WEBVTT
00:00:23.890 --> 00:00:27.250
Thank you for joining this Community IT podcast part two.
00:00:27.250 --> 00:00:33.329
You can find part one in your podcast feed if you subscribe wherever you listen to podcasts.
00:00:33.890 --> 00:00:47.170
Welcome everyone to the Community IT webinar, celebrating the re-release of our Playbook on cybersecurity readiness for nonprofits, updated for the age of AI with the author, Matt Eshleman.
00:00:47.170 --> 00:00:48.849
My name is Carolyn Woodard.
00:00:48.849 --> 00:00:52.929
I am the outreach director for Community IT, and I'll be the moderator today.
00:00:53.170 --> 00:00:59.409
All right, so just giving you that link again to the Foundational Cybersecurity Basics new download that we have.
00:00:59.409 --> 00:01:01.890
We're really proud of this booklet.
00:01:01.890 --> 00:01:08.049
And then Matt, we're gonna move into this checklist that is included in this booklet.
00:01:08.049 --> 00:01:11.650
It goes through these different areas and then you get this checklist at the end.
00:01:11.650 --> 00:01:13.650
So can you talk a little bit about that?
00:01:14.450 --> 00:01:14.929
Yes.
00:01:14.929 --> 00:01:17.170
So thanks for putting this up here.
00:01:17.170 --> 00:01:27.649
And I think it is a good, you know, I really appreciate the fact that you were thinking about how to present this information and yeah, pulling out that checklist for organizations that are just getting started.
00:01:27.649 --> 00:01:36.929
And I do think you know, cybersecurity is one of those areas where you really do need to cover your bases and having that good foundation to build on is very important.
00:01:36.929 --> 00:01:41.890
And so getting the basics right is absolutely critical.
00:01:42.129 --> 00:01:49.089
So you'll notice that that first recommendation here on the list of own it, it's not technical at all.
00:01:49.089 --> 00:01:51.089
It's just talking about accountability.
00:01:51.089 --> 00:02:02.530
you know, I'd say Community IT, we believe that organizations cannot outsource their risk, which means that someone at your organization needs to take responsibility for cybersecurity, right?
00:02:02.530 --> 00:02:07.890
You cannot, you know, send that out to your kind of MSP or whatever, right?
00:02:08.050 --> 00:02:11.890
A large part of their response and controls, you know, you can outsource, right?
00:02:11.890 --> 00:02:17.490
You need somebody to, you know, with capacity to manage and monitor and report and analyze and do all those things.
00:02:17.490 --> 00:02:29.250
But at the end of the day, you know, someone at your organization needs to have that role clearly assigned to them, to somebody on staff, to make you know kind of those fundamental decisions.
00:02:29.729 --> 00:02:34.930
And it's a great idea to leverage external partners for the kind of the monitoring and the operation, right?
00:02:34.930 --> 00:02:46.609
It's a it's a really focused skill set that's that's required for kind of keeping, you know, kind of monitoring everything and deploying things and all of that configuration.
00:02:46.609 --> 00:02:51.409
but you can't outsource kind of the ownership of risk for for the organizations.
00:02:51.409 --> 00:02:56.930
you're hearing this right, kind of going through the checklist.
00:02:56.930 --> 00:03:02.289
All right, so we've got somebody in our organization, it's really clear that they own cyber cybersecurity.
00:03:02.769 --> 00:03:09.409
Then the next thing we want to make sure is that we want to make sure that MFA is enabled for everybody.
00:03:09.409 --> 00:03:12.609
You know, maybe that is moot, you know, we've been talking about this.
00:03:12.609 --> 00:03:20.609
I think you know, we've been doing our Cybersecurity Playbook for years and years and years, and MFA, I think, has been in there every single year as a recommendation.
00:03:20.609 --> 00:03:31.729
You know, we've now evolved that recommendation really to move out into passkeys to help provide some more phish resistant capability, right, to combat against the most common types of cyber attacks.
00:03:32.049 --> 00:03:33.810
We're seeing vendors make moves in this area.
00:03:33.810 --> 00:03:36.769
I think Salesforce is, you know, kind of make it made a big move, right?
00:03:36.769 --> 00:03:43.009
Moving from, hey, like you need to have you know one-time passcodes, now they're requiring and enforcing passkeys for everybody.
00:03:43.009 --> 00:03:49.569
And so the vendors themselves are taking more responsibility for kind of enabling that cybersecurity by default.
00:03:51.090 --> 00:03:59.889
Microsoft themselves will be dropping support for voice and SMS multi-factor authentication in February of 2027.
00:03:59.889 --> 00:04:08.930
So again, if you are an Office 365 customer and you're still getting text messages or a call, know that Microsoft is gonna stop allowing that as a method.
00:04:08.930 --> 00:04:11.650
I mean, they're literally like the service is not gonna work anymore.
00:04:11.650 --> 00:04:15.810
And so you'll need to move to a more secure method of multi-factor authentication.
00:04:15.969 --> 00:04:29.250
And what I would say is I would just take this as an opportunity to move into what we call passkeys or phish resistant MFA as a way to really protect your digital accounts from those outside threat actors.
00:04:29.970 --> 00:04:38.050
Once you get MFA in place, you know, taking a look at using the password manager is a great great option.
00:04:38.050 --> 00:04:51.810
So while you know we talk about maybe more sophisticated solutions like single sign-on for for larger organizations or organizations that maybe have more resources, that can be complicated and have some licensing implications.
00:04:51.810 --> 00:04:57.009
But for organizations just starting out, getting a password manager for all staff is a great start.
00:04:57.329 --> 00:05:03.089
I'll say unfortunately, we still find lots of password spreadsheets in place at organizations.
00:05:03.089 --> 00:05:28.449
So do yourself a favor, evaluate some password managers out there that have that team functionality, get a license, assign it to everybody in your organization so that you can manage passwords and make sure that you have unique, complex passwords for each site that you access, protect it with MFA, and you really raise the, you know, raise the bar for your security protection because of that.
00:05:29.810 --> 00:05:34.610
Moving into security awareness training or phishing awareness training here.
00:05:34.610 --> 00:05:48.769
we know that you know, from the data that we see, the Verizon security report, the their DBIR report implicated staff manipulation in a majority of breaches.
00:05:48.769 --> 00:05:57.730
I think it was like over 60%, were of breaches that were reporting to them, kind of came through kind of user error, user manipulation, that kind of thing.
00:05:57.730 --> 00:06:05.730
and what we find is that regular security awareness training helps to build that culture of security, which is key to minimizing your risk.
00:06:06.129 --> 00:06:23.250
You want to give staff the tools so that they can kind of correctly identify whenever something doesn't quite seem right, to have some technical tools to identify links, to evaluate different scenarios so that they feel confident in responding to those situations when they get into them.
00:06:23.409 --> 00:06:30.449
You know, we also want to make sure that as part of that training, staff kind of feel confident or comfortable reporting it.
00:06:30.449 --> 00:06:38.129
They know where to go, they know how to kind of report that information and that they don't feel bad and kind of just try to ignore it or hide it.
00:06:38.129 --> 00:06:44.050
So, you know, we want to build that culture of security and openness where people share things that are happening to them.
00:06:44.370 --> 00:06:47.490
And I'm really encouraged when I'm you know talking to different organizations.
