WEBVTT
00:00:00.800 --> 00:00:06.559
Welcome to the Executive Thought Partner Podcast, where leadership, strategy, and growth intersect.
00:00:06.799 --> 00:00:07.360
I'm Dr.
00:00:07.440 --> 00:00:09.519
Daniel Freeman, Executive Thought Partner.
00:00:09.759 --> 00:00:12.000
This isn't just a podcast about fundraising.
00:00:12.160 --> 00:00:21.920
It's about how leaders think, decide, and build systems that scale impact across nonprofits, higher education, athletics, and mission-driven enterprises.
00:00:22.320 --> 00:00:28.719
Here we explore major gifts, governance, culture, and the quiet decisions that determine long-term momentum.
00:00:29.039 --> 00:00:35.039
If you're leading something that matters and you want clarity with conviction, you're in the right place.
00:00:35.200 --> 00:00:36.479
Let's get into it.
00:00:36.880 --> 00:00:39.600
Welcome to the Executive Thought Partner Podcast.
00:00:39.679 --> 00:00:40.640
I'm your host, Dr.
00:00:40.719 --> 00:00:41.679
Dan Freeman.
00:00:42.079 --> 00:00:44.159
Today we have Trey Tucker.
00:00:44.320 --> 00:00:50.560
We are going to be speaking about security for your nonprofit, for your organization.
00:00:51.039 --> 00:00:58.640
And Trey's going to hit on some really important pieces because I believe people are not thinking about it until it happens to them.
00:00:58.719 --> 00:01:00.560
And those are words right out of Trey's mouth.
00:01:00.640 --> 00:01:05.599
So I'm going to pass it to Trey to talk a little bit about himself, and then we're going to jump right in.
00:01:06.239 --> 00:01:08.640
Hey Daniel, Trey Tucker with AtNet.
00:01:08.879 --> 00:01:12.000
Appreciate again you having me on the uh the podcast.
00:01:12.319 --> 00:01:16.000
Yeah, we're going to talk about uh cybersecurity day and some of the topics that we're going to come up.
00:01:16.079 --> 00:01:18.000
And I feel like it's kind of undervalued.
00:01:18.159 --> 00:01:28.640
Everybody's always like, or companies are always like, yeah, we're we're okay until you you get a cyber breach or ransomware, and then it gets really personal and there can be some issues.
00:01:28.719 --> 00:01:39.280
So it's always good to have these different topics we're going to discuss out there and some uh tips and tricks and some security tools to uh protect yourself against the uh bad bad actors out there.
00:01:39.599 --> 00:01:40.319
Thanks, Trey.
00:01:40.480 --> 00:01:46.000
Trey, can you tell us a little bit about your background, how you got into cybersecurity and how long you've been there?
00:01:47.200 --> 00:01:48.000
Yeah, appreciate that.
00:01:48.079 --> 00:01:57.920
Yeah, I've been with um at net since around December 2024 and got into IT support and cybersecurity actually from Lake Norman and Charlotte IT.
00:01:58.000 --> 00:02:07.760
I know you network a whole lot and I do, so very loyal to that group and got that from another colleague that uh passed my name along and always wanted to get in IT and cybersecurity.
00:02:07.920 --> 00:02:09.599
So the power of networking.
00:02:09.919 --> 00:02:11.039
Yeah, that's great.
00:02:11.120 --> 00:02:13.120
Well, let's let's jump right in, Trey.
00:02:13.280 --> 00:02:20.960
So something that you had mentioned just now, and and I want you to, I can't wait for you to talk about this.
00:02:21.199 --> 00:02:25.360
Why are nonprofits a hacker's favorite target?
00:02:27.360 --> 00:02:32.879
Yeah, definitely they think they're a lot smaller than they are, but it's like uh a nonprofit.
00:02:33.199 --> 00:02:42.479
But the note is you don't have to be the biggest to be targeted because they don't care the uh hackers or the cybersecurity bad actor.
00:02:42.800 --> 00:02:50.000
They're all about getting your contact information, your banking information, donor information, and you're being a focus.
00:02:50.319 --> 00:03:02.719
So I think they have their guard down just like hey, we're just uh you know a smaller nonprofit, but they should they should have their guard up even more, having the different tools of cybersecurity, cyber insurance, MFA, some of the other tools that we'll we'll mention.
00:03:02.800 --> 00:03:10.159
So I believe that's why they're a target because they think they're too small and and not a focus, but that's uh not the case at all.
00:03:10.560 --> 00:03:16.719
You know, Trey, I was I was talking to someone today, and we're talking about the term users.
00:03:17.360 --> 00:03:25.360
And I always thought that organizations like yourself, businesses, focused on revenue.
00:03:25.919 --> 00:03:35.360
But what I what I started to connect, especially for our conversation today, was it's the amount of people and information that runs through the networks, right?
00:03:35.520 --> 00:03:38.479
So it could be a small nonprofit, right?
00:03:38.560 --> 00:03:55.599
They could have three to five people, but if you have a CRM with people's banking information, with their personal information, and you have hundreds of people that are in that or thousands or more, that becomes a lot more valuable to a bad actor.
00:03:55.759 --> 00:03:56.639
Is that right?
00:03:56.879 --> 00:03:58.159
That's correct.
00:03:58.479 --> 00:04:09.520
And another one with the bad actors, a lot of people don't realize that they have sales teams as well, they have sales quotas, they have managers that set up like a system, which is pretty scary.
00:04:09.680 --> 00:04:12.479
So they're they're out there to close their deals any way they can.
00:04:12.639 --> 00:04:14.960
So it's uh it's big business out there.
00:04:15.039 --> 00:04:17.519
It's it's bad and and scary, but it is business.
00:04:17.839 --> 00:04:20.480
Big business for small business, but not in a good way.
00:04:20.800 --> 00:04:21.680
That's right.
00:04:22.480 --> 00:04:33.600
So, you know, you you talked about kind of it sounds like nonprofits are hackers' favorite targets because nonprofits think they're small enough that they're not targets, right?
00:04:33.759 --> 00:04:37.199
So they're they're not thinking outside of themselves.
00:04:37.600 --> 00:04:42.959
So one of the next things that I always think about is you mentioned MFAs, right?
00:04:43.120 --> 00:04:44.959
Multi-factor authentication.
00:04:45.199 --> 00:04:49.680
I've had to do that so many times, the places that I've worked at, right?
00:04:50.240 --> 00:04:58.800
And you always talk about protecting donor data is so paramount because there's a trust that comes with how well you do that.
00:05:00.879 --> 00:05:01.839
Yeah, exactly.
00:05:02.000 --> 00:05:10.000
It's uh, you know, there's a donor data list, for example, there's names, addresses, given history, credit reports.
00:05:10.319 --> 00:05:18.399
So I know that can be very like frustrating with MFA, and for example, you have to do dual mobile, is what we use, or you got to click on that.
00:05:18.480 --> 00:05:24.319
It's it's annoying, it can be, but it definitely cuts out a whole lot of that, different layers of security to get to that.
00:05:24.399 --> 00:05:26.720
So I think that's at least some of the basic levels.
00:05:26.959 --> 00:05:39.519
But during answer question, there's a lot of mid-sized nonprofits, for example, might be a CRM, and there's 8,000 donor records, and there might be a breach, for example.
00:05:39.759 --> 00:05:47.759
And there was one that was uh like that a while back to a small to medium-sized business, and it ended up being uh losing donations of around$180,000.
00:05:48.399 --> 00:05:56.240
That's just a small instant, but um that is a big focus is the donor industry list and and information.
00:05:57.839 --> 00:06:05.439
Trey, would with obviously with with privacy in mind, can you talk a little bit about that scenario?
00:06:05.600 --> 00:06:07.839
What what you may have seen or what happened?
00:06:08.000 --> 00:06:25.360
I know you're not you know in the weeds with it, but could you maybe talk to the audience a little bit about what what had happened in that instance, and just so they can get an understanding of maybe it's a little scenario of like how the hacker got in or kind of how it affected them.
00:06:25.519 --> 00:06:29.759
Could you share any details on that to kind of give an inside look to the people listening?
00:06:30.079 --> 00:06:36.079
Yeah, usually the number one and the most um popular way is phishing email, and this is how that happened.
