Cybersecurity Awareness Month (October 2026)

Week 1 : Use Strong, Unique Passwords and a Password Manager (Oct 5)

This week, we focus on "Use Strong, Unique Passwords and a Password Manager," an essential step in protecting your accounts and personal information. Strong passwords are a foundation of online security. Using a strong, unique password for every account helps prevent one compromised password from putting your other accounts at risk. CUNY's Cybersecurity Best Practices recommend choosing strong and unique passwords for every account or application and never sharing your password.

A password manager can also make it easier to manage multiple strong, unique passwords by securely creating and storing them.

Helpful Password Tips

• Make passwords long: at least 13 characters (longer is better).
• Use random strings or passphrases: combine unrelated words or mix letters, numbers, and symbols.
• Create unique passwords for every account: never reuse the same one.
• Create a memorable but strong password: Consider using a long passphrase made up of unrelated words that is easy for you to remember but difficult for others to guess.
• Check for reused passwords: Review your important accounts and replace any passwords you have reused. Each account should have its own unique password.
• Consider using a password manager: It can help generate and securely store strong, unique passwords.
• Never Share Your Credentials: Never share your password, MFA codes, or any other authentication credentials with anyone, under any circumstances, including fellow students, faculty, staff, supervisors, subordinates, executives, contractors, vendors, or IT personnel. Legitimate support staff will never ask for your password or MFA code. If anyone requests or pressures you to provide your credentials, report the incident immediately to Student Affairs, Human Resources, or your Information Security Office.

Password Resources

Here are some helpful resources to strengthen your online safety practices:

• CUNY Cybersecurity Awareness Month – Password Guidance
• CUNY Cybersecurity Best Practices
• How to Create Strong Passwords (and Remember Them!) – NCA
• What Is a Password Manager? Time to Log in Safer – NCA
• Secure Our World – CISA

Facts and Figures

Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:

• 62% of respondents report regularly creating unique passwords, a decline from the previous year.
• 41% of respondents never use a password manager.

Helpful Cybersecurity Tips

• CUNY Cybersecurity Best Practices
• Secret Shopper, Personal Assistant, and Other Online Scams
• CUNY Information Security Resources
• CUNY Cybersecurity Awareness Training / Security Awareness

Week 2: Enable MFA Everywhere (Oct 13)

This week, we focus on Enable MFA Everywhere - including your personal accounts.

A password alone may not be enough to protect your accounts. Multi-factor authentication provides an additional layer of security by requiring another method of verification when you sign in.

At CUNY, MFA helps protect University systems and services. CUNY Login MFA is used for applications such as CUNYfirst and Brightspace, while Microsoft MFA protects access to Microsoft 365 services. Whenever MFA is available for your personal accounts, enable it there as well.

Helpful MFA Tips

• Enable MFA wherever it is available, particularly on accounts containing personal, financial, or sensitive information.
• Never share your password or MFA passcode with anyone.
• Never approve an MFA request you did not initiate, and carefully verify any number, location, or application information displayed before approving the request. For example, if you receive an MFA approval request when you are not trying to sign in, deny the request and report it to your college IT office. This could mean someone is attempting to access your account.
• For Microsoft MFA at CUNY, set up more than one authentication method when possible so you have a backup if your primary method is unavailable. CUNY lists Microsoft Authenticator as the most convenient second-factor option.

MFA Resources

• CUNY Microsoft Multi-factor Authentication (MFA)
• CUNY Cybersecurity Awareness Month
• CISA – Turn On MFA

Facts and Figures

Insights from the Oh Behave! Cybersecurity Attitudes and Behaviors Report: 2021–2025 (National Cybersecurity Alliance & CybSafe) are as follows:

• Awareness of multi-factor authentication (MFA) increased from 52% in 2021 to 77% in 2025.
• Despite increased awareness, regular MFA use was only 53% in 2025.

Helpful Cybersecurity Tips

• CUNY Cybersecurity Best Practices
• Secret Shopper, Personal Assistant, and Other Online Scams
• CUNY Information Security Resources
• CUNY Security Awareness
• CUNY IT Security Awareness Course
  Students, faculty, and staff should log into Brightspace and complete the latest cybersecurity awareness training course under the Compliance or Organization tab.

Our emails and supporting information are available from the Cyber Security Awareness Month (NCSAM) page on the CUNY web site.

We also provide a growing security resources list on the CUNY Information Security pages. You may also want to visit the OUCH! website to read recent security articles or subscribe to its free security awareness newsletter designed for technology users.

If you have any questions about any of this information, please contact your college's Information Security Manager.