00:06:47.490 --> 00:06:56.290
I know a lot of folks, you know, they'll mention their Teams, you know, their Teams chat or their Slack to be like, hey, like I got a really weird message and it looked like this, right?
00:06:56.290 --> 00:07:05.409
Just to give the heads up that they saw something strange and they want to share that it what it looked like so that other people are aware and can avoid it.
00:07:06.610 --> 00:07:14.930
And then the final piece, you know, just in tops in terms of talking about avoiding it, is you know, getting really good third-party spam filtering in place.
00:07:14.930 --> 00:07:20.129
So you know, for us, you know, because we work with all nonprofits and we know that price is important, right?
00:07:20.129 --> 00:07:24.930
We don't mandate that, but have it available as an add-on.
00:07:24.930 --> 00:07:32.129
And so through some of those metrics, right, we can kind of get some data between the organizations that have third-party spam filtering and those that don't.
00:07:32.529 --> 00:07:38.930
We can see that the third-party security tools are dropping or reducing the phishing volume, right?
00:07:38.930 --> 00:07:46.370
So those messages that are trying to get you to click on something, to open up an attachment, to maybe copy and paste something into your command prompt, right?
00:07:46.370 --> 00:07:49.569
dropping the volume of those phishing emails by up to 80%.
00:07:50.370 --> 00:07:59.409
So technology isn't perfect, but it can really help to reduce the biggest source of risk to an organization, which is malicious emails, right?
00:07:59.409 --> 00:08:05.569
At the end of the day, you know, that is a very common attack vector, and they do it because it works.
00:08:05.569 --> 00:08:13.569
So if you can get that third-party spam filtering service and reduce the amount of junk that your staff are getting, that that's a huge help.
00:08:13.569 --> 00:08:23.969
You know, we know that Microsoft and Google have some built-in tools, but we find you know it's this is one of those things where it is really worth paying extra for.
00:08:24.610 --> 00:08:29.730
I there's a couple of questions before you move on to the closing the gaps.
00:08:29.730 --> 00:08:43.649
One is if you have any recommendations for good password management tools, specifically for legal organizations, but I'm wondering if you just are are there any that are better than the others, or there's I know that there's several that work really well.
00:08:44.050 --> 00:08:48.290
Yeah, so I would say the ones that we see kind of most most often would be Keeper.
00:08:48.290 --> 00:08:51.090
Looks like that that was a recommendation.
00:08:51.090 --> 00:08:58.610
Dashlane, I think they have some nonprofit discounting, and so I think that can be a compelling often uh offering and 1password.
00:08:59.409 --> 00:09:09.250
You know, I think the you know, in terms of like which one is best, it's probably you know, the answer again is like not really like is one technically superior to another.
00:09:09.250 --> 00:09:11.809
It's like which one is your organization going to use and adopt?
00:09:11.809 --> 00:09:27.169
And so I you know would really encourage organizations, yeah, take advantage of some of those free trials, set three different systems up side by side, explore, use them, kind of figure out which one works best for your organization, and and go with that one, right?
00:09:27.169 --> 00:09:32.289
So the you know, if you have a password manager but nobody uses it, right?
00:09:32.289 --> 00:09:33.490
That doesn't really do you much good.
00:09:33.570 --> 00:09:42.450
And so having a tool that you feel comfortable with, that makes sense to you, that you can you know easily use and administer, like that's the one you want to go with.
00:09:42.450 --> 00:09:45.490
And you know, there are lots of good options out there.
00:09:45.889 --> 00:09:55.730
Have the person that keeps their passwords in the spreadsheet be on that team that's evaluating which password keeper you're gonna use, because they are the ones that are gonna need to use it.
00:09:55.970 --> 00:09:58.610
All right, second question is a client.
00:09:58.610 --> 00:10:10.370
This person says, I had an issue where a client, my emails to them kept getting dropped into their spam junk folders, even though they attempted to flag me as okay as a sender.
00:10:10.769 --> 00:10:17.009
So is there anything you can do like on your end about false positives on spam filtering?
00:10:17.809 --> 00:10:20.610
We could probably have a whole webinar just on that.
00:10:21.409 --> 00:10:26.689
But I will say there's a couple of really kind of key acronyms to think about.
00:10:26.689 --> 00:10:39.570
I know we're trying to stay away from a lot of that, but making sure that you your email is kind of compliant or up to date with what's called SPF, which is kind of sender policy framework, which is hey, here's where emails are supposed to come from for our domain.
00:10:39.570 --> 00:10:41.009
Make sure that's correct.
00:10:41.250 --> 00:10:50.529
And that is combined with DMARC, so which basically says, hey, if you get an email and it says it's from this domain but it's not on this list, reject it, right?
00:10:50.529 --> 00:10:53.649
That's more of like protecting your domain from spoofing.
00:10:53.889 --> 00:11:06.289
And then DKIM kind of goes along, you know, with with the other two that kind of signs your message that says yes, like this message does did indeed come from the domain that it that it says it it did.
00:11:06.289 --> 00:11:13.730
So making sure that those things are in place and you can use some web tools called you know MXToolbox or something to to do some searching.
00:11:13.730 --> 00:11:17.409
it can be a little bit mystifying sometimes, right?
00:11:17.409 --> 00:11:27.090
Sometimes whatever, you know, your domain or maybe a link in your signature will get flagged on some spam engine, and it just takes a while to kind of figure that out.
00:11:27.730 --> 00:11:42.769
So yeah, it's but making sure those those three records are in place and accurate you know usually solves most of the problems with yeah, with with kind of having your mail redirected to junk.
00:11:43.730 --> 00:11:52.850
And we did a podcast a little while ago on that, so I shared that link here and it'll be in the transcript as well that just talks a lot more about what DMARC and DKIM are.
00:11:53.250 --> 00:11:53.889
Perfect.
00:11:54.129 --> 00:11:57.970
All right, so closing the gaps, the rest of the checklist.
00:11:58.289 --> 00:12:07.570
Yeah, so you know, you know, continuing our recommendations and basic controls, you know, you may have noticed a much more frequent cadence for patching and updates this year.
00:12:07.570 --> 00:12:14.289
And I would say that is a hundred percent tied to the explosion in the use of AI to find and exploit software vulnerabilities.
00:12:14.289 --> 00:12:17.649
All the vendors are scrambling to react, right?
00:12:17.649 --> 00:12:21.809
They're they're scanning their own code for vulnerabilities, stuff is getting reported, right?
00:12:21.809 --> 00:12:25.490
It's just a kind of a I don't know, free-for-all jailbreak, right?
00:12:25.490 --> 00:12:35.330
There's just lots of stuff being discovered, and so vendors are pushing updates really frequently to just kind of deal with and keep up with the flood of that.
00:12:35.490 --> 00:12:42.769
So you know, we say reboot your computer monthly, maybe you need to reboot it weekly, right?
00:12:42.769 --> 00:12:50.769
Just but it it sounds kind of silly, but checking to make sure your software is up to date and rebooting your computer regularly is a really good security practice.
00:12:50.769 --> 00:13:00.129
So make sure you're doing that on the regular and don't ignore the updates because if there's a patch released, it's usually because there was some exploit that was identified.
00:13:01.090 --> 00:13:04.610
The other note here, antivirus, anti- malware, managed and maintained.
00:13:04.610 --> 00:13:09.169
Again, you know, we have really seen a big spike in the amount of malicious activity.
