A message from Robert Edamala, Chief Information Security Officer

Dear Cornell faculty and staff,

I am writing with a reminder to be vigilant about cybersecurity. Please follow the guidance below to protect your personal information and to protect university tools and accounts. Cybercriminals and other wrongdoers will seek to take advantage of difficult moments to seek out vulnerabilities, and Cornell’s IT Security Office has observed increased phishing activity targeting the university community.

Take these steps to protect yourself and others from cyberattacks:

• Protect your personal details from online harassment. If you or someone you know is affected, get support, report it, and learn how technology services can help prevent it.
• Update your computers, mobile devices, and software when prompted, and run antivirus software. AI helps cybercriminals find and exploit vulnerabilities faster, so security updates and computer restarts are needed more frequently. 
• If you haven’t already, create a strong new NetID password. Any NetID password older than February 14, 2026, must be updated. Never share your NetID password or reuse it on non-Cornell websites, and watch for phishing emails designed to steal it (see the Phish Bowl for examples).
• Protect your Cornell and personal accounts with multifactor authentication. For Cornell Duo, never approve a prompt you did not initiate or share the three-digit verification code. An unexpected prompt may mean your NetID password has been stolen; change it immediately and contact the IT Security Office. IT will never ask for your Duo code or NetID password.
• Get tips to recognize and report social engineering attempts and scams. Hackers use AI to personalize phishing messages, clone voices, create video deepfakes, and gather information from public social media accounts.
• Additional steps for faculty and staff:
  • Use a Cornell-managed Certified Desktop, which includes essential protections.
  • Set up a Secure Connect passkey on your Cornell-managed and personal devices. Passkeys protect your accounts even if your password is stolen or you fall for a phishing scam.

Upcoming awareness activities and training 

During National Cybersecurity Awareness Month in October, Cornell’s IT Security Office will share simple ways to stay safe online.

Later this fall, faculty and staff will complete the annual ITSO 100 Cybersecurity Training and Attestation.

Faculty and staff will continue to receive year-round phishing simulations to practice recognizing and reporting malicious email.

Thank you for helping improve cybersecurity at Cornell.

Robert Edamala
Chief Information Security Officer
Information Technology at Cornell