00:06:36.240 --> 00:06:40.399
Send it to the admin, clicked on phishing email, like a trusted email.
00:06:40.639 --> 00:06:44.879
And then with AI these days, it's getting so accurate that no one can really tell.
00:06:44.959 --> 00:06:54.319
It used to be back in the day, you would see misspellings, you could see the web address is kind of kind of weird looking, but with with AI, it's getting really kind of scary out there.
00:06:54.399 --> 00:07:01.600
So it's basically coming from a basic phishing email, which that's what the way a lot of it starts and and always kind of gets the different people.
00:07:01.759 --> 00:07:07.759
It's also young, it's also younger people or newer people in uh organizations just kind of click on everything because they're not familiar with it.
00:07:07.920 --> 00:07:09.920
That's another target as well.
00:07:10.240 --> 00:07:13.199
Oh, that's a that's a great note.
00:07:13.439 --> 00:07:16.240
It it makes me think, and not all places do it, but some do.
00:07:16.319 --> 00:07:17.920
They have bios, right?
00:07:18.079 --> 00:07:19.519
On their website.
00:07:19.920 --> 00:07:32.879
I would imagine as as you talk about younger individuals slash people who are newer to the organization, whether they're young or older, age doesn't matter.
00:07:34.240 --> 00:07:48.959
From what you're saying, it makes me think in those bios, maybe they shouldn't mention some specific information because if they're putting in there so-and-so joined us the equivalent of six months, right?
00:07:49.040 --> 00:08:01.120
Or maybe even a year, that could be providing information for a hacker that that person could be a good target for them to reach out to.
00:08:01.279 --> 00:08:03.920
I know that's off the cuff, but that's just kind of what I'm thinking.
00:08:04.079 --> 00:08:05.439
Do you have any thoughts on that?
00:08:05.759 --> 00:08:07.519
Yes, that's actually a really good point.
00:08:07.680 --> 00:08:14.639
They don't have maybe have all the systems and tools and databases and logins all quite familiar with, and they could be an easy target.
00:08:14.720 --> 00:08:15.920
And that's uh that's a good point.
00:08:16.000 --> 00:08:18.240
You could put in, you know, chat GPT or Claude.
00:08:18.319 --> 00:08:26.240
Hey, or who are some of the normal normal or newer type employees at these different roles, nonprofits, and you could kind of target on that.
00:08:26.319 --> 00:08:30.000
That's actually you know kind of scary, but that is that's a good that's a good point for sure.
00:08:30.319 --> 00:08:32.399
Yeah, I promise I don't do this on the daily.
00:08:32.559 --> 00:08:36.240
Okay, uh, you're thinking of that.
00:08:36.399 --> 00:08:42.559
Yeah, I I have I have been in higher ed for over a decade and I have taken many trainings.
00:08:42.639 --> 00:08:46.559
And actually, could you just give us a little tip?
00:08:46.960 --> 00:08:49.279
Obviously, I know what phishing is.
00:08:49.519 --> 00:08:52.240
Could you tell people like what is phishing?
00:08:52.320 --> 00:08:56.000
What should they be looking for in terms of not to click on things?
00:08:56.240 --> 00:08:57.919
Like your view of it.
00:08:58.720 --> 00:09:03.120
Yeah, uh definitely, for example, a popular lance because everybody has this like Amazon, right?
00:09:03.200 --> 00:09:08.399
So it might be, hey, this is our refund or receipt or something from Amazon.
00:09:08.639 --> 00:09:13.600
Another one is for talking about back to newer employees, is that even happened with me?
00:09:13.679 --> 00:09:27.440
And I had to ask my manager at telling me, I got like a text message or an email from the CEO and mentioned his name and goes, Hey Trey, can you pick up these gift cards, for example, or or mail these out or email these out for me, or can you go and do this favor for me?
00:09:27.679 --> 00:09:32.799
First off, it's it was from uh like a non-North Carolina number, so it was a little weird, but you didn't know because I was new, right?
00:09:32.879 --> 00:09:33.919
So I was being targeted.
00:09:34.159 --> 00:09:39.200
So just fit phishing emails, maybe getting asked out of the ordinary by someone.
00:09:39.519 --> 00:09:42.080
Um, another popular one is like deep fakes.
00:09:42.399 --> 00:09:53.440
So you know, there was uh deep fakes where someone from the organization might sound like they're in higher leadership or in that, and do uh do a video call or say, Hey, I want to connect with you about something.
00:09:53.679 --> 00:09:55.360
That's another one that's uh really scary.
00:09:55.440 --> 00:10:21.200
There's been a lot of like ransomware and everything from deepfake of actually, I think it happened in Japan where they came in and it was all people like this, and we thought we were talking to each other and they were asking for money, and they thought it was real, and they ended up doing transferring over um the money and everything, and um kind of scary that's out there, but they I think it ended up being like over 500 grand or something, which is crazy.
00:10:21.519 --> 00:10:40.720
Wow, it you know, when you think of the people who are probably the most susceptible, I would say are volunteers and board members because they are not going through the normal trainings that a team would be going through.
00:10:41.039 --> 00:10:43.519
So that makes me think maybe they should be.
00:10:43.759 --> 00:10:59.120
Can you talk a little bit about how to view volunteers, board members, and kind of the insider risk of those people maybe being around your organization, but not necessarily getting the training like someone else would get who's in the organization?
00:11:00.720 --> 00:11:01.279
Yeah, definitely.
00:11:01.440 --> 00:11:22.080
They're more maybe kind of more part-time or just kind of jump in and help when they can, but definitely them having also they probably use their own personal email, Gmail, Yahoo, and don't have the certain training, and they're an easy target because maybe they don't think they're being targeted, they're not using some of the basic tools like MFA.
00:11:22.480 --> 00:11:40.240
So just be in that kind of part-time and and volunteering and not training on the different cyber um tips and tricks and everything, that's that can be a focus or an easy target because they're not in the day-to-day systems and and everything with the nonprofit that kind of just kind of coming in as needed.
00:11:40.720 --> 00:11:43.440
Yeah, that's a that's a great point, Trey.
00:11:43.519 --> 00:12:00.240
And I don't I think that the lines get blurred sometimes for nonprofits, especially smaller ones, where you know, I I I'm imagining like quite small ones have you know their nonprofit name in gmail.com, right?
00:12:00.399 --> 00:12:04.559
So it's not they don't have an actual domain for their work.
00:12:05.200 --> 00:12:10.480
So they're doing emails like that, or they're using their personal email, right?
00:12:10.559 --> 00:12:23.279
And that's one of the biggest faux pas in in the work that I've been in in in higher education with security, is that you shouldn't be sending emails from your personal email.
00:12:23.840 --> 00:12:32.240
And I just want to get uh you know, your thoughts from your experience uh like how detrimental could that be?
00:12:32.480 --> 00:12:41.759
Someone using their personal email and blurring those lines, especially because they're receiving way more at their personal email than they would be at their work email.
00:12:41.919 --> 00:12:42.480
I would assume.
00:12:42.559 --> 00:12:43.840
Do you have any thoughts on that?
00:12:44.720 --> 00:12:56.799
If fundraising is your job, this show is your edge, the Executive Thought Partner Podcast delivers real strategy, real decisions, real conversations and results.
00:12:57.120 --> 00:13:00.080
That sweet spot where theory meets the real world.
00:13:00.559 --> 00:13:13.840
Practical insights you can use before your next campaign or conversation, hosted by fundraising experts like myself and my guests, backed by the team at Donorbox.
00:13:14.639 --> 00:13:19.840
Subscribe wherever you listen for the Executive Thought Partner podcast.
00:13:20.080 --> 00:13:21.840
You'll thank yourself later.
00:13:22.240 --> 00:13:24.000
Yeah, definitely with personal emails.
00:13:24.159 --> 00:13:31.679
First off, you can be exposed yourself with all your login information, contact information, banking information, so that can be exposed.
00:13:31.840 --> 00:13:46.240
And then also when you use Gmail, Yahoo, or some of the other personal the tools that they have for cybersecurity breaches or anything, they're really MFA is very, very basic, and that can be hacked or breached at any time.