00:13:09.169 --> 00:13:11.090
It's kind of being detected on endpoints.
00:13:11.090 --> 00:13:18.129
And so making sure that you have good tools in place, that they're active and they're in use and they're configured and they're updated, right?
00:13:18.129 --> 00:13:21.169
can help provide that extra layer of protection.
00:13:21.169 --> 00:13:26.769
You know, so just you know, make sure that you've got something in place and it's up to date.
00:13:27.330 --> 00:13:39.730
And then the final piece is is around you know, kind of resiliency and be able to recover if and when you know you do have some sort of data breach or data loss.
00:13:39.730 --> 00:13:48.689
and so making sure that you have a good third-party backup tool in place is key to recovery, you know, so whenever that data maybe has been lost or corrupted.
00:13:48.850 --> 00:14:04.370
So I will say, you know, Google and Microsoft, right, they both provide some basic capabilities in terms of you know, kind of trash can or you could recover some data, but that you know is limited, right, from a time perspective, right?
00:14:04.370 --> 00:14:07.409
They maybe only have 30 days worth of retention in those situations.
00:14:07.409 --> 00:14:12.450
It could also be times where you know the way data is deleted, it doesn't show up in those places.
00:14:12.610 --> 00:14:24.610
So having a third-party backup in another system that you can control and manage is key to being able to recover data in the event that it's lost or stolen.
00:14:24.610 --> 00:14:27.730
and I would also probably expand this definition, right?
00:14:27.730 --> 00:14:42.529
you know, we often think of Google and Microsoft as kind of the big ones because we're primarily focused on kind of IT and operations, but that should also extend to your website, your CRM system, your fundraising system, your finance, accounting, right?
00:14:42.529 --> 00:14:44.450
Kind of all of these applications.
00:14:45.330 --> 00:14:48.850
You know, we often think, hey, it's in the cloud, it's all taken care of.
00:14:48.850 --> 00:15:01.250
That maybe means, right, you don't have to maintain the hardware underneath of it, but it is good to clarify with your vendors, hey, what happens if you know a malicious actor gets in and corrupts a bunch of our data or deletes a bunch of stuff?
00:15:01.250 --> 00:15:02.529
Like, how could we get that back?
00:15:02.689 --> 00:15:19.649
You know, and just have you don't need to know the technical details of how all of it works, but having those kind of clear scenarios to say, how would we respond in this case or how would we respond in this other scenario can be good to just kind of confirm that things are going to work as you expect when you kind of run into that scenario.
00:15:20.210 --> 00:15:20.610
All right.
00:15:20.610 --> 00:15:26.049
And then we have a few more things on the checklist and then we'll be able to get to some recent threats.
00:15:26.610 --> 00:15:27.250
Yes.
00:15:27.250 --> 00:15:29.970
great, you know, we've talked about it a lot.
00:15:29.970 --> 00:15:31.570
You know, policies are important.
00:15:31.570 --> 00:15:43.090
And, you know, I think a lot of these were on our update, you know, two years ago, and now, you know, the addition would say here, you know, kind of is the AI acceptable use policy.
00:15:43.330 --> 00:15:51.490
So I think policies are a great way to start because they help an organization distill and define kind of what they're gonna do and how it's gonna get done.
00:15:51.490 --> 00:16:03.809
And putting things down in writing means that you'll have some discussion around maybe some assumptions that people have and conflict areas that, you know, if you're not talking about it, you know, you you can kind of ignore.
00:16:03.889 --> 00:16:15.009
And so, you know, things that often come up in organizations, it's kind of this policy exercise is good to clarify, are things like the use of personal devices to access work data.
00:16:15.009 --> 00:16:19.409
unless you've done something proactive, right?
00:16:19.409 --> 00:16:24.689
you can't necessarily wipe data from personal devices if they are lost or stolen, right?
00:16:24.689 --> 00:16:27.169
Interns, contractors, you know, right?
00:16:27.169 --> 00:16:31.169
A lot of remote staff, you know, you don't have control of the devices themselves.
00:16:31.169 --> 00:16:41.970
And so if a device is lost or stolen, it's really important that you understand what controls and parameters you have in place to protect data that may be on those devices.
00:16:43.809 --> 00:16:57.809
Understanding where your data is as an organization, what are those official systems of record, who maintains them, who supports them, what data is there, how is it archived, deleted, you know, kind of all of those questions are good to clarify.
00:16:57.809 --> 00:17:05.250
Again, with all the proliferation of SaaS applications, it's super easy for somebody to just sign up for an app, put a bunch of data in it, start using it, right?
00:17:05.250 --> 00:17:07.570
and so you have a lot of ungoverned data out there.
00:17:07.570 --> 00:17:19.090
So being clear about this is our official systems of record, here's how we're using them, here's who has access, you know, those are good conversations to have to clarify how all the workflows are supposed to happen.
00:17:19.730 --> 00:17:25.570
And with AI, it's you know, again, that you know, you we've got great templates.
00:17:25.570 --> 00:17:35.570
It's something that you need to I think work and be really flexible on, but also be kind of very don't be overly prescriptive as this is changing super rapidly.
00:17:35.730 --> 00:17:40.290
So, you know, I think in our templates, right, we like to start with what's approved and then iterate regularly.
00:17:40.290 --> 00:17:42.050
Like here's the things we're working on now.
00:17:42.050 --> 00:17:50.530
Let's kind of you know, give a use this, not that framework, and you know, make sure that it's updated regularly.
00:17:50.530 --> 00:17:53.890
So, you know, A AI is a tool.
00:17:53.890 --> 00:17:56.850
It's a tool that a lot of organizations are using.
00:17:56.850 --> 00:17:59.970
It's also a tool that you don't have to use, right?
00:17:59.970 --> 00:18:11.090
There there seems to be, you know, the feeling that, hey, everybody else is doing it, but you know, you can also take a stand to say, hey, we're not gonna use it, and and make that clear to staff as well.
00:18:11.250 --> 00:18:20.370
Like I said, in the absence of really good communication and maybe technology controls to prevent it, staff are 100% using AI tools.
00:18:20.370 --> 00:18:22.770
You know, it's something that we can see.
00:18:22.770 --> 00:18:32.850
and it's good to provide that clarity to organizations that you know that these things are in use and and they're really widespread.
00:18:34.850 --> 00:18:40.450
So you do need an AI policy, even if your policy is that you don't use AI at your organization.
00:18:40.690 --> 00:18:46.930
We've talked a little bit already about the cyber liability, cyber liability insurance conversation, right?
00:18:46.930 --> 00:18:54.770
If you don't have that protection in place already, it's a good one to start with your, I would start with your existing broker.
00:18:54.770 --> 00:19:00.850
you know, it can seem like a big new expense, but it's a pretty common policy.
00:19:00.850 --> 00:19:03.810
You probably want to bundle it with other things you already have, right?
00:19:03.810 --> 00:19:33.730
and so having that protection in place so that you know you have you know some guardrails in case your organization you know is a victim of of wire fraud or something really significant that that impacts your operations or you know protects your protects you in the event of maybe you have a data leak and right you need to provide reporting on all the people's data that you know that that was disclosed.
00:19:33.970 --> 00:19:37.650
So and then that compliance piece.
00:19:38.770 --> 00:19:39.090
Yep.
