Some of the key vulnerabilities that charities will need to address in terms of cyber security are:
▶ Staff and volunteers
Phishing is a significant risk for charities as volunteers may not have the necessary training or systems to identify these fraudulent emails. Phishing emails have become more sophisticated, and even with robust security measures in place, an external email with a malicious link or attachment can lead to cybercrimes. For example, scammers have used fake invoices and spoofed or impersonated emails to trick individuals into divulging sensitive information or making payments. Clicking on a link in these emails can also result in malware entering the network or unauthorised access to data.
▶ Access issues
IT vendor issues present another cybersecurity risk for organisations. Although outsourcing IT maintenance or setup to experts can be beneficial, it can also create vulnerabilities. For example, if the IT vendor is attacked or infiltrated, they could potentially compromise all of their clients through remote connections. Data shows that only 5% of charities review potential cyber security risks their suppliers pose. Therefore, it is vital to ensure IT vendors have implemented appropriate cybersecurity measures to mitigate this risk. These include strong access controls, regularly reviewing their security protocols, and prioritising employee cybersecurity awareness training.
▶ Weak passwords pose another vulnerability. Attackers can use various methods to guess passwords, including brute-force attacks or social engineering techniques. To avoid this, don't use easily guessable, simple or reused passwords and implement two-factor authentication where possible. Again awareness training for employees and volunteers will help reinforce good security practices.
▶ Insider threats from the mishandling of personal data also present a vulnerability. Even leaving hard copies of sensitive information lying around on public display is a potential cyber risk, so it is important to have strong policies in place for accessing and storing personal data.
▶ Whilst backups enable you to restore lost data, if your backup is connected to the same network as the primary system, a malware infection on the main system could also spread to the backup, resulting in multiple corruptions. If criminals perform a ransomware attack, they could access and encrypt the backups too. Therefore, creating an offline backup (not connected to the main system) is vital to mitigate this vulnerability.
