Protect Your Account and Your Data (Everyday Security Habits)

Who this is for / when to use it

Use this as a checklist for keeping your Cornell account and data safe day to day — whether you're new to JCB or just want to make sure you've got the basics covered. None of it takes long, and each step below links to Cornell's full instructions if you want the detail.

If you've run into something that worries you — a suspicious email, a lost device, or a password you think was stolen — skip to If you think something's wrong at the end.

Protect your account

Your NetID login is the key to almost everything you do at Cornell. A few habits keep it locked down:

• Use a strong, unique passphrase. Longer is stronger, and don't reuse your NetID password anywhere else. See Create a Strong Passphrase or Password.
• Turn on Two-Step Login (Duo) if it isn't already — it's the single biggest thing that stops someone using a stolen password. See Get Started with Two-Step Login.
• Set a NetID recovery email. This is how you get back in if you're ever locked out. See Set a NetID Recovery Email Address.
• Don't reuse passwords — use a password manager. A manager remembers strong, unique passwords for every site so you don't have to. See Secure Password Management.
• Consider going passwordless. Faculty and staff can sign in with a fingerprint, face, or device PIN using Secure Connect — faster and harder to phish. See Secure Connect.

Protect your data

“Data hygiene” just means being deliberate about what sensitive information you keep, where you keep it, and clearing out what you don't need. The goal: if a device is ever lost or compromised, there's as little at risk as possible.

• Know your data's risk level. Cornell classifies information as low, moderate, or high risk, and each level has approved places to store it. Check the Regulated Data guidance and the Regulated Data Chart before storing or sharing sensitive information.
• Store it in the right place. Use Cornell-approved storage such as Box for your work rather than a random local folder or personal account. Not sure which service fits? Use the Data Storage Finder.
• Keep confidential data off your device. If you don't need it, don't keep it — purge temporary files regularly and empty your Trash/Recycle Bin. If you must work with confidential data, contact JCB IT first so we can set you up to do it safely — we have established procedures for handling confidential data, including a dedicated VPN for access and a sanctioned, audited storage share. Full guidance: Data Hygiene Best Practices.
• Back up your work. On a JCB-managed Certified Desktop, backups run automatically. Otherwise, talk to JCB IT about a backup option so a lost or broken device doesn't cost you your files. See Certified Desktop and CrashPlan.

Keep your devices secure

• Run endpoint protection (antivirus). JCB-managed machines have this already; on a personal device, make sure it's on. See Endpoint Protection.
• Lock and protect your phone and tablet if you use them for Cornell mail or files. See Protect Mobile Devices.
• Use CU VPN when you need to reach campus resources from off site. It secures the connection to those Cornell systems — note it's split-tunnel, so it doesn't protect your other web traffic on an untrusted network. See CU VPN.
• Lock your screen whenever you step away, even for a minute.

Common mistakes to avoid

• Reusing your NetID password on other sites — if one is breached, they're all exposed. Use a password manager instead.
• Keeping “just in case” copies of sensitive files on your desktop or a thumb drive. If you don't need it, delete it — and empty the Trash.
• Storing regulated data in the wrong place. Check the Regulated Data Chart before putting sensitive information in any service.
• Approving a Duo prompt you didn't start. If your phone buzzes with a login you didn't request, deny it — someone may have your password. Change your password immediately (below).

If you think something's wrong

• A suspicious or phishing email: don't click — report it. See Spot Fraudulent Emails (Phishing).
• Your NetID password may be stolen: change it right away and follow Report if My NetID Password has Been Stolen.
• A lost or stolen device: report it to the police and to JCB IT as soon as you can — the sooner it's reported, the sooner we can help protect your account and data. See Report a Lost or Stolen Device for the full steps.

Still stuck?

Not sure whether your account or data is set up safely? JCB IT is glad to walk through it with you. You can also browse Cornell's full guidance at IT Security & Policy.

Still need help? Contact the Cornell SC Johnson College of Business Helpdesk at itrequests@business.cornell.edu.

[edited via Jane by rtm25 on 2026-09-09 17:39 UTC]