00:19:39.090 --> 00:19:44.690
So I think closing the compliance loop is you know making sure that you actually have a plan, right?
00:19:44.690 --> 00:20:00.050
So that person that or the team maybe that we identified at the start as the owner has built-in milestones that are built into their performance expectations and maybe more importantly, right, the time and support to actually do that work.
00:20:00.210 --> 00:20:08.050
You know, I think you know, in nonprofit organizations, it just seems like you know, there's always kind of more work to do and not enough time allocated for for it.
00:20:08.050 --> 00:20:16.290
but this is something that you know needs to have kind of formal recognition that this is a responsibility that this person has.
00:20:16.290 --> 00:20:20.690
And we're also gonna give them the time that they need to carry out that work.
00:20:21.090 --> 00:20:30.050
Yeah, I think that's how people or organizations get behind, is it's just something else put on somebody's plate and they didn't make any room on the table for that plate to be on there.
00:20:30.050 --> 00:20:33.010
So making sure that you're supporting that person.
00:20:33.250 --> 00:20:36.050
I'm just gonna show this example very quickly.
00:20:36.050 --> 00:20:45.970
It's an example of an IT roadmap that you might make for this person or the person might make for the organization of what you're gonna do, how urgent it is.
00:20:45.970 --> 00:20:54.930
You can you know put extra columns on here for who's gonna do it, how much it's gonna cost, when it's gonna be done by all of those pieces.
00:20:54.930 --> 00:20:58.450
And that is just like a great way to report back on your progress.
00:20:58.610 --> 00:21:04.450
So, like I said, cybersecurity can feel like you're always what running in place, like there's always more stuff to do.
00:21:04.450 --> 00:21:09.890
So, for a lot of organizations, having some kind of checklist where you're like, look at what you accomplished.
00:21:09.890 --> 00:21:13.650
You didn't have MFA a couple of months ago, and now everybody has it.
00:21:13.650 --> 00:21:16.530
So just being able to check those off is really important.
00:21:16.530 --> 00:21:25.570
and I have a link here that I can share with you about creating an IT roadmap, which could include security.
00:21:25.570 --> 00:21:27.330
You can do it just for security.
00:21:27.650 --> 00:21:33.170
I want to move a little bit quickly through some of these other levels that are in the Playbook.
00:21:33.170 --> 00:21:39.410
If you've downloaded the Playbook, you'll see these other levels, but again, do a risk assessment first.
00:21:39.410 --> 00:21:43.810
Cybersecurity is a journey, not a destination.
00:21:43.810 --> 00:21:50.050
Developing that roadmap, being intentional about improving your cybersecurity will help reduce your risk.
00:21:50.050 --> 00:21:52.770
So it is very worth putting the effort into.
00:21:52.930 --> 00:21:58.370
And I went through that quickly because I wanted to be able to get you to like weigh in on this, Matt.
00:21:58.370 --> 00:22:02.370
So some new twists on some old cybersecurity attacks.
00:22:03.090 --> 00:22:13.090
As we talked about, right, phishing and account compromise, right, and user targeted things are the main are, you know, continue to be the main point of attack for for scammers in in 2026.
00:22:14.530 --> 00:22:18.290
And you know, viruses are back, they're worse than ever.
00:22:18.290 --> 00:22:38.690
you know, there's lots of really sophisticated ways now that adversaries are able to yeah kind of pull on those levers right to get people to to you know click on the link to you know provide that MFA code you know to kind of do the work you know kind of do the work so to speak for them.
00:22:39.250 --> 00:23:10.450
And so you know we certainly see that a lot we've had you know a couple of recent account compromises in both cases they were organizations that didn't have third party spam filtering and you know they got some very convincing messages that they clicked on and then they got forwarded around and it's like it just ends up being a real mess to to try to clean up. S o again the sophisticated email attacks are are you know continue to be very effective for these threat actors.
00:23:10.850 --> 00:23:16.610
I think the new things that we are seeing is that right phishing doesn't always you know kind of come as that link.
00:23:16.610 --> 00:23:25.650
We're starting to see stuff like calendar invites come in, you know, they kind of land and they you know kind of kind of go around a lot of the spam filtering tools.
00:23:25.650 --> 00:23:40.770
You know things are often you know shared as a document and then they have the instructions in the document that kind of conveniently tell you you know how to you know copy and paste maybe a code that's going to allow somebody else to access your system.
00:23:40.930 --> 00:24:02.370
So you know being cautious of you know kind of how you're receiving those even if it's from somebody that you know because it is likely that you know their account could have been compromised and kind of then used to target and pivot to other you know to other email you know kind of contacts that are in that organization's domain.
00:24:04.450 --> 00:24:23.810
We're also seeing you know like I said wire fraud is you know continues to be kind of the big right at the end of the day the amount of financial you know fraud that goes on is is really the main driver and that continues to increase year over year.
00:24:24.050 --> 00:24:47.090
And you know that you know I think gets carried out through a number of different ways from phone calls to updating invoices to payment change requests and so you know all these different methods are kind of new spins on old techniques you know fundamentally designed to get access to banking information that they are not supposed to have.
00:24:47.250 --> 00:25:16.370
And then you know we have the last item here right as attacker in the middle attacks continue . And so you know that is where you get a link it looks realistic it even looks like your Office 365 or Google sign-in page but it's going through an attacker's an attacker's kind of framework and so they're actually able to steal your session right they're not taking your password so to speak but they effectively have what they need to appear as you.
00:25:16.380 --> 00:25:26.210
A nd so that's why we are making that push to switch to phish resistant passkeys or security keys as a way to kind of mitigate that risk.
00:25:28.850 --> 00:26:02.850
The next slide you know kind of continuing on some of these other attacks that we are seeing you know are you know kind of job posting HR scams that impersonate your organization. W e're starting to see you know kind of more around deepfakes usually starting to get something out of your organization like money or access but you know many nonprofit organizations are also concerned about deepfakes that would cause you know represent representational harm a reputational harm, by you know misrepresenting policies or staff members' views.
00:26:02.460 --> 00:26:12.770
S o you know there's lots of things to be concerned about in terms of protecting your organization's identity and trust that you've built up over time.
00:26:13.500 --> 00:26:28.610
And so you know these are just kind of new technology tools that are available and organizations are going to need to find ways and strategies to kind of verify and validate and be able to provide assurance that you know the content that you're putting out you know is in fact is in fact you.
00:26:29.890 --> 00:26:40.210
The other piece I did want to highlight here is that you know a lot of this is kind of technology and kind of delivered you know kind of over the over the internet, right?
00:26:40.210 --> 00:26:43.250
Email, you know, web attacks so on and so forth.
00:26:43.490 --> 00:26:52.290
But we've also seen what maybe seem like throwback attacks around wire fraud that's initiated over the phone first.
00:26:52.290 --> 00:27:20.370
Maybe that ties into some of these deep fake capabilities right to to to let people, create you know more polished you know conversational tone and so we have seen or have heard reports where you know the the bank so to speak right calls in to verify some information and and they're able to kind of convince or or kind of get that information from people on on staff.
00:27:19.980 --> 00:27:37.890
A nd so again there's some technology tools that you can have in place maybe to prevent some attacks there's some training tools or if there's some process tools and so uh viewing this as as a holistic perspective on how to protect your organization is going to involve more than just you know buying the spam filter right?
