Train Your Nonprofit’s Employees to Combat Hackers
June 4, 2023

Your nonprofit organization can’t count its cybersecurity program effective unless it properly trains employees. If staffers visit “dangerous” websites, mix work and personal accounts, or can’t recognize a social engineering scheme, they may open the door to hackers. Both new employee training and refresher courses for longtime staffers can protect your organization.

Leading Cause of Data Loss

According to a recent study from the Ponemon Institute, a technology consulting company, employee negligence is the leading cause of data loss incidents. In fact, almost 60% of organizations experienced data loss due to an employee mistake involving email in the previous 12 months.

The shift to remote work, increasingly common for nonprofits, is notable, too. The Ponemon study found a strong correlation between the number of remote workers an organization has and a data breach’s cost. But the study also found that certain factors — including employee training — are associated with a lower-than-average breach cost.

Social Engineering Threats

Perhaps the most critical cybersecurity threat to your organization is social engineering, so make it a central focus of employee training. In social engineering attacks, including phishing schemes, cybercriminals use social skills to obtain data or compromise a target’s network. Phishing is responsible for 16% of data breaches, according to the Ponemon report.

But phishing is just one example of the social engineering threats your employees might encounter. “Vishing,” for example, uses voice communication. It can be combined with other types of social engineering to lure a victim to call a certain number and reveal sensitive information. “Smishing” leverages SMS messages with dangerous links.

Making Technology Safer

Another common risk is when staffers mix business and personal accounts, information, and devices. You need to explain why they shouldn’t conduct business activities (such as accessing your organization’s bank account) on their personal phone or play games on their employer-provided laptop. Similarly, they shouldn’t share USB flash drives, hard drives or other external hardware between business and personal devices. And they shouldn’t download software or apps from unknown sources either.

Creating a culture of safe browsing is particularly important now that so much work is done remotely. In addition to warning employees to be cautious about suspicious attachments and links, you might want to require them to use a virtual private network (VPN) when accessing your system. A VPN establishes a secure, encrypted connection, hides the user’s IP address and acts as a filter to protect data from cybercriminals.

As always, strong passwords that are frequently changed should be required. Passwords to access accounting, HR and other sensitive data should be given only to those who require it and changed as soon as they don’t.

Training Format

The substantive content of your employee cybersecurity training is critical, but don’t overlook the importance of format. One-sided lectures and slide shows are unlikely to engage or stick with the audience. If you want staffers to walk away ready to put your lessons into action, make the training interactive. For example, create simulations during or after training that allow trainees to put what they’ve learned to the test.

Some organizations deploy simulations in the midst of a workday to check how employees respond. These real-time assessments can provide much better insight into whether employees retain actionable knowledge than a quiz during training.

If the Worst Happens

If despite all your and your staffers’ best efforts, your network is hacked, don’t try to handle the situation yourself. Work with security experts to repair the damage. And contact us for help creating a more risk-averse environment.

© 2023


You might also like

Even a Lower-Cost Benefits Menu Can Help Attract Talent

Even a Lower-Cost Benefits Menu Can Help Attract Talent

Some job candidates assume that nonprofit organizations offer lower compensation than for-profit companies do. If your nonprofit has open positions, this can be a difficult hurdle to overcome — particularly if you don’t have the budget to compete with for-profit...

read more
Thinking Ahead to Your Next Form 990

Thinking Ahead to Your Next Form 990

The deadline for most nonprofits to file Form 990 with the IRS (May 15, 2024) has come and gone. Assuming your organization operates on a calendar-year tax basis and filed its Form 990 on time, you probably don’t want to think about tax reporting again until next...

read more
Why Private Foundations Need to Avoid Self-Dealing

Why Private Foundations Need to Avoid Self-Dealing

If you’re a leader of a private foundation, you’re probably aware of the prohibition against self-dealing transactions between foundations and “disqualified persons.” But what constitutes self-dealing? And who exactly counts as disqualified in this context? It’s...

read more