Latest / The Nonprofit Podcast / Ep 138| Stay Secure: Cybersecurity Tips for Nonprofits

Transcript

Ep 138| Stay Secure: Cybersecurity Tips for Nonprofits · The Nonprofit Podcast

• 0:04
  SPEAKER_01: The Nonprofit Podcast, powered by Donor Bucks.
• 0:08
  SPEAKER_01: Along with all the goodwill and generosity that giving season brings comes a crowd of uninvited and decidedly unwelcome hangers on, hackers, bad actors, and scammers who are working hard to make your hard work their big payday.
• 0:26
  SPEAKER_01: A cyber attack hits every 39 seconds, and nonprofits are 50% more likely to be the target.
• 0:35
  SPEAKER_01: Are you prepared?
• 0:36
  SPEAKER_01: Welcome to the nonprofit podcast.
• 0:38
  SPEAKER_01: I'm Jenna, education and community engagement manager here at Donorbox.
• 0:43
  SPEAKER_01: We are here each week with practical actions you can use today to take your nonprofit to the next level tomorrow.
• 0:51
  SPEAKER_01: I'm joined by Kimmy Arnett, IT security support here at Donorbox.
• 0:56
  SPEAKER_01: And today we're investigating the vulnerabilities that make nonprofits so appealing to threat actors, the value of protecting your data and keeping trust with your donors.
• 1:08
  SPEAKER_01: Welcome, Kimmy.
• 1:09
  SPEAKER_01: Thanks for joining us today.
• 1:11
  SPEAKER_01: I know how busy this time of year is for your team, but as security month comes to a close, I know you have some must-have tips that you'd like to share.
• 1:21
  SPEAKER_02: Hey Jenna, thanks for having me.
• 1:22
  SPEAKER_02: It's great to be here.
• 1:24
  SPEAKER_02: Yes, cyber criminals are becoming more and more sophisticated every single day.
• 1:28
  SPEAKER_02: They utilize advanced techniques like phishing, ransomware, social engineering, and they use them to launch targeted and highly effective attacks.
• 1:37
  SPEAKER_02: So according to recent studies, ransomware attacks have increased by over 150% in the past year alone, and nonprofits are no exception.
• 1:47
  SPEAKER_02: For instance, the 2020 Blackbod data breach affected numerous nonprofit organizations worldwide, exposing sensitive donor information.
• 1:56
  SPEAKER_02: And the FTC said that it was due to security being too lax.
• 2:01
  SPEAKER_01: Yes, I remember hearing about that attack.
• 2:03
  SPEAKER_01: And I know that a lot of organizations were on edge.
• 2:07
  SPEAKER_01: And we know nonprofits face unique challenges in this digital space, especially during high donation periods like giving season, which is the season that we're in right now.
• 2:17
  SPEAKER_01: So can you explain why nonprofits are often seen as prime targets for these cyber criminals?
• 2:24
  SPEAKER_02: Absolutely.
• 2:25
  SPEAKER_02: So nonprofits often operate with limited budgets, which can mean less robust security measures compared to larger corporations.
• 2:34
  SPEAKER_02: So they handle sensitive donor data, including personal and financial information, making them attractive to these threat actors or attackers.
• 2:43
  SPEAKER_02: Despite some nonprofits operating on a limited budget, they collectively raise over$1 trillion annually to deliver programs, but they generally have lower security and higher risk than other sectors handling payments.
• 2:57
  SPEAKER_02: So cyber criminals see nonprofits as gateways to larger targets due to the data that they hold and not just donor information, but also the details about payments and partnerships.
• 3:08
  SPEAKER_02: And during these periods like giving season or election cycles, the volume of online activity increases significantly.
• 3:15
  SPEAKER_02: And this uptick provides more opportunities for these hacktivists or cyber criminals to exploit vulnerabilities through phishing emails and other scams.
• 3:24
  SPEAKER_01: I think I've learned a new term today.
• 3:31
  SPEAKER_01: Now I want to drill down on how fraud impacts nonprofits, where the vulnerabilities lie, and what they need to be aware of.
• 3:40
  SPEAKER_01: So, what, if any, are the warning signs to look out for, would you say?
• 3:44
  SPEAKER_02: Fraud can affect nonprofits in several ways.
• 3:48
  SPEAKER_02: For one, data breaches.
• 3:50
  SPEAKER_02: So attackers exploit vulnerabilities to access sensitive donor information, and this can lead to identity theft, financial loss, significant reputational damage.
• 4:01
  SPEAKER_02: And the average cost of these data breaches, according to IBM's data breach report in 2021, was over$4 million.