00:27:37.890 --> 00:27:48.130
it's gonna also involve talking about how do we make banking change information that's a conversation you need to have internally and it's a conversation to have with your financial institution as well.
00:27:48.530 --> 00:28:02.450
I want to make sure we talk about that last bullet point because I know we have legal people attending, so I had never heard of this DMCA copyright infringement notices that are fake.
00:28:02.450 --> 00:28:04.610
And so what what is that?
00:28:05.330 --> 00:28:27.970
Yeah so it's a it's kind of a technique you know that actually I think has been in use for a while where you know the Digital Millennium Copyright Act I think you know is a real is a real piece of legislation that's designed to protect those people with digital copyrights, to say hey like you know you can't just use my you know audio or images or whatever without attribution.
00:28:27.020 --> 00:28:44.290
B ut it can also be used and manipulated to create a realistic kind of legal sounding threat that again is just trying to get you to make a payment to a fraudster you know because of some vaguely worded you know kind of legal threat, right?
00:28:44.370 --> 00:28:57.170
I think as soon as everybody's like oh the lawyers are involved I'm getting this you know this legal you know sounding message I need to comply with it, and so again treat those with caution.
00:28:57.170 --> 00:29:15.250
It's not to say right you just want to delete everything because it's 100% a scam that's not true, right, there could be legitimate communication that you're getting because you know somebody accidentally you know or you know didn't didn't get the correct permissions to use a certain piece of media on a website or an appeal.
00:29:15.330 --> 00:29:34.770
So there could be legitimate cases where you receive these takedown notifications but it's also I'd say primarily used by scammers as a way to just kind of worm their way into your organization and you know put up a dollar amount right there it's like oh well it's just cheaper to pay this than to talk to our lawyer about you know whether we should or not.
00:29:35.010 --> 00:29:38.770
So it's just amazing what they will come up with.
00:29:38.770 --> 00:29:39.970
And I mean using that.
00:29:40.050 --> 00:29:46.130
I think one of the things that we teach in that awareness, cybersecurity awareness is look at your emotions.
00:29:46.130 --> 00:30:03.010
Are you, is it trying to appeal to fear or shame or you know some other you know like quit embarrassment, doing something quickly with urgency and just be aware of how you're reacting to something, and have that trigger you to think wait should I be worried about this or not?
00:30:03.010 --> 00:30:04.450
Are they just trying to get me?
00:30:04.930 --> 00:30:09.730
So unfortunately we're kind of running out of time for the QA.
00:30:09.730 --> 00:30:20.130
So what I'm gonna propose Matt is that we just go over to Reddit after this and so if you have more questions go ahead and join us on Reddit over there and Matt will be there to answer questions.
00:30:20.530 --> 00:30:34.210
I wanted to make sure to go back over our learning objectives we had for today which was that you know learn our basic approach to cybersecurity understand the new threats in the age of AI we've talked about many of them.
00:30:34.220 --> 00:30:41.330
A nd I think you know there's kind of a theme of if AI can make it convincing a scammer is gonna do that.
00:30:41.330 --> 00:30:55.410
So there are going to be new brand new things - like doing those patches right away keeping an eye out for stories that are coming out about you know new scams that are coming out is just really - it's changing so quickly so keep an eye on that.
00:30:55.730 --> 00:31:01.650
Learn the foundational level that we recommend that is in our basics download it's also in the Playbook.
00:31:01.650 --> 00:31:12.290
And then the takeaways is you know kind of those first steps and best practices in managing cybersecurity at your nonprofit we shared that checklist that you can use, it is in the basics download that you can use.
00:31:12.290 --> 00:31:15.810
And here are those two links again to the URLs.
00:31:16.210 --> 00:31:29.170
Before you go I want to make sure to invite you back next month for our final webinar of 2026 and this is a you know just a little topic a little you know side note should your nonprofit use AI?
00:31:29.170 --> 00:31:31.330
So this is a question we get asked a lot.
00:31:31.330 --> 00:31:34.530
It's out there in the nonprofit environment a lot.
00:31:34.690 --> 00:31:38.530
We're gonna do a kind of different format with this webinar to talk about it.
00:31:38.530 --> 00:31:55.250
I'm gonna be joined by Steve Longenecker who's our director of IT consulting and Nuradeen Aboki who's our senior consultant both of them have worked with a lot of clients on AI and AI implementation and readiness but they've also worked with clients that don't want to do AI.
00:31:55.330 --> 00:32:05.890
So we're gonna answer five or six common questions that nonprofits have about AI, starting with that existential one, moving on to readiness, security, impact.
00:32:05.890 --> 00:32:11.250
The three of us have very different experiences with AI tools and with the ways our clients use them.
00:32:11.250 --> 00:32:12.610
We don't always agree.
00:32:12.770 --> 00:32:27.490
So I'm really looking forward to this conversation it's gonna be at 3 p.m eastern noon Pacific on Wednesday November 18th please join us and we if you submit your questions at registration we might answer one of them on our panel.
00:32:27.490 --> 00:32:33.490
You can register now on our website at communityit.com and I'm putting that in the chat as well.
00:32:33.490 --> 00:32:35.410
So go ahead and register for that.
00:32:35.570 --> 00:32:47.250
Don't forget as you exit the webinar today to take our short survey one lucky winner chosen at random receives a $25 gift certificate for helping us learn how we're doing join us over on Reddit.
00:32:47.250 --> 00:32:49.650
Matt's going to answer some questions over there.
00:32:49.890 --> 00:33:02.850
Matt, I want to thank you so much for your time today and for all your work on helping update this Playbook and develop the basics download so that you know our community really has what they need to get started.
00:33:02.850 --> 00:33:12.770
Cybersecurity can be so lingo ridden and emotional you know, it's you want to put it in the in the drawer and just not worry about it.
00:33:12.930 --> 00:33:18.050
So really appreciate your time and helping inform us and help us educate ourselves.
00:33:18.050 --> 00:33:34.130
I want to appreciate everyone on the webinar today your gift of an hour with us is something we don't take lightly you're in the right place you're worried about cybersecurity and getting better at it getting better at it is something that we really believe all of us can do.
00:33:34.130 --> 00:33:42.130
It is not beyond you so go ahead and download these free guides and Matt thank you again so much for your time today.
00:33:42.610 --> 00:34:07.810
Yes thank you Carolyn and and I'll just yeah highlight you know my meeting information is up it was posted there again there's lots of stuff that you know you can read and try to understand but I'm also happy to yeah have a short conversation and just clarify some of those questions that yeah that that that come up it's really important for us to help build that foundational knowledge around protecting your organization's data from all the threats that are out there.
00:34:07.810 --> 00:34:16.449
Yeah we just want the nonprofit sector to be doing this as well as we can, so thank you again and we will see you over there on Reddit.
00:34:16.530 --> 00:34:29.570
Thanks everyone thank you for joining this Community IT podcast part two you can find part one in your podcast feed if you subscribe wherever you listen to podcasts
00:00:23.890 --> 00:00:27.250
Thank you for joining this Community IT podcast part two.
00:00:27.250 --> 00:00:33.329
You can find part one in your podcast feed if you subscribe wherever you listen to podcasts.
00:00:33.890 --> 00:00:47.170
Welcome everyone to the Community IT webinar, celebrating the re-release of our Playbook on cybersecurity readiness for nonprofits, updated for the age of AI with the author, Matt Eshleman.
