October is Cybersecurity Awareness Month. This month, Long Beach City College Information Technology Services is focusing on five small habits that make our campus—and our lives outside work—safer. 

Week 3 Habit: Why Multi-Factor Authentication is Key

Multifactor authentication, often called MFA, adds another identity check when you sign in. That additional check can prevent someone from accessing your account even if they obtain your password. 

MFA uses two or more kinds of proof: 

• Something you know, such as a password or PIN.  
• Something you have, such as a registered phone or security key.  
• Something you are, such as a fingerprint or facial recognition.  

Microsoft Entra ID uses these factors to help protect Long Beach City College accounts.  

Only approve what you started:

MFA can appear in several forms. The methods you see will depend on the account and the options approved by Information Technology Services. 

When an Authentication Request Appears 

• Stop and think. Did you just attempt to sign in? 
• Check the details. Does the number match? Is the request for the application or service you are trying to open? 
• Deny surprises. If you did not initiate the sign-in, do not approve it. Never approve repeated prompts simply to make them stop. 
• Protect your codes. A one-time verification code is a temporary key to your account. Do not provide it to anyone—including someone claiming to be from technical support. 

An unexpected request may mean that someone else is attempting to use your account. 

At Work 

LBCC recommends using the Microsoft Authenticator app for authentication. Microsoft recommends Authenticator for its flexibility and usability because it supports notifications, verification codes, and passkeys when those features are enabled.  

If you receive an unexpected LBCC authentication request: 

• Select Deny.  
• Contact the ITS Help Desk and report the incident.  
• If you accidentally approved the request or shared a verification code, contact the Help Desk immediately.  

Do not approve a request because another person tells you to, even if the person claims to be an LBCC employee, Microsoft representative, supervisor, or member of ITS. 

Keep Microsoft Authenticator updated through your phone’s official app store. Unsupported versions may eventually be unable to complete authentication.  

Microsoft Authenticator Notification—Recommended for LBCC Logins 

After you begin signing in, a number appears on the sign-in screen and Microsoft Authenticator sends a notification to your registered phone. 

Before approving: 

• Confirm that you initiated the sign-in.  
• Open Microsoft Authenticator.  
• Enter the number displayed on the sign-in screen.  
• Review any additional details shown in the app.  
• Approve the request only when everything matches.  

This process is called number matching. Microsoft enables it for Authenticator push notifications as a safeguard against accidental approvals.  

If you did not initiate the sign-in, select Deny and report the incident to the Help Desk. 

Authenticator App Verification Code 

An authenticator app can generate a temporary verification code that changes regularly. When this method is offered, open the authenticator app you registered with the account and enter the current code on the sign-in page. 

LBCC recommends Microsoft Authenticator for college accounts. However, compatible authenticator apps—such as Google Authenticator—can also generate standards-based verification codes when that method is supported by the service. LBCC’s login supports verification codes generated by compatible third-party authenticator apps.  

Other authenticator apps may generate verification codes, but they generally do not provide the Microsoft Authenticator push notification and number-matching experience described earlier in this email. 

Only enter a verification code on a sign-in page that you opened yourself. Never: 

• Read a verification code to someone over the phone.  
• Send a code by email, text message, or chat.  
• Enter a code because someone else instructed you to do so.  
• Approve a sign-in that you did not initiate.  

A verification code is a temporary key to your account. Anyone asking for it may be attempting to sign in as you.

Passkey, Security Key, or Device-Based Sign-In 

A passkey allows you to sign in using a credential stored on a registered device or physical security key. Instead of entering a password or one-time code, you unlock the passkey using a device PIN, fingerprint, or facial recognition. 

Depending on your device and the options offered by the service, this may include: 

• Touch ID on a Mac or Apple device.  
• Face ID on an iPhone or iPad.  
• Windows Hello on a Windows computer.  
• A registered phone or tablet.  
• A physical FIDO2 security key.  

For example, Mac users may sign in with a passkey using Touch ID, a nearby iPhone or iPad, or a compatible external security key.  

Passkeys and FIDO2 security keys are designed to resist phishing because the credential works only with the legitimate website or service for which it was registered. The credential remains protected by your device or security key and is unlocked with your PIN or biometric sign-in. 

Text Message or Phone Call 

Some services send a code by text message or place an automated phone call. These methods add protection beyond a password, but they are more vulnerable to phishing, phone-number theft, and interception than a passkey, security key, or authenticator app. 

Microsoft is moving Microsoft Entra users away from native SMS and voice authentication in favor of phishing-resistant methods.

Your 10-minute Home Task 

Enable MFA on your personal email account. Then enable it on another important account, such as banking, social media, or online shopping. 

When the service offers several choices, use this general order: 

• A passkey or security key.  
• An authenticator app.  
• A text message or phone call only when a stronger method is unavailable.  

Add a backup or recovery method when the service permits it. Store recovery codes in your password manager or another secure location—not in an unprotected document, email message, or photo gallery. 

Thank you for helping keep Long Beach City College cyber-safe and secure. 

Week 2 Habit: Use a Different Password for Every Account.

Using the same password for several accounts may be convenient, but it creates a chain reaction. If one account is compromised, criminals can try the same email address and password on your other accounts.