• 4:10
  SPEAKER_02: Another way could be forced downtime and ransomware.
• 4:15
  SPEAKER_02: These ransomware attacks can halt operations entirely.
• 4:18
  SPEAKER_02: The average downtime after such an attack is about 21 days, which can be devastating during critical fundraising periods like this.
• 4:27
  SPEAKER_02: Payment fraud, attackers use donation forms to test stolen credit cards, leading to increased chargeback fees and potential account blocks.
• 4:36
  SPEAKER_02: And nonprofits can face chargeback fees ranging from$20 to$100 per fraudulent transaction.
• 4:42
  SPEAKER_02: Spam donations, these can damage your reputation and operational efficiency.
• 4:46
  SPEAKER_02: Accounts flagged as at risk may disrupt legitimate transactions leading to lost donations in donor trust.
• 4:54
  SPEAKER_02: So the warning signs include unusual spikes in transaction activity and multiple small donations from the same source or unfamiliar IP addresses accessing your systems.
• 5:06
  SPEAKER_01: Okay, so speaking of new terms that I am learning, one that I want to dig into more is flagging.
• 5:13
  SPEAKER_01: What is flagging and how does it impact fundraising operations and how long does it take to restore services and lose the at-risk flag or designation?
• 5:25
  SPEAKER_02: So flagging occurs when payment processors or banks detect suspicious activity on your accounts, such as a high number of chargebacks or fraudulent transactions.
• 5:37
  SPEAKER_02: This can lead to temporary holds on your account, delaying access to funds or even freezing transactions altogether.
• 5:43
  SPEAKER_02: Resolving these issues can take anywhere from a few days to several weeks, depending on the severity of your responsiveness.
• 5:51
  SPEAKER_02: And during this period, your ability to process legitimate donations is hindered, which can significantly impact fundraising efforts, especially during peak seasons.
• 6:02
  SPEAKER_02: It's crucial to have robust fraud detection and prevention measures in place to minimize these risks and ensure continuous operation.
• 6:10
  SPEAKER_01: That sets up my next question perfectly.
• 6:13
  SPEAKER_01: What should nonprofits look for when choosing a platform?
• 6:16
  SPEAKER_01: But before we dive into this, there are some terms used that not everyone, especially us non-tech types like me, may need help understanding.
• 6:24
  SPEAKER_01: So are you ready to play Oracle here, Kimmy?
• 6:27
  SPEAKER_01: Yeah, sure.
• 6:27
  SPEAKER_01: Bring it on.
• 6:28
  SPEAKER_01: Okay.
• 6:29
  SPEAKER_01: First up, what is PCI certification?
• 6:33
  SPEAKER_01: I see it all over the place.
• 6:35
  SPEAKER_01: And why is PCI compliance essential for an online donation platform?
• 6:40
  SPEAKER_02: That's a great question, Jenna.
• 6:42
  SPEAKER_02: Okay, so PCI DSS stands for Payment Card Industry Data Security Standard.
• 6:49
  SPEAKER_02: And simply put, it's a set of security standards designed to ensure that all companies processing, storing, or transmitting credit card information maintain a secure environment.
• 7:00
  SPEAKER_02: So there are 12 requirements for PCI DSS compliance covering areas like maintaining a secure network, protecting cardholder data, and monitoring and testing networks.
• 7:12
  SPEAKER_02: And uh PCI level one compliance is the highest standard, requiring a vigorous annual audit by a qualified security assessor.
• 7:21
  SPEAKER_02: And so for DonorBox, achieving PCI level one compliance means we adhere to the most stringent security protocols, safeguarding donor information with bank grade security.
• 7:32
  SPEAKER_02: And while some platforms rely solely on their payment processors' compliance, donor box has actually ensured that our entire system meets and upholds these rigorous standards.
• 7:41
  SPEAKER_02: And additionally, we comply with the strong customer authentication requirements under the PSD2 regulations in Europe, adding an extra layer of security for transactions.
• 7:50
  SPEAKER_01: So essentially, this is bank grade security.
• 7:52
  SPEAKER_01: So that's very reassuring to know.
• 7:54
  SPEAKER_01: Now, encryption is usually mentioned along with this term tokenization.
• 8:00
  SPEAKER_01: Can you give us a basic idea of what tokenization actually is and where it's used?
• 8:05
  SPEAKER_02: Tokenization is a process where sensitive data like credit card numbers, for instance, are replaced with a unique identifier known as a token.
• 8:15
  SPEAKER_02: And this token has no meaningful value if intercepted, which makes it useless to a hacker.
• 8:21
  SPEAKER_02: So just think of it like using a poker chip in a casino.
