Key takeaways
- Cybersecurity Awareness Month happens every October to help people and businesses stay safer online.
- Most cyberattacks on small and midsize businesses start with everyday gaps, like stolen passwords, phishing emails, and missed updates.
- Four habits close the biggest gaps: turn on multi-factor authentication (MFA), use strong and unique passwords, spot and report phishing, and keep software updated.
- You don’t need a big budget or a tech background. You need consistency, and a team that’s in on it.
October is Cybersecurity Awareness Month, which means your feed is about to fill up with scary headlines about ransomware and data breaches. Those threats are real. But if those stories leave you thinking security is only for big companies with big budgets, we’d like a word.
As Nebraska’s favorite nerds, we work with businesses, schools, and county governments across the state every day. And here’s what we’ve learned: most security incidents don’t start with a mastermind hacker. They start with something ordinary. A reused password. A convincing email opened on a busy Tuesday. An update someone meant to install last week.
The good news? Ordinary problems have ordinary fixes. This month, we’re breaking cybersecurity down into four simple habits. No jargon, no fear-mongering, just practical steps your whole team can actually use.
What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month is a national campaign held every October to help individuals and organizations protect themselves online. It was launched in 2004 by the U.S. Department of Homeland Security and the National Cybersecurity Alliance (then the National Cyber Security Alliance), and today it’s led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance.
Fun fact: 2004 is also the year Applied Connective Technologies opened its doors. We like to think we’ve both been keeping people safer online ever since.
Why should my business use multi-factor authentication (MFA)?
Multi-factor authentication (MFA) adds a second step to signing in, like a code, an app prompt, or a security key, so a stolen password alone can’t unlock your account. It’s one of the simplest and most effective ways to protect your business from account takeovers.
If you only do one thing this month, make it this one.
Stolen passwords are one of the most common ways attackers get in. They’re leaked in data breaches, guessed, or phished. MFA makes a stolen password a lot less useful, because the attacker would also need your phone or security key.
Where to start:
- Email first. Your inbox is the key to everything else, since it’s where password resets land.
- Then money and data. Add MFA to banking, payroll, accounting software, and any system that holds customer or employee information.
- Use an authenticator app instead of text-message codes when you can. It’s faster and harder to intercept.
Pro tip from our help desk: If you get an MFA prompt you didn’t trigger, don’t approve it. That’s a sign someone has your password. Deny it, change your password, and give your IT team a call.
How do I create strong passwords my team will actually use?
The best passwords are long, unique to each account, and stored in a password manager, so nobody has to memorize them. A passphrase of four or five random words is easier to remember and much harder to crack than a short, complex password.
Let’s be honest. Most people know they shouldn’t reuse passwords, and most people still do. It’s not laziness. Nobody can remember 80 different complicated passwords.
The catch is that when one website gets breached, attackers take those email-and-password combinations and try them everywhere else. If your password for a shopping site matches your work email, one breach just became two.
Think passphrase, not password.
Length beats complexity. Something like copper-lantern-river-tulip is easier to type and remember, and much tougher to crack, than P@ssw0rd1!.
Let a password manager do the remembering.
A password manager creates and stores a strong, unique password for every account, so you only need to remember one. For businesses, a team password manager also makes it easy to share access securely and remove it when someone leaves. Goodbye, sticky notes and password spreadsheets.
How can employees spot and report phishing emails?
To spot phishing, pause on anything urgent, check the real sender and link destinations, and verify requests for money or passwords through a separate channel. Then report anything suspicious to IT, even if you already clicked.
Phishing emails have gotten good. Gone are the obvious typos and long-lost princes. Today’s phishing looks like a shared file from a coworker, an invoice from a real vendor, or a password-expiration notice from Microsoft. Many are now written with AI, so they read cleanly and sound right.
That’s why the best defense is a habit, not a checklist: pause, check, report.
Pause
Urgency is a scammer’s favorite tool. “Act now,” “Your account will be locked,” and “I need this wire sent before 3 p.m.” are designed to make you skip thinking. If a message makes you feel rushed, slow down.
Check
Look at the actual sender address, not just the display name. Hover over links to see where they really go. If a request involves money, passwords, or sensitive data, verify it by calling a number you already have, not one in the email.
Report
If something feels off, report it to your IT team, even if you already clicked. Especially if you already clicked. The faster your IT team knows, the faster they can contain it. The strongest security cultures thank people for reporting instead of blaming them for mistakes. That’s why we call people “the human defense.”
Why do software updates matter for cybersecurity?
Software updates fix security weaknesses that attackers actively look for, so installing them quickly is one of the easiest ways to keep your business protected. Turning on automatic updates and restarting when prompted handles most of the work.
We get it. That update notification always pops up right before a meeting. So you click “remind me later,” and later turns into next week.
Here’s why that matters. When a software company releases a security update, it’s often because a weakness has been discovered, and sometimes attackers already know about it. Once a patch is public, it can also become a roadmap for anyone hunting for systems that haven’t updated yet. The window between “patch released” and “actively exploited” keeps getting shorter.
Turn on automatic updates for operating systems, browsers, and apps, on computers and phones.
Restart when asked
Many updates don’t finish installing until you reboot. A quick restart at the end of the day goes a long way.
Don’t forget the rest of your network.
Routers, firewalls, printers, security cameras, and other connected devices need updates too, and they’re easy to overlook. This is where patch management really pays off: updates get tested, scheduled, and applied across every device, so nothing slips through the cracks.
How can a small business make these cybersecurity habits stick?
Start with one habit at a time, make security a team effort, and have leaders model the behavior. Consistency matters more than perfection.
None of these four habits is complicated. The hard part is making them part of how your business runs every month, not just in October. A few ways to get there:
- Pick one habit at a time. Trying to fix everything at once usually means nothing sticks. Start with MFA this week and build from there.
- Make it a team effort. Security isn’t just IT’s job. Talk about these habits at a staff meeting, share a real phishing email someone caught, and celebrate the people who report suspicious messages.
- Lead from the top. When owners and managers use MFA, password managers, and updates themselves, everyone else follows.
- Train regularly. Short, ongoing cybersecurity training keeps these habits fresh far better than a once-a-year slideshow.
Cybersecurity Awareness Month FAQ
When is Cybersecurity Awareness Month?
Cybersecurity Awareness Month takes place every October in the United States. It’s led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance.
What are the most important cybersecurity tips for small businesses?
The four highest-impact habits are turning on multi-factor authentication, using strong and unique passwords with a password manager, training employees to spot and report phishing, and keeping all software and devices updated.
Are small businesses really targets for cyberattacks?
Yes. Attackers often target small and midsize businesses because they expect fewer defenses than large companies. A single compromised email account can lead to downtime, lost data, fraud, and damaged customer trust.
What does a managed IT provider do for cybersecurity?
A managed IT and cybersecurity provider monitors and protects your systems for you. That typically includes endpoint security, managed firewalls, patch management, backup and disaster recovery, cybersecurity training, and help desk support, so security doesn’t depend on someone remembering to do it.
How do I know where my business stands?
A security risk assessment is a good place to start. It shows where your biggest gaps are and which fixes will make the most difference first.
Ready for IT that just works?
Applied Connective Technologies has has been Nebraska’s people-first IT & Cybersecurity team since 2004. With offices in Albion, Lincoln, Norfolk, Columbus, Elkhorn, and Ogallala, we’re the local IT & Cybersecurity team that picks up the phone, serving businesses across the state.
Want to know how your team measures up? Claim a free security risk assessment or call us at (866) 358-0109. Let’s talk!
Follow us on Facebook and LinkedIn all October for weekly tips from Nebraska’s favorite nerds.