Cybersecurity Awareness Month & Securing the Next 250
A Message from the Security Department
Following last month's focus on our internal environment during National Insider Threat Awareness Month, October shifts our attention to external resilience for the 23rd annual National Cybersecurity Awareness Month (CAM). Co-led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance, this year's theme is "Securing the Next 250."
Framed around the impending 250th anniversary of the United States, the focus is on positioning our collective digital resilience as a foundational pillar of future national security and economic prosperity.
While September emphasized that our security is only as strong as the people operating inside the facility, October expands that principle to the digital perimeter. Our corporate infrastructure is deeply interconnected with the broader defense and federal supply chain. Modern cyber defense is not just about firewalls and software patches; it is about human behavior. Threat actors are increasingly bypassing technical controls to target employees directly using Artificial Intelligence. This October, we are asking every member of the AIC team to recommit to the core security behaviors that keep our contracts compliant and our data safe.
Fortifying Our Defenses: The Four Core Behaviors
To align with CISA's national strategy, AIC is focusing on four non-negotiable behavioral steps for our workforce. These actions form the bedrock of our digital security posture:
Avoid and Report Phishing Scams: Phishing is no longer limited to poorly spelled emails from unknown senders. Adversaries are using advanced generative AI to create contextually flawless emails, spoofed PDF requests, and even deepfake voice calls. Trust your instincts, if a financial request or urgent password reset seems unusual, verify it through a secondary channel and report it immediately.
Use Strong, Unique Passwords: Reusing passwords across personal and professional accounts is one of the leading causes of enterprise breaches. You must utilize enterprise password managers to generate and store complex, unique credentials for every system you access.
Require Multifactor Authentication (MFA): We are actively transitioning to phishing-resistant MFA, including FIDO2 hardware keys and passkeys. MFA is mandatory for all network access. Never approve an MFA push notification or provide a device code if you did not actively initiate the login request yourself.
Update Software Promptly: Cybercriminals quickly weaponize known vulnerabilities. When you receive a prompt to update your operating system, web browser, or enterprise applications, apply the patch and restart your machine as soon as possible. Delaying updates leaves the entire network exposed.
The AI Threat Landscape: See Something, Say Something
The Evolution of Human Risk According to the latest SANS 2026 Security Awareness & Culture Report, Artificial Intelligence has surged to become the #2 most-cited human risk facing organizations today. AI platforms can generate spear-phishing campaigns at scale that easily bypass traditional email filters.
Because of this, we are changing how we measure security success. Click rates are no longer the primary focus; your Reporting Rate is.
A rising reporting rate, where employees actively flag suspicious emails, SMS messages, and unexpected file-sharing requests, is our strongest defense. High reporting velocity provides our Security Operations Center (SOC) with the critical early warnings required to contain an incident before an adversary can steal an identity token or deploy ransomware. We want to hear from you.
What This Means For You:
We all play a part in securing our digital and physical environments. Do not assume that security is only an IT responsibility. If you observe suspicious activity, rely on established protocols:
Verify Urgent Requests: Mandate a "Zero Trust" approach for all high-risk actions. If an executive or vendor requests an urgent wire transfer, data export, or password change via email or voice call, hang up and verify the request by calling a known, trusted number from the corporate directory.
Never Share Authorization Codes: If a system asks you to input an alphanumeric "Device Code" into a Microsoft login portal, verify exactly what device or application you are authorizing. Threat actors use this mechanism to silently bypass your MFA.
Report, Don't Ignore: If you click a suspicious link or accidentally provide credentials, do not hide it. Immediately isolate your machine and contact the IT Helpdesk. Speed is our greatest asset in incident response.
In personnel security, early transparency protects the mission. Whether reporting a suspected data spill, a physical security gap, or an unusual digital request, your Security Team is here to support you and keep our environment safe.
Report all security incidents, facility concerns, or travel updates directly to your FSO.
Comments