Alexis Veras, Information Security Manager.
IT SUPPORT
- Request Services*
- Report Incidents*
- LehmanQ (Live Support)
- Lehman IT Knowledge Base