00:13:46.320 --> 00:13:55.200
So just using that Gmail, like Yahoo is not anything compared to, you know, an Outlook or another type email.
00:13:55.360 --> 00:13:58.320
So you're you're being exposed using the personal email.
00:13:58.960 --> 00:14:00.960
You know, Trey, that's scary, right?
00:14:01.039 --> 00:14:03.840
And I know your job is always like I don't want to make it scary, right?
00:14:04.240 --> 00:14:08.960
I don't want to scare people, but but there are a lot of people who can do bad things.
00:14:09.120 --> 00:14:18.960
And something that I'm thinking about that I hear occasionally, probably one of the lesser topics they've talked about in cyber training, is password managers, right?
00:14:19.039 --> 00:14:20.080
How to hold your information.
00:14:20.240 --> 00:14:21.519
Can you talk a little bit about that?
00:14:21.679 --> 00:14:25.519
Like what you know, are there browsers that you recommend?
00:14:25.679 --> 00:14:27.600
Like, where should people keep their passwords?
00:14:27.679 --> 00:14:31.519
Not on a sticky note on the top of their desk if anyone goes in their office.
00:14:31.600 --> 00:14:33.919
But can you can you talk to that a little bit?
00:14:34.240 --> 00:14:36.399
Yeah, definitely a password portal.
00:14:36.480 --> 00:14:46.799
If anything, even the personal own that it keeps everything in there and it keeps that layer of defense, plus it does keep that password because everybody's always creating passwords, right?
00:14:46.960 --> 00:14:47.759
They can be annoying.
00:14:47.840 --> 00:14:54.879
And then what a lot of people do just because they get kind of lazy is they're just kind of create the same password just and they can remember it, and that's a target.
00:14:55.039 --> 00:15:02.159
And if a bad actor uh gets to that, then they're gonna log in and get all your logins and everything if you use the same one.
00:15:02.240 --> 00:15:11.759
So I know it's annoying, but if you can at least have a unique password that you can save to the password portal, for example, that would be ideal.
00:15:12.000 --> 00:15:18.879
And then make it as long as you can and try to put you know exclamation for or special character with capital letters.
00:15:19.039 --> 00:15:21.919
Don't and don't have really anything generalized.
00:15:22.000 --> 00:15:28.080
So don't do you know, Daniel Freeman and maybe your year you're born or something very one, two, three, very basic.
00:15:28.399 --> 00:15:33.039
Have maybe something only you would know, only you would know that they couldn't know, just some very basics.
00:15:33.120 --> 00:15:45.200
I know it's annoying because there's a hundred emails, logins for each person with all the accounts and apps and everything, but to be safe, it'd be good to have some unique and unique ones with a password portal would help.
00:15:45.519 --> 00:15:52.879
So so what you're saying, Trey, is we have to fight the urge of being consistent.
00:15:53.039 --> 00:16:06.480
We need to be inconsistent with our passwords, they all need to be totally different, and we need to be totally out there with things that are disconnected from us completely, right?
00:16:06.559 --> 00:16:13.679
Because the goal when you're making those passwords, like you said, special characters and the breaks and the differences in them, right?
00:16:13.840 --> 00:16:15.600
Like has to be random.
00:16:15.840 --> 00:16:21.840
Like I know you know, Google, Google suggests strong passwords, right?
00:16:21.919 --> 00:16:26.000
When you save a password in there now, and those things are just random as all get up.
00:16:26.080 --> 00:16:29.360
Like you gotta say, you have to save that for yourself.
00:16:30.480 --> 00:16:45.519
So you know, nonprofits think that they're small, but they're not really thinking about the deeper issue of of how many users they have, how many people are in their database, and how attractive that is for a potential hacker.
00:16:46.159 --> 00:16:52.240
They people need to be looking at the donor data because there's a trust that comes with it.
00:16:52.399 --> 00:16:57.759
I remember we used to talk about when I was in Collegiate Athletics, they were like, you don't write down the credit card number.
00:16:57.919 --> 00:17:04.480
Like they had sheets, and it was like, okay, you write down all this information, but you have to shred it afterwards if you're gonna do that, right?
00:17:04.559 --> 00:17:12.240
And it shouldn't be in general, you should just put it on the website, like done it on the website while you're on the phone with them instead of writing it down.
00:17:12.720 --> 00:17:17.839
And then, you know, we talked about how volunteers and board members are the weak point.
00:17:18.319 --> 00:17:18.559
Right.
00:17:18.880 --> 00:17:26.000
I mean, if you really think about it, they're using personal emails, they're not there, or or even part-time, right?
00:17:26.079 --> 00:17:38.079
There are people that haven't been through these trainings, people that aren't part of them, people that aren't even considered to be part of these trainings, they're that weak link that could really hurt you.
00:17:38.400 --> 00:17:41.359
So I want to ask you though.
00:17:41.680 --> 00:17:44.880
I've been through this experience with an organization.
00:17:45.279 --> 00:17:48.079
Cyber insurance, what does it cover?
00:17:48.640 --> 00:17:50.160
What does it not cover?
00:17:50.400 --> 00:17:55.440
Can you just give us some real in-depth about what that looks like and why people should have it?
00:17:56.960 --> 00:18:02.559
Yeah, so cyber insurance is very like baseline, as I mentioned, and it's very it's very nuanced.
00:18:02.640 --> 00:18:10.160
I believe it might have been like right after COVID or even the last four or five years, it's gotten to the it was very popular at first, and everybody rushed to it, and it was very expensive.
00:18:10.319 --> 00:18:14.799
But now it's kind of went in more uh downstream, as they call it.
00:18:14.880 --> 00:18:19.200
Like it's almost been getting to the point of like auto insurance, but in a good way.
00:18:19.519 --> 00:18:32.000
But you want to at least have some type of uh policy if you're a small and medium-sized business, in case there's a ransomware, because even when there's a ransomware, some of the statistics you only get maybe 50% of it back, which still helps.
00:18:32.640 --> 00:18:43.839
But back to it is just is is very important to get that and maybe even get an IT provider, like an MSP like myself, for example, to at least do a review each year of the security controls.
00:18:44.160 --> 00:19:03.039
And then I I believe even from what I've heard, if you do have at least an IT support company, it helps with um uh helps with the coverage, which is uh which is a good thing, because you have all those security cool tools already implemented, so that can help with the uh different coverage and everything for the cyber insurance.
00:19:04.079 --> 00:19:07.519
Yeah, you know, it's funny, it sounds like car insurance, which you mentioned, right?
00:19:07.680 --> 00:19:13.440
Because if you have the safety features in your car, your car insurance is less, right?
00:19:13.519 --> 00:19:17.119
And there are certain things that can change and make your car insurance more affordable.
00:19:17.279 --> 00:19:30.960
And to your point, it sounds like having the back-end support makes it even cheaper because they know that you're doing your due diligence and you have kind of safety lines in place already.
00:19:32.559 --> 00:19:35.279
Can you uh can you talk about?
00:19:35.440 --> 00:19:45.759
I know you talked a little bit about for that cyber insurance, but like what what scenarios would nonprofits or organizations need that cyber insurance for?
00:19:45.839 --> 00:19:50.640
I know I know you talked specifically about kind of the phishing attacks.
00:19:50.960 --> 00:19:53.039
Do they help with trainings?
00:19:53.279 --> 00:19:55.680
Do they help with getting the MFA set up?
00:19:55.839 --> 00:19:59.200
Like what kinds of things can that insurance help with?
00:19:59.359 --> 00:20:15.440
Or let's go a little deeper, not just the insurance, which keeps you safe, but like if they were to work with AtNat, like what kinds of things could you help them with, or could your team help them with to make sure that they've got everything inline and streamlined?
00:20:16.480 --> 00:20:18.960
Yeah, definitely the MFA is the first thing we mentioned.
00:20:19.039 --> 00:20:21.680
That usually helps on like over 90% of it.
00:20:21.839 --> 00:20:26.720
Also having an endpoint detection or response plan.
00:20:27.279 --> 00:20:32.319
Also, we help with regular backups and employee security training.
00:20:32.559 --> 00:20:37.440
Like, for example, we send that out each uh each week, and I'm a part of it too.
