October is National Cybersecurity Awareness Month, which means it is time for the familiar reminders: recognize phishing, use MFA, keep software updated, avoid password reuse, and report anything suspicious. All good advice. None of it is exactly new, but a timely reminder never hurts, especially in cybersecurity, where yesterday’s obvious warning has a way of becoming tomorrow’s incident report.
So instead of another checklist, because nothing says “engaging campus communication” like a sixth bullet about passwords, let’s start with a normal day at Chapman.
A faculty member is getting ready for class. A staff member is reviewing a new software tool that promises to “transform workflows,” which may or may not mean “create three new meetings.” A researcher is sharing information with a partner. Someone opens an email that looks almost right: the logo is familiar, the wording is close enough, and the request is just urgent enough to be annoying.
At that moment, we should not expect that person to become a cybersecurity analyst. They should not need to know whether the message involves credential harvesting, domain spoofing, a compromised account, or some other unpleasant little gift from the internet. They need a simple way to pause, verify, and ask for help before clicking something that will make everyone’s afternoon more interesting than planned.
That is where good cybersecurity should show up. Not as a lecture. Not as a maze. Not as a surprise requirement that appears five minutes before a deadline, wearing a little cape labeled “compliance.” Good security works best when it is built into the way people already work: a reporting button that is easy to find, MFA that blocks suspicious access, vendor reviews that catch risk early, and clear guidance that helps people move forward without needing a second career in cybersecurity.
Behind the scenes, InfoSec is doing the less glamorous work of reducing complexity. We look at systems, data, vendors, identity, privacy, artificial intelligence, compliance, and architecture so the rest of the university can focus on teaching, learning, research, student support, collaboration, and discovery. Security has a way of showing up whether it was invited or not, so it is better to include it early, preferably before the purchasing decision, the launch date, or the email that begins with “quick question.”
Of course, even the best cybersecurity program will not prevent every problem. Someone will eventually click the wrong link. A vendor will have an issue. A system will need urgent attention. Something unexpected will happen because technology remains very committed to being technology. Resilience means recognizing issues quickly, responding effectively, recovering well, and keeping the university moving without turning every incident into a campus-wide dramatic reading.
That is why cybersecurity is a team sport, even though everyone does not play the same position and nobody really wants the mascot to be “Suspicious Link.” Students, faculty, researchers, staff, IT administrators, and the security team all have different roles. Everyone can help by pausing when something looks wrong, verifying before acting, and reporting when unsure. Our job in InfoSec is to make that easier, clearer, and more consistent.
So, this Cybersecurity Awareness Month, the message is not that everyone needs to become an expert. The message is that security should help people do their work with confidence. It should make the safer choice the easier choice. It should support the mission rather than compete with it. That is a better story than “please enjoy this mandatory reminder about passwords,” though, to be fair, passwords have had a very long run.
Cybersecurity is not the mission. It is one of the things that helps make the mission possible. The goal is to help the university do more safely. Find tips and resources on Chapman’s Cybersecurity Awareness Month page.
The goal is to help the university safely do more.
Keith Barros
Chief Information Security Officer
Chapman University
Stay safe, stay vigilant
