2026 Cybersecurity Awareness Month
2026 Cybersecurity Awareness Month
Embedded Files
Stay Safe Online, Build a Cyber Strong Wyoming!
Stay Safe Online, Build a Cyber Strong Wyoming!
October marks Cybersecurity Awareness Month, an international initiative championed by the National Cybersecurity Alliance (NCA) and the Cybersecurity and Infrastructure Security Agency (CISA) alongside partners across government, business, and education.
ETS is proud to stand once again with the Governor’s Office, the Wyoming Office of Homeland Security, CISA, and the NCA to advance this critical mission across our state.
This year, our focus centers on tackling modern digital risks through small, proactive choices. We are diving into practical defenses against emerging tactics like QR-code scams and AI impersonation, while reinforcing the importance of keeping devices updated and secure. We'll also explore how to use artificial intelligence responsibly, protect important files using the 3-2-1 backup strategy, and make reporting suspicious messages part of our daily routine through the Phish Hook button.
Every time you pause before clicking, restart your laptop for updates, or report a suspicious message, you help protect state systems, personal information, and Wyoming from cyber threats.
Throughout October, ETS will share practical insights and actionable resources focused on four essential cybersecurity habits for today's digital landscape:
Throughout October, ETS will share practical insights and actionable resources focused on four essential cybersecurity habits for today's digital landscape:
Recognizing modern phishing, quishing, and AI impersonation.
Keeping devices updated and secure.
Practicing responsible AI habits while securing vital data.
Building strong security habits and reporting suspicious messages with the Phish Hook.
By practicing these steps every day, you can help keep yourself, your family, and your workplace safe while helping protect the critical services Wyoming citizens depend on.
For more information about Cybersecurity Awareness Month 2026 and campaign resources, visit StaySafeOnline.org or follow #CybersecurityAwarenessMonth throughout October.
You can also explore additional cybersecurity best practices from our federal partner, the Cybersecurity and Infrastructure Security Agency (CISA), by visiting their website or following @CISAgov on social media.
Cybersecurity Awareness Month Events at ETS
Cybersecurity Awareness Month Events at ETS
Please note: These activities are exclusive to State of Wyoming employees.
CISO Coin - Front
CISO Coin - Back
October — Cybersecurity Presentation and Q&A at the Capitol
October — Cybersecurity Presentation and Q&A at the Capitol
Have questions about cybersecurity? Curious how threats impact your work — or what you can do at home? Get answers straight from the experts!
When: October 21st, 2026
Time: 2-3 PM
Where: Wyoming State Capitol, Room W53/54
Who: Open to all state employees
Bring your questions, your curiosity, and maybe even a coworker or two. This is your chance to hear from ETS's cybersecurity leaders in person, learn something new, and walk away more cyber-confident than ever!
All Month Long — CISO Challenge Coin Giveaway Challenge!
All Month Long — CISO Challenge Coin Giveaway Challenge!
Think training can't be fun? Think again.
Complete your KnowBe4 training in October and you’ll be entered to win one of 10 new exclusive CISO Challenge Coins — a collectible symbol of your commitment to cybersecurity. All trainings are less than 10 minutes!
Want better odds? Take all four trainings and your name goes in four times.
Plus, watch your inbox for a mystery challenge — three more coins will go to those who rise to the occasion.
Contest closes October 30, 2026.
When you take the KnowBe4 training during October, you'll be entered into a drawing to win one of ten limited-edition CISO coins!
Quadruple your chances and take all four trainings! These coins are a unique symbol of your commitment to cybersecurity and a great conversation starter.
These coins aren’t just cool collectibles — they’re a badge of honor and a conversation starter that shows you take cybersecurity seriously.
Outsmart the Imposters: Decoding Modern Scams
Outsmart the Imposters: Decoding Modern Scams
Recognizing modern phishing, quishing, and AI impersonation
Digital communication makes it easier than ever to connect, work, and manage our lives. However, it also gives cybercriminals sophisticated tools to exploit our trust. Scammers have moved far beyond the obvious, poorly written emails of the past. Today’s scams use emotional manipulation, artificial intelligence, and multiple communication methods to appear more convincing and harder to detect.