00:20:37.519 --> 00:20:48.640
You get micro trainings, so let's just say it's a two to three minute video and it's used like an act it out scenario, but it gives you tips and tricks, and you get like four four questions, it's usually like three, three to five minutes.
00:20:48.799 --> 00:20:53.440
So that helps with different training and scenarios of a phishing email or a cyber threat.
00:20:53.680 --> 00:21:04.960
And then also checking your your policy where if you have a policy of let's say$250,000, sounds like a lot, but if you get hit with a ransom where$500,000, it's not really covered.
00:21:05.039 --> 00:21:11.759
So it's good to have a IT or MSP like my like myself who I work for to do a renewal of it.
00:21:11.920 --> 00:21:13.599
So that's another one that really helps out.
00:21:14.640 --> 00:21:17.279
Yeah, that's a that's a really great point.
00:21:17.440 --> 00:21:26.000
And you know, I mean, I've had to do some long trainings, and I I love the fact you talked about kind of like weekly.
00:21:26.640 --> 00:21:40.079
I mean, the goal is with people who have never really used uh security training, uh for them to go sit there for three hours or two hours, even one hour is just not digestible.
00:21:40.640 --> 00:21:52.079
But in a way, uh getting a weekly email that takes three to five minutes and just keeps you fresh, but doesn't make you lose a part of your day, I love that.
00:21:52.960 --> 00:21:55.680
I love that I love that your group does that.
00:21:56.000 --> 00:22:01.359
Now I think the last thing I'm curious about is Let's be honest, right?
00:22:01.440 --> 00:22:04.559
Some some nonprofits are going to look at this and be like, no one wants my information.
00:22:04.720 --> 00:22:06.319
I still don't believe you.
00:22:06.960 --> 00:22:10.079
And we we know that's not true, right?
00:22:10.240 --> 00:22:11.920
People people take anything.
00:22:12.079 --> 00:22:13.599
But I'm I'm curious.
00:22:13.839 --> 00:22:16.480
Tell me about cybersecurity on a shoestring.
00:22:16.880 --> 00:22:20.799
Like what you know, what free and low-cost tools are there that actually work?
00:22:20.960 --> 00:22:27.039
Like, can you walk through maybe a few of the a few of the tools that everyone should be using?
00:22:28.160 --> 00:22:29.279
Yeah, definitely for sure.
00:22:29.359 --> 00:22:34.480
So Microsoft 365, for example, and nonprofits, they're always really good on giving discounts.
00:22:34.559 --> 00:22:40.160
If you qualify for as a 501c3, you'll get a deeply discount.
00:22:40.400 --> 00:22:47.279
Also, this this will include like enterprise email security, like MFA and device management.
00:22:47.839 --> 00:22:58.720
Also, CISA Cybersecurity and Infrastructure Security Agency offers free scanning and other phishing simulation tools to nonprofits at no cost.
00:22:58.880 --> 00:23:03.519
You can also get Cloud Fair for Teams, which is kind of a free tier.
00:23:03.680 --> 00:23:06.400
So some of those are just some of the some of those as well.
00:23:06.559 --> 00:23:14.240
And also Google workspace, even though it mentions the target, that can be a free Google workspace for for that as well, to at least have that.
00:23:14.319 --> 00:23:18.319
And there's also um business Google workspace as well.
00:23:18.559 --> 00:23:23.039
So there's a lot of uh benefits to nonprofits at discounted rates.
00:23:23.200 --> 00:23:27.680
I know it's it's all about money at the end of the day, so that that could be some things for some different nonprofits.
00:23:28.000 --> 00:23:28.960
That's great.
00:23:29.200 --> 00:23:46.400
You know, Trey, I before we before we finish up, I would love if you could send me a link that I can put on this podcast description for people to look at that kind of show the things that you offer through AtNet so they get a better idea.
00:23:46.720 --> 00:23:49.039
Because I think what what you offer, right?
00:23:49.119 --> 00:23:52.480
Uh whatever it is on the baseline, people should really be considering that.
00:23:52.640 --> 00:23:54.559
Similar to business insurance, right?
00:23:54.720 --> 00:24:07.440
You hope you never have to use business insurance, you hope you never have to use cyber insurance, but for the amount that it usually costs, it is worth it.
00:24:08.079 --> 00:24:15.920
But then also to have someone dedicated to you for all of the cyber needs, not cybersecurity necessarily.
00:24:16.079 --> 00:24:32.640
I mean, but all that back-end work is is really helpful to make things streamlined in and in space, especially for the trainings and the updates and the information and things that I believe that nonprofits should really be diving into the fractional side.
00:24:32.880 --> 00:24:36.799
I would I would consider you know your team's work kind of fractional IT, right?
00:24:36.880 --> 00:24:38.720
Because you're not working inside, right?
00:24:38.880 --> 00:24:42.319
Fractional IT, fractional fundraising, fractional marketing.
00:24:42.720 --> 00:24:50.000
Maybe you have one person doing that role internally as well that's working boots on the ground, but they're not strategizing.
00:24:50.160 --> 00:24:52.960
I think there are just so many benefits to that.
00:24:53.519 --> 00:25:05.519
Now, Trey, before you before we we finish off this podcast, is there anything else you share you're thinking you would share with us for nonprofits or organizations to know about?
00:25:05.680 --> 00:25:29.279
If there's one, I call it one hot take that you have in the cybersecurity world, something you're thinking about, something that's common right now that people aren't thinking about till it comes to them, what what is that hot take that you'd share with people to make them think a little bit more about why they should be investing in this and why it's so necessary for them to be on top of this work?
00:25:30.400 --> 00:25:31.680
Yeah, I'm gonna go back to it.
00:25:31.759 --> 00:25:41.200
My manager always uh mentioned it and he he always makes this a great stat that small business is compromised every 31 seconds in the US.
00:25:41.680 --> 00:25:46.079
Which so at least have the basics MFA.
00:25:47.039 --> 00:26:00.559
If you can't have cybersecurity, also just be on the really read your emails if it's more internal, being a nonprofit, phishing emails, so just be real diligent on that.
00:26:00.640 --> 00:26:07.440
So it's a MFA, if you can do cybersecurity, and just read your emails closely before doing anything, yeah.
00:26:07.680 --> 00:26:12.720
Because it can it's not uh if it's gonna happen, but when is what we like to tell.
00:26:12.799 --> 00:26:16.319
But at least have these certain cybersecurity tools set up.
00:26:16.640 --> 00:26:18.000
That's that's really great.
00:26:18.319 --> 00:26:24.720
Like we said, point of this is not to scare people, it's just to make them aware because we've seen it happen.
00:26:25.039 --> 00:26:26.720
It does happen.
00:26:27.039 --> 00:26:47.279
And when you are dealing with so many other people, not just the database, but people you're trying to serve, the populations you're trying to serve through your mission, but also the people you're trying to serve who are supporting your mission, you've got to do everything possible to keep both of them safe and their information safe.
00:26:47.519 --> 00:26:52.559
So, Trey, I really appreciate you coming on to the Executive Thought Podcast.
00:26:52.960 --> 00:26:59.119
I'll include your LinkedIn and any link you share with me for AtNet, I'll put that in the podcast description.
00:26:59.359 --> 00:27:06.640
This was really important to me because, as I've told you more times than I should, I think cybersecurity is huge for nonprofits.
00:27:06.720 --> 00:27:16.720
And I've just seen bad things happen when people don't think about this net as part of the work that they're doing, this safety net.
00:27:16.880 --> 00:27:18.720
So thank you for coming on today.
00:27:18.880 --> 00:27:19.680
We appreciate it.
00:27:19.839 --> 00:27:25.359
We'll put that information in there and looking forward to having this podcast come out.
00:27:25.759 --> 00:27:27.920
Yeah, appreciate you having me on again, Daniel.
00:27:28.079 --> 00:27:29.200
Look forward to it.
00:27:29.839 --> 00:27:33.759
Thank you for listening to the Executive Thought Partner Podcast.
00:27:33.920 --> 00:27:41.839
If today's conversation helped clarify your leadership or expand your thinking, share it with someone navigating meaningful decisions.
00:27:42.000 --> 00:27:46.319
Until next time, think clearly, lead intentionally, and build what lasts.
