A message from Robert Edamala, Chief Information Security Officer

Dear Cornell community,

I am writing with a reminder to be vigilant about cybersecurity. Please follow the guidance below to protect your personal information and to protect university tools and accounts. Cybercriminals and other wrongdoers will seek to take advantage of difficult moments to seek out vulnerabilities, and Cornell’s IT Security Office has observed increased malicious activity targeting the university community.

Take these steps to protect yourself and others from cyberattacks:

• Protect your personal details from online harassment. If you or someone you know is affected, get support, report it, and learn how technology services can help prevent it.
• Update your computers, mobile devices, and software when prompted, and run antivirus software. AI helps cybercriminals find and exploit vulnerabilities faster, so security updates and computer restarts are needed more frequently. 
• If you haven’t already, create a strong new NetID password. Any NetID password older than February 14, 2026, must be updated. Never share your NetID password or reuse it on non-Cornell websites, and watch for phishing emails designed to steal it (see the Phish Bowl for examples).
• Protect your Cornell and personal accounts with multifactor authentication. For Cornell Duo, never approve a prompt you did not initiate or share the three-digit verification code. An unexpected prompt may mean your NetID password has been stolen; change it immediately and contact the IT Security Office. IT will never ask for your Duo code or NetID password.
• Get tips to recognize and report social engineering attempts and scams. Hackers use AI to personalize phishing messages, clone voices, create video deepfakes, and gather information from public social media accounts.
• Additional steps for faculty and staff:
  • Use a Cornell-managed Certified Desktop, which includes essential protections.
  • Set up a Secure Connect passkey on your Cornell-managed and personal devices. Passkeys protect your accounts even if your password is stolen or you fall for a phishing scam.

Upcoming awareness activities and training 

During National Cybersecurity Awareness Month in October, Cornell’s IT Security Office will share simple ways to stay safe online.

Later this fall, faculty staff, and student employees will complete the annual ITSO 100 Cybersecurity Training and Attestation.

Faculty and staff will continue to receive year-round phishing simulations to practice recognizing and reporting malicious email.

Thank you for helping improve cybersecurity at Cornell.

Robert Edamala
Chief Information Security Officer
Information Technology at Cornell

Cybersecurity Month Articles

Updating Your NetID Password Keeps Everyone Cybersafe: Hackers don’t have to sit in a dark room guessing passwords one at a time. With a little help from AI, and cheap software, they can test thousands of password combinations every second. These hackers love pet names, birthdays, and they really love short passwords and reused passwords! Create a Strong Passphrase or Password. While you're at it, keep your devices updated.

Password, passphrase, passkey — what’s right for you?: Higher education faces unique security challenges right now and you, as part of the Cornell community, have the opportunity and responsibility to thwart the attacks that relentlessly target Cornell’s IT defenses on a daily basis by doing one simple thing: protect your NetID from hackers. Explore three options for keeping your NetID in your hands and out of anyone else's.