Understanding how modern scams work, from emotional manipulation to tactics like QR-code scams and AI impersonation, in one of your strongest defenses.
The Myth of the "Weakest Link"
The Myth of the "Weakest Link"
You Are Our Best Sensor Network
In this week's segment of The CISO Corner, CISO Miguel Penaranda flips the script on traditional IT thinking, explaining why human intuition, not software, is Wyoming's most powerful sensor network against modern scams.
The Core Tactic: Exploiting Human Emotion
The Core Tactic: Exploiting Human Emotion
Scammers often target our emotions. Whether it’s excitement, fear, or urgency, strong emotions can be used to trick us into acting before we think. Our inboxes and phones are flooded with information, making it easy to react on autopilot. When a message sparks a strong emotional response, take that as your cue to pause and evaluate before acting.
Common Psychological Lures:
Common Psychological Lures:
🎁 Too good to be true
Exclusive Giveaways: "You've won a dream vacation!"
Payroll Bonus/Unclaimed Funds: "You're owed an unclaimed refund!"
Unrealistic Job: Earn $80 an hour working 3 hours a day from home - no interview required!
💬 Connection & Romance
Fake Dating/Social Profile: A stranger sending direct messages on social media with sudden, intense affection or flattering compliments
Corporate Impersonation: An email pretending to be a new employee or vendor asking to connect on WhatsApp, asking for assistance or a favor
⚠️ Fear & Urgency
Executive Demands: An email appearing to come from your boss or CEO
Account Lockout Threats: "Your bank account has been flagged for fraudulent activity and will be frozen unless verified"
Extortion/Legal Threats: A message claiming law enforcement has issued a warrant for unpaid taxes or an attacker has compromised your webcam
Notice how cybercriminals combine emotional triggers, like urgency, generic greetings, and too-good-to-be-true offers, with other warning signs to catch you off guard.
Watch for details like a sender address that doesn’t look right, suspicious links, or unexpected QR codes asking you to act quickly. Unexpected phone calls pressuring you to share sensitive information can be another warning sign.
Learning to recognize these red flags gives you a simple mental checklist for every email, text, or call you receive. If something doesn’t look or feel right, pause. Don’t click, scan, reply, or share information. Report suspicious messages using the Phish Hook button.
Shield Your Screens: Security Essentials
Shield Your Screens: Security Essentials
Device Updates and Security
Our laptops, smartphones, and tablets connect us to state systems and sensitive information every day. While security tools work in the background to help protect them, keeping our devices secure also depends on regular updates and good security habits. Cybercriminals look for outdated software and security weaknesses they can use to gain access to devices and systems.
Keeping your devices updated is one of the simplest and most effective ways to protect against these threats.
Retiring the Old Tractor (Legacy Systems)
Retiring the Old Tractor (Legacy Systems)
Knowing when to let old gear go
In this week's segment of The CISO Corner, CISO Miguel Penaranda compares outdated software to a rusty old tractor, highlighting why retiring legacy systems is essential to keeping Wyoming's state network safe from cybercriminals.
The Core Defense: Keep it Updated
The Core Defense: Keep it Updated
Software updates do far more than add new features or fix visual bugs. Their most important job is often addressing security weaknesses. When developers discover a security issue in an operating system or application, they create an update to fix it. Until you install that update and restart your device, the security weakness may remain open for cybercriminals to exploit.
😴Practice Clean Reboot Habits
The Weekly Restart: Fully shut down or restart your computer at least once a week to ensure pending security scripts finalize.
Avoid Excessive Postponing: Repeatedly clicking "Remind Me Tomorrow" leaves known security gaps exposed for days at a time.
Off-Hours Scheduling: Set active hours on your machine so updates install overnight or during lunch without disrupting your workflow.
🔨Patch Without Delay
Operating System Updates: Install Windows, macOS, or mobile OS patches as soon as prompted.
Browser & Application Security: Regularly restart web browsers (Chrome, Edge) to apply pending background updates.
Enable Automatic Updates: Toggle auto-update features on across all work and personal devices whenever available.
🔒Secure Mobile & Remote Work
Physical Screen Safety: Always lock your machine whenever stepping away from your workspace.