00:00:00.800 --> 00:00:06.559
Welcome to the Executive Thought Partner Podcast, where leadership, strategy, and growth intersect.
00:00:06.799 --> 00:00:07.360
I'm Dr.
00:00:07.440 --> 00:00:09.519
Daniel Freeman, Executive Thought Partner.
00:00:09.759 --> 00:00:12.000
This isn't just a podcast about fundraising.
00:00:12.160 --> 00:00:21.920
It's about how leaders think, decide, and build systems that scale impact across nonprofits, higher education, athletics, and mission-driven enterprises.
00:00:22.320 --> 00:00:28.719
Here we explore major gifts, governance, culture, and the quiet decisions that determine long-term momentum.
00:00:29.039 --> 00:00:35.039
If you're leading something that matters and you want clarity with conviction, you're in the right place.
00:00:35.200 --> 00:00:36.479
Let's get into it.
00:00:36.880 --> 00:00:39.600
Welcome to the Executive Thought Partner Podcast.
00:00:39.679 --> 00:00:40.640
I'm your host, Dr.
00:00:40.719 --> 00:00:41.679
Dan Freeman.
00:00:42.079 --> 00:00:44.159
Today we have Trey Tucker.
00:00:44.320 --> 00:00:50.560
We are going to be speaking about security for your nonprofit, for your organization.
00:00:51.039 --> 00:00:58.640
And Trey's going to hit on some really important pieces because I believe people are not thinking about it until it happens to them.
00:00:58.719 --> 00:01:00.560
And those are words right out of Trey's mouth.
00:01:00.640 --> 00:01:05.599
So I'm going to pass it to Trey to talk a little bit about himself, and then we're going to jump right in.
00:01:06.239 --> 00:01:08.640
Hey Daniel, Trey Tucker with AtNet.
00:01:08.879 --> 00:01:12.000
Appreciate again you having me on the uh the podcast.
00:01:12.319 --> 00:01:16.000
Yeah, we're going to talk about uh cybersecurity day and some of the topics that we're going to come up.
00:01:16.079 --> 00:01:18.000
And I feel like it's kind of undervalued.
00:01:18.159 --> 00:01:28.640
Everybody's always like, or companies are always like, yeah, we're we're okay until you you get a cyber breach or ransomware, and then it gets really personal and there can be some issues.
00:01:28.719 --> 00:01:39.280
So it's always good to have these different topics we're going to discuss out there and some uh tips and tricks and some security tools to uh protect yourself against the uh bad bad actors out there.
00:01:39.599 --> 00:01:40.319
Thanks, Trey.
00:01:40.480 --> 00:01:46.000
Trey, can you tell us a little bit about your background, how you got into cybersecurity and how long you've been there?
00:01:47.200 --> 00:01:48.000
Yeah, appreciate that.
00:01:48.079 --> 00:01:57.920
Yeah, I've been with um at net since around December 2024 and got into IT support and cybersecurity actually from Lake Norman and Charlotte IT.
00:01:58.000 --> 00:02:07.760
I know you network a whole lot and I do, so very loyal to that group and got that from another colleague that uh passed my name along and always wanted to get in IT and cybersecurity.
00:02:07.920 --> 00:02:09.599
So the power of networking.
00:02:09.919 --> 00:02:11.039
Yeah, that's great.
00:02:11.120 --> 00:02:13.120
Well, let's let's jump right in, Trey.
00:02:13.280 --> 00:02:20.960
So something that you had mentioned just now, and and I want you to, I can't wait for you to talk about this.
00:02:21.199 --> 00:02:25.360
Why are nonprofits a hacker's favorite target?
00:02:27.360 --> 00:02:32.879
Yeah, definitely they think they're a lot smaller than they are, but it's like uh a nonprofit.
00:02:33.199 --> 00:02:42.479
But the note is you don't have to be the biggest to be targeted because they don't care the uh hackers or the cybersecurity bad actor.
00:02:42.800 --> 00:02:50.000
They're all about getting your contact information, your banking information, donor information, and you're being a focus.
00:02:50.319 --> 00:03:02.719
So I think they have their guard down just like hey, we're just uh you know a smaller nonprofit, but they should they should have their guard up even more, having the different tools of cybersecurity, cyber insurance, MFA, some of the other tools that we'll we'll mention.
00:03:02.800 --> 00:03:10.159
So I believe that's why they're a target because they think they're too small and and not a focus, but that's uh not the case at all.
00:03:10.560 --> 00:03:16.719
You know, Trey, I was I was talking to someone today, and we're talking about the term users.
00:03:17.360 --> 00:03:25.360
And I always thought that organizations like yourself, businesses, focused on revenue.
00:03:25.919 --> 00:03:35.360
But what I what I started to connect, especially for our conversation today, was it's the amount of people and information that runs through the networks, right?
00:03:35.520 --> 00:03:38.479
So it could be a small nonprofit, right?
00:03:38.560 --> 00:03:55.599
They could have three to five people, but if you have a CRM with people's banking information, with their personal information, and you have hundreds of people that are in that or thousands or more, that becomes a lot more valuable to a bad actor.
00:03:55.759 --> 00:03:56.639
Is that right?
00:03:56.879 --> 00:03:58.159
That's correct.
00:03:58.479 --> 00:04:09.520
And another one with the bad actors, a lot of people don't realize that they have sales teams as well, they have sales quotas, they have managers that set up like a system, which is pretty scary.
00:04:09.680 --> 00:04:12.479
So they're they're out there to close their deals any way they can.
00:04:12.639 --> 00:04:14.960
So it's uh it's big business out there.
00:04:15.039 --> 00:04:17.519
It's it's bad and and scary, but it is business.
00:04:17.839 --> 00:04:20.480
Big business for small business, but not in a good way.
00:04:20.800 --> 00:04:21.680
That's right.
00:04:22.480 --> 00:04:33.600
So, you know, you you talked about kind of it sounds like nonprofits are hackers' favorite targets because nonprofits think they're small enough that they're not targets, right?
00:04:33.759 --> 00:04:37.199
So they're they're not thinking outside of themselves.
00:04:37.600 --> 00:04:42.959
So one of the next things that I always think about is you mentioned MFAs, right?
00:04:43.120 --> 00:04:44.959
Multi-factor authentication.
00:04:45.199 --> 00:04:49.680
I've had to do that so many times, the places that I've worked at, right?
00:04:50.240 --> 00:04:58.800
And you always talk about protecting donor data is so paramount because there's a trust that comes with how well you do that.
00:05:00.879 --> 00:05:01.839
Yeah, exactly.
00:05:02.000 --> 00:05:10.000
It's uh, you know, there's a donor data list, for example, there's names, addresses, given history, credit reports.
00:05:10.319 --> 00:05:18.399
So I know that can be very like frustrating with MFA, and for example, you have to do dual mobile, is what we use, or you got to click on that.
00:05:18.480 --> 00:05:24.319
It's it's annoying, it can be, but it definitely cuts out a whole lot of that, different layers of security to get to that.
00:05:24.399 --> 00:05:26.720
So I think that's at least some of the basic levels.
00:05:26.959 --> 00:05:39.519
But during answer question, there's a lot of mid-sized nonprofits, for example, might be a CRM, and there's 8,000 donor records, and there might be a breach, for example.
00:05:39.759 --> 00:05:47.759
And there was one that was uh like that a while back to a small to medium-sized business, and it ended up being uh losing donations of around$180,000.
00:05:48.399 --> 00:05:56.240
That's just a small instant, but um that is a big focus is the donor industry list and and information.
00:05:57.839 --> 00:06:05.439
Trey, would with obviously with with privacy in mind, can you talk a little bit about that scenario?
00:06:05.600 --> 00:06:07.839
What what you may have seen or what happened?
00:06:08.000 --> 00:06:25.360
I know you're not you know in the weeds with it, but could you maybe talk to the audience a little bit about what what had happened in that instance, and just so they can get an understanding of maybe it's a little scenario of like how the hacker got in or kind of how it affected them.
00:06:25.519 --> 00:06:29.759
Could you share any details on that to kind of give an inside look to the people listening?
00:06:30.079 --> 00:06:36.079
Yeah, usually the number one and the most um popular way is phishing email, and this is how that happened.
