![\"\"](\"https:\/\/accountingforgood.com.au\/wp-content\/uploads\/2024\/11\/AFG-Cyber-security-for-not-for-profit-organisations.webp\" "\\"AFG-Cyber")
<\/p><\/div>\n
\u00a0<\/p>\n
Not For Profit organisations (NFPs) are not immune to cybercrime. Hackers are becoming more sophisticated and targeting a broader range of victims. In this article we examine how they operate and steps your organisation can take to protect itself.<\/p>\n
The financial and operational toll of cybercrime is punishing. According to recent reports, cybercrime costs Australian entities millions annually as hackers grow more sophisticated and target a broader range of victims, including organisations like yours. For NFPs, a cyber breach can be particularly damaging\u2014financially and in terms of trust and reputation within the community. Beyond monetary losses, organisations can suffer setbacks in service delivery, administrative delays, and even long-lasting operational and reputational issues.<\/p>\n
As specialists in accounting for the not-for-profit sector, we understand the importance of proactive financial security and robust cybersecurity protocols. Protecting your NFP\u2019s data and financial assets against cyber threats is paramount to sustaining your mission and safeguarding your stakeholders.<\/p>\n<\/p><\/div>\n
Understanding the hacker\u2019s mindset<\/h2>\n
\n<\/p><\/div>\n
Understanding how cybercriminals operate is useful, as many attacks on NFPs are not random. Cybercriminals often target organisations with perceived vulnerabilities, knowing that many NFPs focus more on their mission than cybersecurity infrastructure. Hackers can be highly skilled, motivated, and organised, and their tactics can range from direct financial theft to data breaches intended to disrupt or manipulate organisational activities.<\/p>\n
Hackers come in various types. Some are \u201cscript kiddies,\u201d generally younger individuals using readily available tools to break into systems for the thrill rather than financial gain. Others are advanced hackers, often part of organised cybercrime groups, who systematically exploit vulnerabilities to steal sensitive data and funds. These groups may even target specific sectors, including NFPs, for potential data access and disruption.<\/p>\n<\/p><\/div>\n
Common tactics used against Not-for-Profits<\/h2>\n
\n<\/p><\/div>\n
Cybercriminals often exploit weaknesses in outdated systems, unsecured devices, and insufficient policies. Not-for-profits are particularly vulnerable to tactics like phishing, malware attacks, and social engineering. Phishing emails that appear legitimate\u2014often mimicking banks, service providers, or donors\u2014may encourage staff to \u201cverify\u201d organisational information. It is highly recommended to train your team to identify and verify suspicious communications. .<\/p>\n
Hackers can install malicious software to monitor keystrokes and capture passwords and sensitive data. This often occurs through unreliable downloads or unprotected browsing. Using licensed antivirus software and restricting downloads to approved sources are important security measures.<\/p>\n
Some hackers may hijack a person\u2019s mobile number to intercept two-factor authentication (2FA) codes, giving them access to critical accounts and gather information from publicly accessible profiles known as social engineering or social media exploitation.<\/p>\n<\/p><\/div>\n
Establishing cybersecurity policies and procedures<\/h2>\n
\n<\/p><\/div>\n<\/p><\/div>\n\n ![\"\"](\"https:\/\/accountingforgood.com.au\/wp-content\/uploads\/2024\/11\/AFG-Establishing-cybersecurity-policies-and-procedures.webp\" "\\"AFG-Establishing")
<\/p><\/div>\n
\n\u00a0<\/p>\n
To protect against these attacks, every NFP should have a cybersecurity policy in place outlining procedures to prevent and respond to breaches. This policy should include data protection protocols, regular system updates, and access controls. By implementing a clear, formalised plan, your organisation can reduce risks and respond quickly in case of a cyber incident.<\/p>\n
\n- Ensure the policy covers data handling, device security, and access controls. The policy should outline who is responsible for data security and how incidents will be handled.<\/li>\n
- Restrict access to sensitive data based on role-specific requirements. Only authorised personnel should have access to financial and donor information.<\/li>\n