Unapproved Hardware: Never plug unknown USB drives or personal peripherals into state-owned devices.
Wi-Fi Protection: Avoid conducting state business on open public Wi-Fi networks without an approved VPN connection.
Simple, everyday habits can make a big difference in keeping our devices and systems secure. While security tools work behind the scenes to protect state systems, completing software updates helps fix security weaknesses that cybercriminals could use to gain access.
An outdated application or web browser can be like an unlocked door in an otherwise secure building. Installing updates, restarting your device when prompted, and locking your screen when you step away all help close those gaps.
Making these actions part of your routine helps keep our systems secure. When you see an update notification, take a few minutes to complete the update and restart your device. It’s one of the simplest ways you can help protect state systems and information.
From Our Team: A Quick Look at State IT & Security
From Our Team: A Quick Look at State IT & Security
In 2025 and 2026, IT operations successfully applied 168,857 security updates and achieved a 99.48% success rate.
The technology landscape now requires much more frequent maintenance. Software vendors published 1,709 distinct updates in 2026, a 3.01x increase in volume from the previous year. State systems met this higher demand by successfully executing 148,663 installations for 2026 releases, keeping everyday applications and web browsers protected.
Protecting the state network relies heavily on keeping core systems up to date. Updates to essential operating systems and background components accounted for 68.8% of all updates applied during this period. Software providers now release larger security packages more frequently, making regular device maintenance essential. State personnel play a vital role in this process simply by allowing automated updates to run and restarting devices when prompted. Taking a moment to restart ensures these updates install correctly and keeps our daily operations safe.
Smart Prompts, Safe Storage
Smart Prompts, Safe Storage
Responsible AI practices, plus data protection using the 3-2-1 backup strategy
New technologies bring incredible potential for productivity, but they also introduce fresh risks. As we integrate artificial intelligence into our daily work and manage critical data across multiple platforms, our security approach must evolve. This week, we are focused on maintaining high standards for the data we share with AI tools and securing our valuable files with bulletproof redundancy.
Understanding the "why" behind responsible AI guardrails and the exact "how" of robust data protection is essential for modern cyber stewardship.
Upstream Water Rights (Supply Chain Risk)
Upstream Water Rights (Supply Chain Risk)
Guarding the upstream water
In this week's segment of The CISO Corner, CISO Miguel Penaranda draws on Wyoming water rights to explain supply chain risk, emphasizing why vetting third-party software vendors upstream protects our entire state network downstream.
The Core Choice: Guarding the Prompt
The Core Choice: Guarding the Prompt
Large Language Models (LLMs) and generative AI tools process the information you provide to them. When you enter information into a public AI tool, you may lose control over how that information is stored, processed, or used. That’s why sensitive, confidential, or protected state information should never be entered into a public AI tool.
⌨️Prompt with Prudence
The Golden Rule for AI: Never enter information into a public AI tool that you would not be comfortable sharing outside the organization.
Keep Sensitive Data Out: Never enter sensitive, confidential, or protected information, including personal information, system credentials, or other nonpublic state data, into a public AI tool.
Verify AI-Generated Content: AI can produce information that sounds convincing but is inaccurate. Always review and verify AI-generated content before using or sharing it.
✌️Protecting Your Personal Data: The 3-2-1 Backup Strategy
The 3-2-1 strategy is a widely used approach for protecting personal files and data from hardware failure, corruption, or cyber incidents:
3: Keep three copies of important personal files.
2: Store those copies on two different types of storage.
1: Keep one copy in a separate, secure location.
For state information, always follow applicable state policies and use approved storage and backup solutions. Do not create personal backups of state information. Review applicable ETS policies before storing or backing up state information.
The 3-2-1 strategy can help protect the personal files that matter most to you, such as family photos, financial records, or other important documents. Having multiple copies in separate locations means a lost device, hardware failure, or other incident is less likely to result in permanent data loss.
At work, the approach is different. State systems and information are protected through approved enterprise tools, policies, and processes. As an employee, your role is to store state information only in approved locations and follow established policies rather than creating your own backup copies.
Whether you’re protecting personal information at home or handling state information at work, the goal is the same: know where your information belongs and take the appropriate steps to keep it secure.
Page updated
Report abuse