00:06:36.240 --> 00:06:40.399
Send it to the admin, clicked on phishing email, like a trusted email.
00:06:40.639 --> 00:06:44.879
And then with AI these days, it's getting so accurate that no one can really tell.
00:06:44.959 --> 00:06:54.319
It used to be back in the day, you would see misspellings, you could see the web address is kind of kind of weird looking, but with with AI, it's getting really kind of scary out there.
00:06:54.399 --> 00:07:01.600
So it's basically coming from a basic phishing email, which that's what the way a lot of it starts and and always kind of gets the different people.
00:07:01.759 --> 00:07:07.759
It's also young, it's also younger people or newer people in uh organizations just kind of click on everything because they're not familiar with it.
00:07:07.920 --> 00:07:09.920
That's another target as well.
00:07:10.240 --> 00:07:13.199
Oh, that's a that's a great note.
00:07:13.439 --> 00:07:16.240
It it makes me think, and not all places do it, but some do.
00:07:16.319 --> 00:07:17.920
They have bios, right?
00:07:18.079 --> 00:07:19.519
On their website.
00:07:19.920 --> 00:07:32.879
I would imagine as as you talk about younger individuals slash people who are newer to the organization, whether they're young or older, age doesn't matter.
00:07:34.240 --> 00:07:48.959
From what you're saying, it makes me think in those bios, maybe they shouldn't mention some specific information because if they're putting in there so-and-so joined us the equivalent of six months, right?
00:07:49.040 --> 00:08:01.120
Or maybe even a year, that could be providing information for a hacker that that person could be a good target for them to reach out to.
00:08:01.279 --> 00:08:03.920
I know that's off the cuff, but that's just kind of what I'm thinking.
00:08:04.079 --> 00:08:05.439
Do you have any thoughts on that?
00:08:05.759 --> 00:08:07.519
Yes, that's actually a really good point.
00:08:07.680 --> 00:08:14.639
They don't have maybe have all the systems and tools and databases and logins all quite familiar with, and they could be an easy target.
00:08:14.720 --> 00:08:15.920
And that's uh that's a good point.
00:08:16.000 --> 00:08:18.240
You could put in, you know, chat GPT or Claude.
00:08:18.319 --> 00:08:26.240
Hey, or who are some of the normal normal or newer type employees at these different roles, nonprofits, and you could kind of target on that.
00:08:26.319 --> 00:08:30.000
That's actually you know kind of scary, but that is that's a good that's a good point for sure.
00:08:30.319 --> 00:08:32.399
Yeah, I promise I don't do this on the daily.
00:08:32.559 --> 00:08:36.240
Okay, uh, you're thinking of that.
00:08:36.399 --> 00:08:42.559
Yeah, I I have I have been in higher ed for over a decade and I have taken many trainings.
00:08:42.639 --> 00:08:46.559
And actually, could you just give us a little tip?
00:08:46.960 --> 00:08:49.279
Obviously, I know what phishing is.
00:08:49.519 --> 00:08:52.240
Could you tell people like what is phishing?
00:08:52.320 --> 00:08:56.000
What should they be looking for in terms of not to click on things?
00:08:56.240 --> 00:08:57.919
Like your view of it.
00:08:58.720 --> 00:09:03.120
Yeah, uh definitely, for example, a popular lance because everybody has this like Amazon, right?
00:09:03.200 --> 00:09:08.399
So it might be, hey, this is our refund or receipt or something from Amazon.
00:09:08.639 --> 00:09:13.600
Another one is for talking about back to newer employees, is that even happened with me?
00:09:13.679 --> 00:09:27.440
And I had to ask my manager at telling me, I got like a text message or an email from the CEO and mentioned his name and goes, Hey Trey, can you pick up these gift cards, for example, or or mail these out or email these out for me, or can you go and do this favor for me?
00:09:27.679 --> 00:09:32.799
First off, it's it was from uh like a non-North Carolina number, so it was a little weird, but you didn't know because I was new, right?
00:09:32.879 --> 00:09:33.919
So I was being targeted.
00:09:34.159 --> 00:09:39.200
So just fit phishing emails, maybe getting asked out of the ordinary by someone.
00:09:39.519 --> 00:09:42.080
Um, another popular one is like deep fakes.
00:09:42.399 --> 00:09:53.440
So you know, there was uh deep fakes where someone from the organization might sound like they're in higher leadership or in that, and do uh do a video call or say, Hey, I want to connect with you about something.
00:09:53.679 --> 00:09:55.360
That's another one that's uh really scary.
00:09:55.440 --> 00:10:21.200
There's been a lot of like ransomware and everything from deepfake of actually, I think it happened in Japan where they came in and it was all people like this, and we thought we were talking to each other and they were asking for money, and they thought it was real, and they ended up doing transferring over um the money and everything, and um kind of scary that's out there, but they I think it ended up being like over 500 grand or something, which is crazy.
00:10:21.519 --> 00:10:40.720
Wow, it you know, when you think of the people who are probably the most susceptible, I would say are volunteers and board members because they are not going through the normal trainings that a team would be going through.
00:10:41.039 --> 00:10:43.519
So that makes me think maybe they should be.
00:10:43.759 --> 00:10:59.120
Can you talk a little bit about how to view volunteers, board members, and kind of the insider risk of those people maybe being around your organization, but not necessarily getting the training like someone else would get who's in the organization?
00:11:00.720 --> 00:11:01.279
Yeah, definitely.
00:11:01.440 --> 00:11:22.080
They're more maybe kind of more part-time or just kind of jump in and help when they can, but definitely them having also they probably use their own personal email, Gmail, Yahoo, and don't have the certain training, and they're an easy target because maybe they don't think they're being targeted, they're not using some of the basic tools like MFA.
00:11:22.480 --> 00:11:40.240
So just be in that kind of part-time and and volunteering and not training on the different cyber um tips and tricks and everything, that's that can be a focus or an easy target because they're not in the day-to-day systems and and everything with the nonprofit that kind of just kind of coming in as needed.
00:11:40.720 --> 00:11:43.440
Yeah, that's a that's a great point, Trey.
00:11:43.519 --> 00:12:00.240
And I don't I think that the lines get blurred sometimes for nonprofits, especially smaller ones, where you know, I I I'm imagining like quite small ones have you know their nonprofit name in gmail.com, right?
00:12:00.399 --> 00:12:04.559
So it's not they don't have an actual domain for their work.
00:12:05.200 --> 00:12:10.480
So they're doing emails like that, or they're using their personal email, right?
00:12:10.559 --> 00:12:23.279
And that's one of the biggest faux pas in in the work that I've been in in in higher education with security, is that you shouldn't be sending emails from your personal email.
00:12:23.840 --> 00:12:32.240
And I just want to get uh you know, your thoughts from your experience uh like how detrimental could that be?
00:12:32.480 --> 00:12:41.759
Someone using their personal email and blurring those lines, especially because they're receiving way more at their personal email than they would be at their work email.
00:12:41.919 --> 00:12:42.480
I would assume.
00:12:42.559 --> 00:12:43.840
Do you have any thoughts on that?
00:12:44.720 --> 00:12:56.799
If fundraising is your job, this show is your edge, the Executive Thought Partner Podcast delivers real strategy, real decisions, real conversations and results.
00:12:57.120 --> 00:13:00.080
That sweet spot where theory meets the real world.
00:13:00.559 --> 00:13:13.840
Practical insights you can use before your next campaign or conversation, hosted by fundraising experts like myself and my guests, backed by the team at Donorbox.
00:13:14.639 --> 00:13:19.840
Subscribe wherever you listen for the Executive Thought Partner podcast.
00:13:20.080 --> 00:13:21.840
You'll thank yourself later.
00:13:22.240 --> 00:13:24.000
Yeah, definitely with personal emails.
00:13:24.159 --> 00:13:31.679
First off, you can be exposed yourself with all your login information, contact information, banking information, so that can be exposed.
00:13:31.840 --> 00:13:46.240
And then also when you use Gmail, Yahoo, or some of the other personal the tools that they have for cybersecurity breaches or anything, they're really MFA is very, very basic, and that can be hacked or breached at any time.