00:00:47.170 --> 00:00:48.849
My name is Carolyn Woodard.
00:00:48.849 --> 00:00:52.929
I am the outreach director for Community IT, and I'll be the moderator today.
00:00:53.170 --> 00:00:59.409
All right, so just giving you that link again to the Foundational Cybersecurity Basics new download that we have.
00:00:59.409 --> 00:01:01.890
We're really proud of this booklet.
00:01:01.890 --> 00:01:08.049
And then Matt, we're gonna move into this checklist that is included in this booklet.
00:01:08.049 --> 00:01:11.650
It goes through these different areas and then you get this checklist at the end.
00:01:11.650 --> 00:01:13.650
So can you talk a little bit about that?
00:01:14.450 --> 00:01:14.929
Yes.
00:01:14.929 --> 00:01:17.170
So thanks for putting this up here.
00:01:17.170 --> 00:01:27.649
And I think it is a good, you know, I really appreciate the fact that you were thinking about how to present this information and yeah, pulling out that checklist for organizations that are just getting started.
00:01:27.649 --> 00:01:36.929
And I do think you know, cybersecurity is one of those areas where you really do need to cover your bases and having that good foundation to build on is very important.
00:01:36.929 --> 00:01:41.890
And so getting the basics right is absolutely critical.
00:01:42.129 --> 00:01:49.089
So you'll notice that that first recommendation here on the list of own it, it's not technical at all.
00:01:49.089 --> 00:01:51.089
It's just talking about accountability.
00:01:51.089 --> 00:02:02.530
you know, I'd say Community IT, we believe that organizations cannot outsource their risk, which means that someone at your organization needs to take responsibility for cybersecurity, right?
00:02:02.530 --> 00:02:07.890
You cannot, you know, send that out to your kind of MSP or whatever, right?
00:02:08.050 --> 00:02:11.890
A large part of their response and controls, you know, you can outsource, right?
00:02:11.890 --> 00:02:17.490
You need somebody to, you know, with capacity to manage and monitor and report and analyze and do all those things.
00:02:17.490 --> 00:02:29.250
But at the end of the day, you know, someone at your organization needs to have that role clearly assigned to them, to somebody on staff, to make you know kind of those fundamental decisions.
00:02:29.729 --> 00:02:34.930
And it's a great idea to leverage external partners for the kind of the monitoring and the operation, right?
00:02:34.930 --> 00:02:46.609
It's a it's a really focused skill set that's that's required for kind of keeping, you know, kind of monitoring everything and deploying things and all of that configuration.
00:02:46.609 --> 00:02:51.409
but you can't outsource kind of the ownership of risk for for the organizations.
00:02:51.409 --> 00:02:56.930
you're hearing this right, kind of going through the checklist.
00:02:56.930 --> 00:03:02.289
All right, so we've got somebody in our organization, it's really clear that they own cyber cybersecurity.
00:03:02.769 --> 00:03:09.409
Then the next thing we want to make sure is that we want to make sure that MFA is enabled for everybody.
00:03:09.409 --> 00:03:12.609
You know, maybe that is moot, you know, we've been talking about this.
00:03:12.609 --> 00:03:20.609
I think you know, we've been doing our Cybersecurity Playbook for years and years and years, and MFA, I think, has been in there every single year as a recommendation.
00:03:20.609 --> 00:03:31.729
You know, we've now evolved that recommendation really to move out into passkeys to help provide some more phish resistant capability, right, to combat against the most common types of cyber attacks.
00:03:32.049 --> 00:03:33.810
We're seeing vendors make moves in this area.
00:03:33.810 --> 00:03:36.769
I think Salesforce is, you know, kind of make it made a big move, right?
00:03:36.769 --> 00:03:43.009
Moving from, hey, like you need to have you know one-time passcodes, now they're requiring and enforcing passkeys for everybody.
00:03:43.009 --> 00:03:49.569
And so the vendors themselves are taking more responsibility for kind of enabling that cybersecurity by default.
00:03:51.090 --> 00:03:59.889
Microsoft themselves will be dropping support for voice and SMS multi-factor authentication in February of 2027.
00:03:59.889 --> 00:04:08.930
So again, if you are an Office 365 customer and you're still getting text messages or a call, know that Microsoft is gonna stop allowing that as a method.
00:04:08.930 --> 00:04:11.650
I mean, they're literally like the service is not gonna work anymore.
00:04:11.650 --> 00:04:15.810
And so you'll need to move to a more secure method of multi-factor authentication.
00:04:15.969 --> 00:04:29.250
And what I would say is I would just take this as an opportunity to move into what we call passkeys or phish resistant MFA as a way to really protect your digital accounts from those outside threat actors.
00:04:29.970 --> 00:04:38.050
Once you get MFA in place, you know, taking a look at using the password manager is a great great option.
00:04:38.050 --> 00:04:51.810
So while you know we talk about maybe more sophisticated solutions like single sign-on for for larger organizations or organizations that maybe have more resources, that can be complicated and have some licensing implications.
00:04:51.810 --> 00:04:57.009
But for organizations just starting out, getting a password manager for all staff is a great start.
00:04:57.329 --> 00:05:03.089
I'll say unfortunately, we still find lots of password spreadsheets in place at organizations.
00:05:03.089 --> 00:05:28.449
So do yourself a favor, evaluate some password managers out there that have that team functionality, get a license, assign it to everybody in your organization so that you can manage passwords and make sure that you have unique, complex passwords for each site that you access, protect it with MFA, and you really raise the, you know, raise the bar for your security protection because of that.
00:05:29.810 --> 00:05:34.610
Moving into security awareness training or phishing awareness training here.
00:05:34.610 --> 00:05:48.769
we know that you know, from the data that we see, the Verizon security report, the their DBIR report implicated staff manipulation in a majority of breaches.
00:05:48.769 --> 00:05:57.730
I think it was like over 60%, were of breaches that were reporting to them, kind of came through kind of user error, user manipulation, that kind of thing.
00:05:57.730 --> 00:06:05.730
and what we find is that regular security awareness training helps to build that culture of security, which is key to minimizing your risk.
00:06:06.129 --> 00:06:23.250
You want to give staff the tools so that they can kind of correctly identify whenever something doesn't quite seem right, to have some technical tools to identify links, to evaluate different scenarios so that they feel confident in responding to those situations when they get into them.
00:06:23.409 --> 00:06:30.449
You know, we also want to make sure that as part of that training, staff kind of feel confident or comfortable reporting it.
00:06:30.449 --> 00:06:38.129
They know where to go, they know how to kind of report that information and that they don't feel bad and kind of just try to ignore it or hide it.
00:06:38.129 --> 00:06:44.050
So, you know, we want to build that culture of security and openness where people share things that are happening to them.
00:06:44.370 --> 00:06:47.490
And I'm really encouraged when I'm you know talking to different organizations.
00:06:47.490 --> 00:06:56.290
I know a lot of folks, you know, they'll mention their Teams, you know, their Teams chat or their Slack to be like, hey, like I got a really weird message and it looked like this, right?
00:06:56.290 --> 00:07:05.409
Just to give the heads up that they saw something strange and they want to share that it what it looked like so that other people are aware and can avoid it.