A strong password should be: 

• Long: Use at least 16 characters. Longer is generally stronger. 
• Unique: Your Long Beach City College password should never be used for a personal email, shopping, banking, social media, streaming, or other account. 
• Random: Avoid names, birthdays, addresses, favorite teams, school mascots, common phrases, and predictable patterns. 
• Stored Safely: A password manager can create, store, and enter unique passwords so you do not have to remember them all. 

Make the Password you must Remember a Passphrase.

A passphrase is a password made from several unrelated words. It can be both long and easier to remember than a short, complicated password. 

A good passphrase: 

• Contains at least five unrelated words.  
• Is at least 16 characters long.  
• Creates a strange or memorable picture in your mind.  
• Is not used for any other account.  

For example, imagine a mango riding in a canoe beneath a lantern: Mango Canoe Lantern Velvet Orbit 

Do not use this example as your password. Create your own combination of unrelated words. You may separate the words with spaces or hyphens when the account allows them. Avoid using a familiar quotation, song lyric, movie title, family name, pet name, college phrase, or information someone could find on social media. 

Use a passphrase for a password you need to remember, such as the main password that unlocks your password manager. Never reuse that passphrase anywhere else. 

Let a Password Manager Remember the Rest!

For accounts stored in your password manager, you do not need to create memorable passwords. Use the manager’s password generator to create a long, random, and unique password for each account. 

A password manager can: 

• Generate strong passwords.  
• Store passwords in an encrypted vault.  
• Enter passwords for you on websites and mobile apps.  
• Identify passwords that are weak or reused.  
• Help you change a password after an account has been involved in a data breach.

Well-known password managers with paid personal plans include: 

• 1Password  
• Bitwarden  
• LastPass  

These are examples for personal consideration and do not represent an LBCC endorsement, but paid password managers are generally superior to a browser’s built-in password manager or Apple’s Passwords app due to advanced security features and organizational tools. Features, pricing, account-recovery options, and security practices differ among providers. Before choosing one, confirm that it works with your computer, phone, browsers, and other devices. Whichever password manager you select, protect it with a unique passphrase and turn on multifactor authentication. 

At Work:

Never reuse your LBCC password on a personal website or application. On an LBCC-managed device you can add the browser extension for one of the paid password managers mentioned earlier without ITS approval. However, you can contact request help setting up the extension. 

Your 10-Minute Home Task:

Start with your personal email account because it is often used to reset the passwords for your other accounts. 

1. Choose or open a reputable password manager.  
2. Protect the manager with a long, unique passphrase.  
3. Replace any reused personal email password with one generated by the manager.  
4. Replace one additional reused password, such as a shopping or social media password.  
5. Store both new passwords in the manager.  
6. Download the password manager only from the provider’s official website or your device’s official app store. 

You do not have to fix every password today. Improving two important accounts is meaningful progress. 

Thank you for helping keep Long Beach City College cyber-safe and secure. 

Week 1 Habit: Pause. Inspect. Verify. 

Cyber scams do not arrive only through email. They may reach you in several ways: 

• Phishing: Fraudulent email or online message
• Smishing: Phishing delivered via text message
• Vishing: Phishing conducted via phone call or voicemail

The Goal: Scammers create artificial urgency to pressure you into acting before you think.

Common Scam Scenarios

Be extra cautious if you encounter:

• A shared document or voicemail notification.  
• A payroll, benefits, or account problem.  
• An urgent request from a student, colleague, or LBCC executive.  
• A text asking you to buy gift cards or send payment information.  
• A call asking for your password, verification code, or sensitive details.  

This is a reminder that we must continuously make informed decisions when dealing with email, text messages, and phone calls. Please review the information on how to recognize phishing email messages.

Reminders when at Work:

• Suspicious Email: Use the Report button in Outlook. Simply right click on the email and select Report, then choose Report Phishing.
• Suspicious Call/Text: Do not reply. Report the incident directly to the ITS Help Desk.
• Clicked a link or shared credentials? Contact the ITS Help Desk immediately so we can secure your account.

Please remember: Dr. Muñoz and other LBCC executives will never ask you to purchase gift cards or send payment information through a text message. 

Your awareness is one of the strongest defenses against phishing, smishing, and vishing. Thank you for helping keep Long Beach City College cyber-safe and secure!

Your 3-Step Defense

Pause

Ask yourself:

• Was I expecting this message or call?  
• Is the person creating urgency or asking me to keep the request secret?  
• Am I being asked for money, gift cards, a password, or a verification code?  

Urgency is often intended to keep you from stopping to verify the request. 

Inspect

Check the following:

• the full email address
• phone number provided is legitimate
• link destination
• wording of the message

A familiar name, college logo, caller ID, or professional-looking message does not prove that the communication is legitimate. 

Verify

Contact the person or organization through a method you already trust, such as: 

• The LBCC phone directory.  
• A saved phone number.  
• An official website or mobile app.  
• A previously established email address.  

Do not use the phone number, link, or contact information contained in the suspicious message. 

10-Minute Home Action Task

Bookmark the official sign-in pages for your personal email, bank, credit card, and most-used shopping accounts. Also save the official customer-service numbers for your bank and credit-card provider in your contacts. 

When you receive an unexpected account alert: 

• Open the organization’s official app or website.  
• Use your saved bookmark.  
• Call the number printed on your card or listed on the organization’s official website.  
• Do not use a link or phone number contained in the unexpected message.