00:13:46.320 --> 00:13:55.200
So just using that Gmail, like Yahoo is not anything compared to, you know, an Outlook or another type email.
00:13:55.360 --> 00:13:58.320
So you're you're being exposed using the personal email.
00:13:58.960 --> 00:14:00.960
You know, Trey, that's scary, right?
00:14:01.039 --> 00:14:03.840
And I know your job is always like I don't want to make it scary, right?
00:14:04.240 --> 00:14:08.960
I don't want to scare people, but but there are a lot of people who can do bad things.
00:14:09.120 --> 00:14:18.960
And something that I'm thinking about that I hear occasionally, probably one of the lesser topics they've talked about in cyber training, is password managers, right?
00:14:19.039 --> 00:14:20.080
How to hold your information.
00:14:20.240 --> 00:14:21.519
Can you talk a little bit about that?
00:14:21.679 --> 00:14:25.519
Like what you know, are there browsers that you recommend?
00:14:25.679 --> 00:14:27.600
Like, where should people keep their passwords?
00:14:27.679 --> 00:14:31.519
Not on a sticky note on the top of their desk if anyone goes in their office.
00:14:31.600 --> 00:14:33.919
But can you can you talk to that a little bit?
00:14:34.240 --> 00:14:36.399
Yeah, definitely a password portal.
00:14:36.480 --> 00:14:46.799
If anything, even the personal own that it keeps everything in there and it keeps that layer of defense, plus it does keep that password because everybody's always creating passwords, right?
00:14:46.960 --> 00:14:47.759
They can be annoying.
00:14:47.840 --> 00:14:54.879
And then what a lot of people do just because they get kind of lazy is they're just kind of create the same password just and they can remember it, and that's a target.
00:14:55.039 --> 00:15:02.159
And if a bad actor uh gets to that, then they're gonna log in and get all your logins and everything if you use the same one.
00:15:02.240 --> 00:15:11.759
So I know it's annoying, but if you can at least have a unique password that you can save to the password portal, for example, that would be ideal.
00:15:12.000 --> 00:15:18.879
And then make it as long as you can and try to put you know exclamation for or special character with capital letters.
00:15:19.039 --> 00:15:21.919
Don't and don't have really anything generalized.
00:15:22.000 --> 00:15:28.080
So don't do you know, Daniel Freeman and maybe your year you're born or something very one, two, three, very basic.
00:15:28.399 --> 00:15:33.039
Have maybe something only you would know, only you would know that they couldn't know, just some very basics.
00:15:33.120 --> 00:15:45.200
I know it's annoying because there's a hundred emails, logins for each person with all the accounts and apps and everything, but to be safe, it'd be good to have some unique and unique ones with a password portal would help.
00:15:45.519 --> 00:15:52.879
So so what you're saying, Trey, is we have to fight the urge of being consistent.
00:15:53.039 --> 00:16:06.480
We need to be inconsistent with our passwords, they all need to be totally different, and we need to be totally out there with things that are disconnected from us completely, right?
00:16:06.559 --> 00:16:13.679
Because the goal when you're making those passwords, like you said, special characters and the breaks and the differences in them, right?
00:16:13.840 --> 00:16:15.600
Like has to be random.
00:16:15.840 --> 00:16:21.840
Like I know you know, Google, Google suggests strong passwords, right?
00:16:21.919 --> 00:16:26.000
When you save a password in there now, and those things are just random as all get up.
00:16:26.080 --> 00:16:29.360
Like you gotta say, you have to save that for yourself.
00:16:30.480 --> 00:16:45.519
So you know, nonprofits think that they're small, but they're not really thinking about the deeper issue of of how many users they have, how many people are in their database, and how attractive that is for a potential hacker.
00:16:46.159 --> 00:16:52.240
They people need to be looking at the donor data because there's a trust that comes with it.
00:16:52.399 --> 00:16:57.759
I remember we used to talk about when I was in Collegiate Athletics, they were like, you don't write down the credit card number.
00:16:57.919 --> 00:17:04.480
Like they had sheets, and it was like, okay, you write down all this information, but you have to shred it afterwards if you're gonna do that, right?
00:17:04.559 --> 00:17:12.240
And it shouldn't be in general, you should just put it on the website, like done it on the website while you're on the phone with them instead of writing it down.
00:17:12.720 --> 00:17:17.839
And then, you know, we talked about how volunteers and board members are the weak point.
00:17:18.319 --> 00:17:18.559
Right.
00:17:18.880 --> 00:17:26.000
I mean, if you really think about it, they're using personal emails, they're not there, or or even part-time, right?
00:17:26.079 --> 00:17:38.079
There are people that haven't been through these trainings, people that aren't part of them, people that aren't even considered to be part of these trainings, they're that weak link that could really hurt you.
00:17:38.400 --> 00:17:41.359
So I want to ask you though.
00:17:41.680 --> 00:17:44.880
I've been through this experience with an organization.
00:17:45.279 --> 00:17:48.079
Cyber insurance, what does it cover?
00:17:48.640 --> 00:17:50.160
What does it not cover?
00:17:50.400 --> 00:17:55.440
Can you just give us some real in-depth about what that looks like and why people should have it?
00:17:56.960 --> 00:18:02.559
Yeah, so cyber insurance is very like baseline, as I mentioned, and it's very it's very nuanced.
00:18:02.640 --> 00:18:10.160
I believe it might have been like right after COVID or even the last four or five years, it's gotten to the it was very popular at first, and everybody rushed to it, and it was very expensive.
00:18:10.319 --> 00:18:14.799
But now it's kind of went in more uh downstream, as they call it.
00:18:14.880 --> 00:18:19.200
Like it's almost been getting to the point of like auto insurance, but in a good way.
00:18:19.519 --> 00:18:32.000
But you want to at least have some type of uh policy if you're a small and medium-sized business, in case there's a ransomware, because even when there's a ransomware, some of the statistics you only get maybe 50% of it back, which still helps.
00:18:32.640 --> 00:18:43.839
But back to it is just is is very important to get that and maybe even get an IT provider, like an MSP like myself, for example, to at least do a review each year of the security controls.
00:18:44.160 --> 00:19:03.039
And then I I believe even from what I've heard, if you do have at least an IT support company, it helps with um uh helps with the coverage, which is uh which is a good thing, because you have all those security cool tools already implemented, so that can help with the uh different coverage and everything for the cyber insurance.
00:19:04.079 --> 00:19:07.519
Yeah, you know, it's funny, it sounds like car insurance, which you mentioned, right?
00:19:07.680 --> 00:19:13.440
Because if you have the safety features in your car, your car insurance is less, right?
00:19:13.519 --> 00:19:17.119
And there are certain things that can change and make your car insurance more affordable.
00:19:17.279 --> 00:19:30.960
And to your point, it sounds like having the back-end support makes it even cheaper because they know that you're doing your due diligence and you have kind of safety lines in place already.
00:19:32.559 --> 00:19:35.279
Can you uh can you talk about?
00:19:35.440 --> 00:19:45.759
I know you talked a little bit about for that cyber insurance, but like what what scenarios would nonprofits or organizations need that cyber insurance for?
00:19:45.839 --> 00:19:50.640
I know I know you talked specifically about kind of the phishing attacks.
00:19:50.960 --> 00:19:53.039
Do they help with trainings?
00:19:53.279 --> 00:19:55.680
Do they help with getting the MFA set up?
00:19:55.839 --> 00:19:59.200
Like what kinds of things can that insurance help with?
00:19:59.359 --> 00:20:15.440
Or let's go a little deeper, not just the insurance, which keeps you safe, but like if they were to work with AtNat, like what kinds of things could you help them with, or could your team help them with to make sure that they've got everything inline and streamlined?
00:20:16.480 --> 00:20:18.960
Yeah, definitely the MFA is the first thing we mentioned.
00:20:19.039 --> 00:20:21.680
That usually helps on like over 90% of it.
00:20:21.839 --> 00:20:26.720
Also having an endpoint detection or response plan.
00:20:27.279 --> 00:20:32.319
Also, we help with regular backups and employee security training.
00:20:32.559 --> 00:20:37.440
Like, for example, we send that out each uh each week, and I'm a part of it too.
