Securing the Vision: Guiding Non-Profit Organizations through the Digital Era amidst Cyber Challenges

Non-profit organizations are essential for addressing societal challenges, promoting social responsibility, and driving positive change. They play a crucial role in managing various critical issues, such as poverty, healthcare, social services, animal welfare, disaster relief, education, environmental conservation, and social justice. To make it a reality, many non-profits also engage in innovative research and projects, working on cutting-edge solutions and technologies to address pressing global challenges.

Non-profits may face security risks such as potential data breaches, compromising sensitive donor information, and the challenge of securing limited resources, making them susceptible to cyber threats. Additionally, their focus on social impact may inadvertently lead to overlooking comprehensive cybersecurity measures.

Surprise! Non-Profits often store Sensitive & PII data

Based on the nature of the non-profit organizations and how they are sustained, non-profits may hold various types of sensitive and personally identifiable information (PII) data, depending on their operations and activities. Typical data non-profits might be interested in storing include:

• Donor Information: Non-profits often collect and store data about their donors, including names, addresses, email addresses, and phone numbers.
• Volunteer Information: Details about volunteers, such as their contact information and sometimes background checks, may be stored.
• Employee Data: If the non-profit has employees, their personal information, such as social security numbers, addresses, and banking details, maybe on record.
• Client or Beneficiary Information: Non-profits providing services may collect PII from their clients or beneficiaries, which could include medical records, financial information, or other personal details.
• Membership Information: Non-profit associations may maintain data on their members, including personal contact information and, in some cases, professional credentials.
• Event Registrations: Information about attendees at fundraising events or conferences, including names, email addresses, and dietary restrictions, might be collected.
• Email Lists: Non-profits often manage email lists for communication and fundraising purposes, which can include a substantial amount of PII.
• Board of Directors (BODs): The board of directors for non-profits provides strategic oversight and governance, ensuring the organization’s mission is fulfilled and resources are used effectively to benefit the community. They also play a key role in fundraising and maintaining transparency, crucial for trust and accountability.

Due to privacy laws and regulations, Non-profit organizations do need to handle this data with care to safeguard the privacy and security of individuals’ information. 

Ransomware attacks are on the rise over the years and it is not just limited to for-profits and government with huge impacts. These attacks are also focused on non-profits.

Here are a noticeable cyber recent attacks focused on non-profits:

• An attack on the servers of the International Committee of the Red Cross in September 2022 resulted in 500,000 personal data and confidential information records being compromised. The attack compromised personal data and confidential ICRC information of more than 515,000 vulnerable people, including those separated from their families due to conflict, migration, and disaster, missing persons and their families, and people in detention.     
• A data breach against Broward Health of California, a nonprofit organization that manages health care in Florida in January 2022 affected 1.35M private data records including social security numbers.

Non-profit organizations, like any other entities, are not immune to security risks. Some key risks include:

1. Data Breaches: Non-profits often store sensitive information about donors, beneficiaries, and employees. Data breaches can lead to the exposure of this information, resulting in financial losses and damage to the organization’s reputation.
2. Phishing and Social Engineering: Cybercriminals may target non-profits with phishing emails and social engineering attacks to gain unauthorized access to systems or trick employees into divulging sensitive information.
3. Ransomware: Ransomware attacks can encrypt an organization’s data, rendering it inaccessible until a ransom is paid. Non-profits are not exempt from these types of attacks, and paying the ransom does not guarantee data recovery.
4. Malware and Viruses: Malicious software can infect non-profit systems, compromising their security and potentially stealing data or disrupting operations.
5. Weak Passwords and Authentication: Inadequate password practices and weak authentication mechanisms can make non-profit systems vulnerable to unauthorized access.
6. Insider Threats: Employees or volunteers with access to sensitive information can pose a threat to the organization’s security, intentionally or unintentionally.
7. Third-Party Risks: Non-profits often work with third-party vendors for services such as payment processing and website hosting. These vendors can introduce security risks if not properly vetted and managed.
8. Lack of Security Awareness: Insufficient security awareness among staff and volunteers can lead to security lapses, such as clicking on malicious links or downloading unsafe attachments.
9. Inadequate Patching and Updates: Failing to regularly update software and systems can leave non-profits susceptible to known vulnerabilities that cybercriminals can exploit.

“Precious funds” have to be used to recover data in case of a breach. So nonprofits should be thinking about cyber security, partnering with for-profits, universities, and non-profits like “Pocket Security” etc. for support.

Strengthening Non-Profit Security: Proactive Measures for Enhanced Protection

Non-profits can enhance their security posture by implementing foundational measures, gradually minimizing exposure. Initiating practices, if not already in place, is crucial for bolstering their cybersecurity efforts.

1. Stay current with security best practices

If running out-of-date software, an organization opens up a back door for hackers to stroll through. Don’t be one of those organizations that still rely on Internet Explorer. Keeping everything up-to-date will also help security leaders get optimal performance out of their hardware.

2. Strengthen passwords

Everyone in an organization should use complex, randomly generated passwords that are difficult to crack and virtually impossible to guess. A team should not use these passwords for other sites and should change them regularly (security leaders can set it up so passwords must be changed in a specific timeframe).

Have everyone use a password manager rather than storing passwords directly on their computers. This will also make it easier for employees to remember the complex passwords they create.

3. Implement two-factor authentication (2FA)

A password should only be one part of the login equation, however. Non-profits should also implement 2FA across an organization. Users must verify that they are who they say they are by approving a login through a second device (usually their phone). Ideally, this authentication should be done through an app. While better than nothing, SMS is more easily hijacked than dedicated authenticator apps.

4. Prioritize regular data backups

While backups won’t keep an organization from being the victim of a cyberattack, it will put them in a much better position if it happens. Ransomware attacks, for example, lose their teeth if the data they’re threatening to delete is safely backed up elsewhere.

5. Remain alert for potential threats

Keep a steady eye on online presence to spot and handle any suspicious activity before it becomes problematic. That means monitoring networks, servers, websites, and social media presence.

6. Encrypt sensitive information

The unfortunate fact of cybersecurity is that, even with all the right protections in place, breaches can still happen, which is why it’s so important that all personal and private data is heavily encrypted. That way, even if someone can steal sensitive files and documents, they won’t be able to read them.

7. Limit access permissions

While providing open access to an organization’s data to all team members might be easier, it’s also a massive vulnerability. The default behavior should be to deny access to information unless an employee needs to see it.

Summary

It can be tempting to think that just because a nonprofit is small, they’re not under the radar of any cybercriminals looking to make a buck. But the truth is that these qualities make them the exact target they’re looking for. The sooner data is kept safe, the better off a nonprofit will be.