Cybersecurity Awareness Month: 10 Habits That Work

A suspicious message arrives while several apps demand updates. Which security task deserves attention first? Start by protecting your accounts, then address suspicious messages, device updates, and recovery steps.

October’s campaign highlights passwords, multifactor authentication, phishing awareness and software updates. These CISA recommendations become more practical when each has a clear action and completion check.

Cybersecurity Awareness Month Habits 1–4: Protect Accounts First

Account protection starts with securing the credentials that unlock everything else.

1. Give Your Main Email Account a Separate Password

Email deserves priority because criminals can use it to access other personal accounts. The NCSC recommends a strong, separate email password.

Check whether that password appears anywhere else, including shopping accounts. If it does, replace it with a unique one.

2. Use a Password Manager for Unique Passwords

Unique passwords limit the damage when one account’s credentials become exposed. Small variations on a familiar password don’t provide genuine separation.

A password manager helps create and remember passwords. Generate a different password for each account rather than maintaining a predictable naming pattern.

3. Enable Multifactor Authentication Where Passwords Remain

Multifactor authentication, or MFA, requires additional verification beyond a password. CISA includes MFA among its core protective actions.

Start with email, financial accounts and work services. Open each account’s security settings and complete enrollment rather than assuming MFA is already active.

4. Choose Passkeys When Available

Passkeys replace passwords with credentials accessed through a device’s fingerprint, face recognition or PIN. The NCSC recommends passkeys because they resist phishing.

Enable them wherever supported. Where they aren’t available, continue using strong passwords and additional verification.

Cybersecurity Awareness Habits 5–6: Verify Requests and Report Phishing

Suspicious requests need a verification routine, not a quick judgment.

5. Verify Sensitive Requests Through a Separate Channel

Phishing uses deceptive messages to obtain information or trigger unsafe actions. An unexpected payment request should prompt verification before anyone transfers money.

Call through an established number rather than using contact details inside the message. Systech recommends this independent-channel check for requests involving money, credentials or sensitive information.

6. Report Suspicious Messages Instead of Only Deleting Them

Recognizing a suspicious message and reporting it are separate actions. CISA recommends both avoiding and reporting phishing.

Use the service’s reporting option or contact the workplace security team. Make “pause, verify, report” the routine rather than quietly deleting every questionable message.

Habits 7–8: Keep Software Supported and Updated

Device protection depends on installing fixes and knowing when fixes stop.

7. Enable Automatic Updates and Complete Restarts

Software and app updates contain security fixes that help protect devices. The NCSC recommends installing the latest updates.

Enable automatic updates for operating systems, browsers and apps wherever possible. During a weekly check, install pending updates and complete any required restarts.

8. Check Whether Devices Still Receive Security Updates

Outdated software needs an update while unsupported software needs a longer-term decision. CISA recommends replacing end-of-support devices.

Check manufacturer support information for older computers, phones and home routers. Having no available updates doesn’t necessarily mean a device remains supported.

Habits 9–10: Make Backups Useful Before Something Goes Wrong

Backup routines need both a saved copy and a recovery check.

9. Back Up Irreplaceable Files Automatically

Prioritize photographs, essential documents and other files that cannot easily be recreated. The NCSC recommends external-drive or cloud-based backups.

Choose a backup schedule that runs automatically where possible. Check what the service saves rather than assuming every important folder is included.

10. Practice Restoring a File

A restoration test turns the backup recommendation into a practical completion check. Select one sample document or photograph and restore it.

Confirm that the restored file opens and contains the expected information. Treat this as a useful check rather than proof that every recovery scenario will succeed.

Conclusion

Cybersecurity Awareness Month works best as a starting point for repeatable actions. Secure email first, enable updates and establish backups. Keep a recurring review of account protection, device support and restoration checks rather than waiting for next October’s reminder.