00:20:37.519 --> 00:20:48.640
You get micro trainings, so let's just say it's a two to three minute video and it's used like an act it out scenario, but it gives you tips and tricks, and you get like four four questions, it's usually like three, three to five minutes.
00:20:48.799 --> 00:20:53.440
So that helps with different training and scenarios of a phishing email or a cyber threat.
00:20:53.680 --> 00:21:04.960
And then also checking your your policy where if you have a policy of let's say$250,000, sounds like a lot, but if you get hit with a ransom where$500,000, it's not really covered.
00:21:05.039 --> 00:21:11.759
So it's good to have a IT or MSP like my like myself who I work for to do a renewal of it.
00:21:11.920 --> 00:21:13.599
So that's another one that really helps out.
00:21:14.640 --> 00:21:17.279
Yeah, that's a that's a really great point.
00:21:17.440 --> 00:21:26.000
And you know, I mean, I've had to do some long trainings, and I I love the fact you talked about kind of like weekly.
00:21:26.640 --> 00:21:40.079
I mean, the goal is with people who have never really used uh security training, uh for them to go sit there for three hours or two hours, even one hour is just not digestible.
00:21:40.640 --> 00:21:52.079
But in a way, uh getting a weekly email that takes three to five minutes and just keeps you fresh, but doesn't make you lose a part of your day, I love that.
00:21:52.960 --> 00:21:55.680
I love that I love that your group does that.
00:21:56.000 --> 00:22:01.359
Now I think the last thing I'm curious about is Let's be honest, right?
00:22:01.440 --> 00:22:04.559
Some some nonprofits are going to look at this and be like, no one wants my information.
00:22:04.720 --> 00:22:06.319
I still don't believe you.
00:22:06.960 --> 00:22:10.079
And we we know that's not true, right?
00:22:10.240 --> 00:22:11.920
People people take anything.
00:22:12.079 --> 00:22:13.599
But I'm I'm curious.
00:22:13.839 --> 00:22:16.480
Tell me about cybersecurity on a shoestring.
00:22:16.880 --> 00:22:20.799
Like what you know, what free and low-cost tools are there that actually work?
00:22:20.960 --> 00:22:27.039
Like, can you walk through maybe a few of the a few of the tools that everyone should be using?
00:22:28.160 --> 00:22:29.279
Yeah, definitely for sure.
00:22:29.359 --> 00:22:34.480
So Microsoft 365, for example, and nonprofits, they're always really good on giving discounts.
00:22:34.559 --> 00:22:40.160
If you qualify for as a 501c3, you'll get a deeply discount.
00:22:40.400 --> 00:22:47.279
Also, this this will include like enterprise email security, like MFA and device management.
00:22:47.839 --> 00:22:58.720
Also, CISA Cybersecurity and Infrastructure Security Agency offers free scanning and other phishing simulation tools to nonprofits at no cost.
00:22:58.880 --> 00:23:03.519
You can also get Cloud Fair for Teams, which is kind of a free tier.
00:23:03.680 --> 00:23:06.400
So some of those are just some of the some of those as well.
00:23:06.559 --> 00:23:14.240
And also Google workspace, even though it mentions the target, that can be a free Google workspace for for that as well, to at least have that.
00:23:14.319 --> 00:23:18.319
And there's also um business Google workspace as well.
00:23:18.559 --> 00:23:23.039
So there's a lot of uh benefits to nonprofits at discounted rates.
00:23:23.200 --> 00:23:27.680
I know it's it's all about money at the end of the day, so that that could be some things for some different nonprofits.
00:23:28.000 --> 00:23:28.960
That's great.
00:23:29.200 --> 00:23:46.400
You know, Trey, I before we before we finish up, I would love if you could send me a link that I can put on this podcast description for people to look at that kind of show the things that you offer through AtNet so they get a better idea.
00:23:46.720 --> 00:23:49.039
Because I think what what you offer, right?
00:23:49.119 --> 00:23:52.480
Uh whatever it is on the baseline, people should really be considering that.
00:23:52.640 --> 00:23:54.559
Similar to business insurance, right?
00:23:54.720 --> 00:24:07.440
You hope you never have to use business insurance, you hope you never have to use cyber insurance, but for the amount that it usually costs, it is worth it.
00:24:08.079 --> 00:24:15.920
But then also to have someone dedicated to you for all of the cyber needs, not cybersecurity necessarily.
00:24:16.079 --> 00:24:32.640
I mean, but all that back-end work is is really helpful to make things streamlined in and in space, especially for the trainings and the updates and the information and things that I believe that nonprofits should really be diving into the fractional side.
00:24:32.880 --> 00:24:36.799
I would I would consider you know your team's work kind of fractional IT, right?
00:24:36.880 --> 00:24:38.720
Because you're not working inside, right?
00:24:38.880 --> 00:24:42.319
Fractional IT, fractional fundraising, fractional marketing.
00:24:42.720 --> 00:24:50.000
Maybe you have one person doing that role internally as well that's working boots on the ground, but they're not strategizing.
00:24:50.160 --> 00:24:52.960
I think there are just so many benefits to that.
00:24:53.519 --> 00:25:05.519
Now, Trey, before you before we we finish off this podcast, is there anything else you share you're thinking you would share with us for nonprofits or organizations to know about?
00:25:05.680 --> 00:25:29.279
If there's one, I call it one hot take that you have in the cybersecurity world, something you're thinking about, something that's common right now that people aren't thinking about till it comes to them, what what is that hot take that you'd share with people to make them think a little bit more about why they should be investing in this and why it's so necessary for them to be on top of this work?
00:25:30.400 --> 00:25:31.680
Yeah, I'm gonna go back to it.
00:25:31.759 --> 00:25:41.200
My manager always uh mentioned it and he he always makes this a great stat that small business is compromised every 31 seconds in the US.
00:25:41.680 --> 00:25:46.079
Which so at least have the basics MFA.
00:25:47.039 --> 00:26:00.559
If you can't have cybersecurity, also just be on the really read your emails if it's more internal, being a nonprofit, phishing emails, so just be real diligent on that.
00:26:00.640 --> 00:26:07.440
So it's a MFA, if you can do cybersecurity, and just read your emails closely before doing anything, yeah.
00:26:07.680 --> 00:26:12.720
Because it can it's not uh if it's gonna happen, but when is what we like to tell.
00:26:12.799 --> 00:26:16.319
But at least have these certain cybersecurity tools set up.
00:26:16.640 --> 00:26:18.000
That's that's really great.
00:26:18.319 --> 00:26:24.720
Like we said, point of this is not to scare people, it's just to make them aware because we've seen it happen.
00:26:25.039 --> 00:26:26.720
It does happen.
00:26:27.039 --> 00:26:47.279
And when you are dealing with so many other people, not just the database, but people you're trying to serve, the populations you're trying to serve through your mission, but also the people you're trying to serve who are supporting your mission, you've got to do everything possible to keep both of them safe and their information safe.
00:26:47.519 --> 00:26:52.559
So, Trey, I really appreciate you coming on to the Executive Thought Podcast.
00:26:52.960 --> 00:26:59.119
I'll include your LinkedIn and any link you share with me for AtNet, I'll put that in the podcast description.
00:26:59.359 --> 00:27:06.640
This was really important to me because, as I've told you more times than I should, I think cybersecurity is huge for nonprofits.
00:27:06.720 --> 00:27:16.720
And I've just seen bad things happen when people don't think about this net as part of the work that they're doing, this safety net.
00:27:16.880 --> 00:27:18.720
So thank you for coming on today.
00:27:18.880 --> 00:27:19.680
We appreciate it.
00:27:19.839 --> 00:27:25.359
We'll put that information in there and looking forward to having this podcast come out.
00:27:25.759 --> 00:27:27.920
Yeah, appreciate you having me on again, Daniel.
00:27:28.079 --> 00:27:29.200
Look forward to it.
00:27:29.839 --> 00:27:33.759
Thank you for listening to the Executive Thought Partner Podcast.
00:27:33.920 --> 00:27:41.839
If today's conversation helped clarify your leadership or expand your thinking, share it with someone navigating meaningful decisions.
00:27:42.000 --> 00:27:46.319
Until next time, think clearly, lead intentionally, and build what lasts.