00:07:06.610 --> 00:07:14.930
And then the final piece, you know, just in tops in terms of talking about avoiding it, is you know, getting really good third-party spam filtering in place.
00:07:14.930 --> 00:07:20.129
So you know, for us, you know, because we work with all nonprofits and we know that price is important, right?
00:07:20.129 --> 00:07:24.930
We don't mandate that, but have it available as an add-on.
00:07:24.930 --> 00:07:32.129
And so through some of those metrics, right, we can kind of get some data between the organizations that have third-party spam filtering and those that don't.
00:07:32.529 --> 00:07:38.930
We can see that the third-party security tools are dropping or reducing the phishing volume, right?
00:07:38.930 --> 00:07:46.370
So those messages that are trying to get you to click on something, to open up an attachment, to maybe copy and paste something into your command prompt, right?
00:07:46.370 --> 00:07:49.569
dropping the volume of those phishing emails by up to 80%.
00:07:50.370 --> 00:07:59.409
So technology isn't perfect, but it can really help to reduce the biggest source of risk to an organization, which is malicious emails, right?
00:07:59.409 --> 00:08:05.569
At the end of the day, you know, that is a very common attack vector, and they do it because it works.
00:08:05.569 --> 00:08:13.569
So if you can get that third-party spam filtering service and reduce the amount of junk that your staff are getting, that that's a huge help.
00:08:13.569 --> 00:08:23.969
You know, we know that Microsoft and Google have some built-in tools, but we find you know it's this is one of those things where it is really worth paying extra for.
00:08:24.610 --> 00:08:29.730
I there's a couple of questions before you move on to the closing the gaps.
00:08:29.730 --> 00:08:43.649
One is if you have any recommendations for good password management tools, specifically for legal organizations, but I'm wondering if you just are are there any that are better than the others, or there's I know that there's several that work really well.
00:08:44.050 --> 00:08:48.290
Yeah, so I would say the ones that we see kind of most most often would be Keeper.
00:08:48.290 --> 00:08:51.090
Looks like that that was a recommendation.
00:08:51.090 --> 00:08:58.610
Dashlane, I think they have some nonprofit discounting, and so I think that can be a compelling often uh offering and 1password.
00:08:59.409 --> 00:09:09.250
You know, I think the you know, in terms of like which one is best, it's probably you know, the answer again is like not really like is one technically superior to another.
00:09:09.250 --> 00:09:11.809
It's like which one is your organization going to use and adopt?
00:09:11.809 --> 00:09:27.169
And so I you know would really encourage organizations, yeah, take advantage of some of those free trials, set three different systems up side by side, explore, use them, kind of figure out which one works best for your organization, and and go with that one, right?
00:09:27.169 --> 00:09:32.289
So the you know, if you have a password manager but nobody uses it, right?
00:09:32.289 --> 00:09:33.490
That doesn't really do you much good.
00:09:33.570 --> 00:09:42.450
And so having a tool that you feel comfortable with, that makes sense to you, that you can you know easily use and administer, like that's the one you want to go with.
00:09:42.450 --> 00:09:45.490
And you know, there are lots of good options out there.
00:09:45.889 --> 00:09:55.730
Have the person that keeps their passwords in the spreadsheet be on that team that's evaluating which password keeper you're gonna use, because they are the ones that are gonna need to use it.
00:09:55.970 --> 00:09:58.610
All right, second question is a client.
00:09:58.610 --> 00:10:10.370
This person says, I had an issue where a client, my emails to them kept getting dropped into their spam junk folders, even though they attempted to flag me as okay as a sender.
00:10:10.769 --> 00:10:17.009
So is there anything you can do like on your end about false positives on spam filtering?
00:10:17.809 --> 00:10:20.610
We could probably have a whole webinar just on that.
00:10:21.409 --> 00:10:26.689
But I will say there's a couple of really kind of key acronyms to think about.
00:10:26.689 --> 00:10:39.570
I know we're trying to stay away from a lot of that, but making sure that you your email is kind of compliant or up to date with what's called SPF, which is kind of sender policy framework, which is hey, here's where emails are supposed to come from for our domain.
00:10:39.570 --> 00:10:41.009
Make sure that's correct.
00:10:41.250 --> 00:10:50.529
And that is combined with DMARC, so which basically says, hey, if you get an email and it says it's from this domain but it's not on this list, reject it, right?
00:10:50.529 --> 00:10:53.649
That's more of like protecting your domain from spoofing.
00:10:53.889 --> 00:11:06.289
And then DKIM kind of goes along, you know, with with the other two that kind of signs your message that says yes, like this message does did indeed come from the domain that it that it says it it did.
00:11:06.289 --> 00:11:13.730
So making sure that those things are in place and you can use some web tools called you know MXToolbox or something to to do some searching.
00:11:13.730 --> 00:11:17.409
it can be a little bit mystifying sometimes, right?
00:11:17.409 --> 00:11:27.090
Sometimes whatever, you know, your domain or maybe a link in your signature will get flagged on some spam engine, and it just takes a while to kind of figure that out.
00:11:27.730 --> 00:11:42.769
So yeah, it's but making sure those those three records are in place and accurate you know usually solves most of the problems with yeah, with with kind of having your mail redirected to junk.
00:11:43.730 --> 00:11:52.850
And we did a podcast a little while ago on that, so I shared that link here and it'll be in the transcript as well that just talks a lot more about what DMARC and DKIM are.
00:11:53.250 --> 00:11:53.889
Perfect.
00:11:54.129 --> 00:11:57.970
All right, so closing the gaps, the rest of the checklist.
00:11:58.289 --> 00:12:07.570
Yeah, so you know, you know, continuing our recommendations and basic controls, you know, you may have noticed a much more frequent cadence for patching and updates this year.
00:12:07.570 --> 00:12:14.289
And I would say that is a hundred percent tied to the explosion in the use of AI to find and exploit software vulnerabilities.
00:12:14.289 --> 00:12:17.649
All the vendors are scrambling to react, right?
00:12:17.649 --> 00:12:21.809
They're they're scanning their own code for vulnerabilities, stuff is getting reported, right?
00:12:21.809 --> 00:12:25.490
It's just a kind of a I don't know, free-for-all jailbreak, right?
00:12:25.490 --> 00:12:35.330
There's just lots of stuff being discovered, and so vendors are pushing updates really frequently to just kind of deal with and keep up with the flood of that.
00:12:35.490 --> 00:12:42.769
So you know, we say reboot your computer monthly, maybe you need to reboot it weekly, right?
00:12:42.769 --> 00:12:50.769
Just but it it sounds kind of silly, but checking to make sure your software is up to date and rebooting your computer regularly is a really good security practice.
00:12:50.769 --> 00:13:00.129
So make sure you're doing that on the regular and don't ignore the updates because if there's a patch released, it's usually because there was some exploit that was identified.
00:13:01.090 --> 00:13:04.610
The other note here, antivirus, anti- malware, managed and maintained.
00:13:04.610 --> 00:13:09.169
Again, you know, we have really seen a big spike in the amount of malicious activity.
00:13:09.169 --> 00:13:11.090
It's kind of being detected on endpoints.
00:13:11.090 --> 00:13:18.129
And so making sure that you have good tools in place, that they're active and they're in use and they're configured and they're updated, right?
00:13:18.129 --> 00:13:21.169
can help provide that extra layer of protection.