• 8:25
  SPEAKER_02: The chips represent money but aren't actual currency outside of the casino.
• 8:30
  SPEAKER_02: And so similarly, tokenization ensures that even if data is intercepted, no actual card information is exposed.
• 8:37
  SPEAKER_02: And at DonorBox, we never store any credit card information on our servers.
• 8:41
  SPEAKER_02: Only the connected payment processors like Stripe or PayPal handle the actual card details.
• 8:47
  SPEAKER_02: And this significantly reduces the risk of data breaches and protects donor information.
• 8:52
  SPEAKER_01: Something else we hear about, but may not fully understand or recognize how devastating the impact can be to organizations is DDOS or DDOS attacks.
• 9:02
  SPEAKER_01: Can you tell me a little bit more about that?
• 9:04
  SPEAKER_02: DDOS stands for distributed denial of service or just simply put, a DOS attack or a DDoS attack.
• 9:13
  SPEAKER_02: And in these situations, it's where multiple compromise systems flood a targeted website or service with traffic, overwhelming it to the point where it becomes unavailable to legitimate users.
• 9:27
  SPEAKER_02: So think a thousand people with their shopping carts trying to enter through one store entrance at the same time.
• 9:32
  SPEAKER_02: For nonprofits, this means your website or donation pages could go down during critical fundraising campaigns.
• 9:38
  SPEAKER_02: And according to NetScout's threat intelligence report, there were over 10 million DDoS attacks globally in 2020, the highest number ever recorded.
• 9:46
  SPEAKER_02: And these attacks not only result in immediate financial loss due to missed donations, but can also damage your organization's reputation.
• 9:55
  SPEAKER_02: And donors may question your recreability and security measures if they can't access your services when they want to contribute.
• 10:01
  SPEAKER_02: DDoS attacks can be a smokescreen for other malicious activities, think data breaches or malware injections.
• 10:08
  SPEAKER_02: So that's why robust DDoS protection is crucial.
• 10:12
  SPEAKER_01: Kimmy, we've talked about how nonprofits are particularly vulnerable to cyber threats, especially during these high traffic periods like giving season.
• 10:20
  SPEAKER_01: So can you walk us through the advanced security features DonorBox offers to safeguard organizations and their donors and what makes these solutions stand out in the fight against online fraud and those cyber attacks?
• 10:35
  SPEAKER_02: Certainly.
• 10:35
  SPEAKER_02: So DonorBox deploys multiple layers of security to protect nonprofits and their donors.
• 10:42
  SPEAKER_02: The first being 24-7 automated fraud detection.
• 10:46
  SPEAKER_02: We partner with leading payment processors like Stripe and PayPal, which use machine learning algorithms to detect and block fraudulent activities in real time.
• 10:56
  SPEAKER_02: This includes identifying patterns that indicate credit card testing or other malicious behaviors.
• 11:02
  SPEAKER_02: We employ zip code validation and recapture, and these features help verify legitimate donors while blocking bots and malicious actors.
• 11:11
  SPEAKER_02: The zip code validation ensures that billing address matches the card details, adding an extra layer of security.
• 11:17
  SPEAKER_02: The recapture protects against automated bot attacks without disrupting the user experience.
• 11:23
  SPEAKER_02: We use SSL and TLS encryption, and all data transmitted through Donor Max is encrypted using industry standard SSL and TSL protocols.
• 11:31
  SPEAKER_02: And this means that any information exchanged between the donor's browser and our servers is secure and confidential.
• 11:37
  SPEAKER_02: And like we talked about earlier, tokenization.
• 11:40
  SPEAKER_02: So we don't store any card data on our servers.
• 11:43
  SPEAKER_02: Tokenization ensures sensitive information is securely handled by the payment processor, making donor information practically inaccessible to hackers.
• 11:50
  SPEAKER_02: We've got DDoS protection.
• 11:52
  SPEAKER_02: We utilize advanced DDoS mitigation strategies to ensure your donation pages remain active even during targeted attempts to disrupt your operations.
• 12:01
  SPEAKER_02: And we have PCI DSS level one compliance.
• 12:05
  SPEAKER_02: By adhering to the highest standards of payment security, we ensure all transactions are encrypted, secure, and continuously protected.
• 12:13
  SPEAKER_02: And last but not least, we have fraud prevention settings, and that's enabled by default for all campaigns.
• 12:20
  SPEAKER_02: These settings automatically block scammers attempting multiple failed donation attempts.
• 12:25
  SPEAKER_02: We auto-blacklist repeat offenders across our network and provide detailed scam reports for your review.
• 12:30
  SPEAKER_02: Oh, we forgot multi-factor authentication.