- Regular training is essential for building cyber awareness. Conduct workshops or seminars to educate staff about recognising phishing emails, secure password practices, and the importance of data protection.<\/li>\n
- Establish a reliable data backup system and a recovery plan. In the event of a cyber attack, having secure backups can ensure that your organisation can continue operations with minimal disruption.<\/li>\n
- Work with an IT specialist or cybersecurity consultant to conduct routine security checks, ensuring systems and protocols meet current standards.<\/li>\n<\/ul><\/div>\n\n\n
Key cybersecurity practices for your organisation<\/h2>\n
\n<\/p><\/div>\n
Passwords are the first line of defence. Use complex passwords that combine letters, numbers, and symbols. Avoid easily guessed terms, such as birthdays or organisation names. Encourage staff to use unique passwords across platforms and change them regularly.<\/p>\n
Two-factor authentication requires a secondary verification step, providing an added layer of security. Implement 2FA on all critical systems to help prevent unauthorised access.<\/p>\n
Employ antivirus software across all devices to monitor and prevent suspicious activities. Ensure the firewall is active to create a barrier between your network and potential threats.<\/p>\n
Public Wi-Fi networks are vulnerable to attacks. Discourage staff from accessing organisational accounts on unsecured networks and, where possible, use a virtual private network (VPN).<\/p>\n
Review login history and account activity regularly to identify unfamiliar devices or logins. Suspicious activity can be an early sign of a breach.<\/p>\n<\/p><\/div>\n
<\/p><\/div>\n
\u00a0<\/p>\n
To protect against these attacks, every NFP should have a cybersecurity policy in place outlining procedures to prevent and respond to breaches. This policy should include data protection protocols, regular system updates, and access controls. By implementing a clear, formalised plan, your organisation can reduce risks and respond quickly in case of a cyber incident.<\/p>\n
- \n
- Ensure the policy covers data handling, device security, and access controls. The policy should outline who is responsible for data security and how incidents will be handled.<\/li>\n
- Restrict access to sensitive data based on role-specific requirements. Only authorised personnel should have access to financial and donor information.<\/li>\n
- Regular training is essential for building cyber awareness. Conduct workshops or seminars to educate staff about recognising phishing emails, secure password practices, and the importance of data protection.<\/li>\n
- Establish a reliable data backup system and a recovery plan. In the event of a cyber attack, having secure backups can ensure that your organisation can continue operations with minimal disruption.<\/li>\n
- Work with an IT specialist or cybersecurity consultant to conduct routine security checks, ensuring systems and protocols meet current standards.<\/li>\n<\/ul><\/div>\n\n\n
Key cybersecurity practices for your organisation<\/h2>\n
\n<\/p><\/div>\nPasswords are the first line of defence. Use complex passwords that combine letters, numbers, and symbols. Avoid easily guessed terms, such as birthdays or organisation names. Encourage staff to use unique passwords across platforms and change them regularly.<\/p>\n
Two-factor authentication requires a secondary verification step, providing an added layer of security. Implement 2FA on all critical systems to help prevent unauthorised access.<\/p>\n
Employ antivirus software across all devices to monitor and prevent suspicious activities. Ensure the firewall is active to create a barrier between your network and potential threats.<\/p>\n
Public Wi-Fi networks are vulnerable to attacks. Discourage staff from accessing organisational accounts on unsecured networks and, where possible, use a virtual private network (VPN).<\/p>\n
Review login history and account activity regularly to identify unfamiliar devices or logins. Suspicious activity can be an early sign of a breach.<\/p>\n<\/p><\/div>\n
![\"\"](\"https:\/\/accountingforgood.com.au\/wp-content\/uploads\/2024\/10\/AFG-Financial-compliance-specialist-.webp\" "\\"AFG-Financial-compliance-specialist-\\"")
<\/p><\/div>\n