• 12:33
  SPEAKER_02: So we strongly encourage all of our users to enable MFA on their donor box accounts.
• 12:38
  SPEAKER_02: And it's super easy to set up.
• 12:40
  SPEAKER_02: This adds an extra layer of security by requiring a second form of verification when logging in.
• 12:45
  SPEAKER_01: Okay.
• 12:45
  SPEAKER_01: As we are in the thick of giving season, what are three practical steps that nonprofits can take right now to protect themselves and their donors?
• 12:54
  SPEAKER_01: Great question, Jenna.
• 12:56
  SPEAKER_02: Here's three actionable steps right here.
• 12:58
  SPEAKER_02: Okay, so for number one, most importantly, enable multi-factor authentication.
• 13:02
  SPEAKER_02: Implement it on all of your accounts, especially those handling sensitive data.
• 13:06
  SPEAKER_02: It's generally quick to set up and significantly reduces the risk of unauthorized access to your sensitive information.
• 13:14
  SPEAKER_02: Number two, conduct regular vulnerability assessments.
• 13:17
  SPEAKER_02: Regularly assess your systems for potential weaknesses and address them promptly.
• 13:22
  SPEAKER_02: This includes software updates, patching vulnerabilities, and reviewing access controls.
• 13:28
  SPEAKER_02: And then last but not least, educate your staff on phishing scams.
• 13:32
  SPEAKER_02: Human error is often the weakest link in cybersecurity.
• 13:36
  SPEAKER_02: So provide regular training to your staff to recognize and report phishing attempts and other suspicious activities.
• 13:43
  SPEAKER_02: According to Verizon's data breach investigations report, phishing is responsible for a significant portion of data breaches each year.
• 13:51
  SPEAKER_01: It's clear that protecting donor data is not just about technology, it's also about building and maintaining trust with your donors and having the same level of trust with your online donation platform provider as well.
• 14:06
  SPEAKER_01: And it's very clear that we provide a lot of measures to keep our users safe and secure and their donors as well.
• 14:12
  SPEAKER_01: So, final question for you: what would you recommend for nonprofits looking to further secure their online presence?
• 14:21
  SPEAKER_02: I would say number one, invest in a comprehensive, security-focused platform partner that offers end-to-end encryption and real-time monitoring.
• 14:31
  SPEAKER_02: So, shameless plug, donor box is committed to providing that level of security.
• 14:35
  SPEAKER_02: We stay ahead of emerging threats to ensure your organization and your donor data remain secure.
• 14:41
  SPEAKER_02: Additionally, focus on getting a culture of security within your organization.
• 14:46
  SPEAKER_02: Ensure that everyone from leadership to volunteers is aware of best practices and understands their role in maintaining security for your organization.
• 14:54
  SPEAKER_02: And finally, regularly review and update your security policies to adapt to emerging threats.
• 15:00
  SPEAKER_02: Cybersecurity is an ever-changing landscape and staying informed is key.
• 15:05
  SPEAKER_02: For example, ransomware attacks start becoming more sophisticated and phishing emails are increasingly personalized.
• 15:12
  SPEAKER_02: So being proactive can make all the difference.
• 15:15
  SPEAKER_01: Thank you so much for breaking this down and for being here today, Kimmy.
• 15:20
  SPEAKER_01: For those listening, we do have a landing page on donor box security measures.
• 15:25
  SPEAKER_01: So I'll be sure that we link that in the show notes.
• 15:27
  SPEAKER_01: I think you've given our listeners a lot to consider today.
• 15:31
  SPEAKER_01: Of course.
• 15:31
  SPEAKER_01: Thanks for having me, Jenna.
• 15:33
  SPEAKER_01: And thank you for joining us on the Nonprofit Podcast.
• 15:36
  SPEAKER_01: I hope you've left with the confidence to take a small step today that will make a big difference tomorrow.
• 15:42
  SPEAKER_01: Be sure to click the download button on your podcast player, then leave the nonprofit podcast a review, or give it a thumbs up if you're listening to the nonprofit podcast on YouTube.
• 15:51
  SPEAKER_01: Your review is a great way to help others find us.
• 15:53
  SPEAKER_01: You're here to help others, we're here to help you.
• 15:56
  SPEAKER_01: Until next time, stay inspired.
• 16:03
  SPEAKER_00: And we believe it should be available to everyone.
• 16:06
  SPEAKER_00: From frontline heroes to first-time fundraisers.
• 16:09
  SPEAKER_00: Our tools empower you to help others.
• 16:12
  SPEAKER_00: This is our mission.
• 16:13
  SPEAKER_00: This is DonorBox.
• 16:15
  SPEAKER_00: Helping you help others.