00:13:21.169 --> 00:13:26.769
You know, so just you know, make sure that you've got something in place and it's up to date.
00:13:27.330 --> 00:13:39.730
And then the final piece is is around you know, kind of resiliency and be able to recover if and when you know you do have some sort of data breach or data loss.
00:13:39.730 --> 00:13:48.689
and so making sure that you have a good third-party backup tool in place is key to recovery, you know, so whenever that data maybe has been lost or corrupted.
00:13:48.850 --> 00:14:04.370
So I will say, you know, Google and Microsoft, right, they both provide some basic capabilities in terms of you know, kind of trash can or you could recover some data, but that you know is limited, right, from a time perspective, right?
00:14:04.370 --> 00:14:07.409
They maybe only have 30 days worth of retention in those situations.
00:14:07.409 --> 00:14:12.450
It could also be times where you know the way data is deleted, it doesn't show up in those places.
00:14:12.610 --> 00:14:24.610
So having a third-party backup in another system that you can control and manage is key to being able to recover data in the event that it's lost or stolen.
00:14:24.610 --> 00:14:27.730
and I would also probably expand this definition, right?
00:14:27.730 --> 00:14:42.529
you know, we often think of Google and Microsoft as kind of the big ones because we're primarily focused on kind of IT and operations, but that should also extend to your website, your CRM system, your fundraising system, your finance, accounting, right?
00:14:42.529 --> 00:14:44.450
Kind of all of these applications.
00:14:45.330 --> 00:14:48.850
You know, we often think, hey, it's in the cloud, it's all taken care of.
00:14:48.850 --> 00:15:01.250
That maybe means, right, you don't have to maintain the hardware underneath of it, but it is good to clarify with your vendors, hey, what happens if you know a malicious actor gets in and corrupts a bunch of our data or deletes a bunch of stuff?
00:15:01.250 --> 00:15:02.529
Like, how could we get that back?
00:15:02.689 --> 00:15:19.649
You know, and just have you don't need to know the technical details of how all of it works, but having those kind of clear scenarios to say, how would we respond in this case or how would we respond in this other scenario can be good to just kind of confirm that things are going to work as you expect when you kind of run into that scenario.
00:15:20.210 --> 00:15:20.610
All right.
00:15:20.610 --> 00:15:26.049
And then we have a few more things on the checklist and then we'll be able to get to some recent threats.
00:15:26.610 --> 00:15:27.250
Yes.
00:15:27.250 --> 00:15:29.970
great, you know, we've talked about it a lot.
00:15:29.970 --> 00:15:31.570
You know, policies are important.
00:15:31.570 --> 00:15:43.090
And, you know, I think a lot of these were on our update, you know, two years ago, and now, you know, the addition would say here, you know, kind of is the AI acceptable use policy.
00:15:43.330 --> 00:15:51.490
So I think policies are a great way to start because they help an organization distill and define kind of what they're gonna do and how it's gonna get done.
00:15:51.490 --> 00:16:03.809
And putting things down in writing means that you'll have some discussion around maybe some assumptions that people have and conflict areas that, you know, if you're not talking about it, you know, you you can kind of ignore.
00:16:03.889 --> 00:16:15.009
And so, you know, things that often come up in organizations, it's kind of this policy exercise is good to clarify, are things like the use of personal devices to access work data.
00:16:15.009 --> 00:16:19.409
unless you've done something proactive, right?
00:16:19.409 --> 00:16:24.689
you can't necessarily wipe data from personal devices if they are lost or stolen, right?
00:16:24.689 --> 00:16:27.169
Interns, contractors, you know, right?
00:16:27.169 --> 00:16:31.169
A lot of remote staff, you know, you don't have control of the devices themselves.
00:16:31.169 --> 00:16:41.970
And so if a device is lost or stolen, it's really important that you understand what controls and parameters you have in place to protect data that may be on those devices.
00:16:43.809 --> 00:16:57.809
Understanding where your data is as an organization, what are those official systems of record, who maintains them, who supports them, what data is there, how is it archived, deleted, you know, kind of all of those questions are good to clarify.
00:16:57.809 --> 00:17:05.250
Again, with all the proliferation of SaaS applications, it's super easy for somebody to just sign up for an app, put a bunch of data in it, start using it, right?
00:17:05.250 --> 00:17:07.570
and so you have a lot of ungoverned data out there.
00:17:07.570 --> 00:17:19.090
So being clear about this is our official systems of record, here's how we're using them, here's who has access, you know, those are good conversations to have to clarify how all the workflows are supposed to happen.
00:17:19.730 --> 00:17:25.570
And with AI, it's you know, again, that you know, you we've got great templates.
00:17:25.570 --> 00:17:35.570
It's something that you need to I think work and be really flexible on, but also be kind of very don't be overly prescriptive as this is changing super rapidly.
00:17:35.730 --> 00:17:40.290
So, you know, I think in our templates, right, we like to start with what's approved and then iterate regularly.
00:17:40.290 --> 00:17:42.050
Like here's the things we're working on now.
00:17:42.050 --> 00:17:50.530
Let's kind of you know, give a use this, not that framework, and you know, make sure that it's updated regularly.
00:17:50.530 --> 00:17:53.890
So, you know, A AI is a tool.
00:17:53.890 --> 00:17:56.850
It's a tool that a lot of organizations are using.
00:17:56.850 --> 00:17:59.970
It's also a tool that you don't have to use, right?
00:17:59.970 --> 00:18:11.090
There there seems to be, you know, the feeling that, hey, everybody else is doing it, but you know, you can also take a stand to say, hey, we're not gonna use it, and and make that clear to staff as well.
00:18:11.250 --> 00:18:20.370
Like I said, in the absence of really good communication and maybe technology controls to prevent it, staff are 100% using AI tools.
00:18:20.370 --> 00:18:22.770
You know, it's something that we can see.
00:18:22.770 --> 00:18:32.850
and it's good to provide that clarity to organizations that you know that these things are in use and and they're really widespread.
00:18:34.850 --> 00:18:40.450
So you do need an AI policy, even if your policy is that you don't use AI at your organization.
00:18:40.690 --> 00:18:46.930
We've talked a little bit already about the cyber liability, cyber liability insurance conversation, right?
00:18:46.930 --> 00:18:54.770
If you don't have that protection in place already, it's a good one to start with your, I would start with your existing broker.
00:18:54.770 --> 00:19:00.850
you know, it can seem like a big new expense, but it's a pretty common policy.
00:19:00.850 --> 00:19:03.810
You probably want to bundle it with other things you already have, right?
00:19:03.810 --> 00:19:33.730
and so having that protection in place so that you know you have you know some guardrails in case your organization you know is a victim of of wire fraud or something really significant that that impacts your operations or you know protects your protects you in the event of maybe you have a data leak and right you need to provide reporting on all the people's data that you know that that was disclosed.
00:19:33.970 --> 00:19:37.650
So and then that compliance piece.
00:19:38.770 --> 00:19:39.090
Yep.
00:19:39.090 --> 00:19:44.690
So I think closing the compliance loop is you know making sure that you actually have a plan, right?
00:19:44.690 --> 00:20:00.050
So that person that or the team maybe that we identified at the start as the owner has built-in milestones that are built into their performance expectations and maybe more importantly, right, the time and support to actually do that work.
00:20:00.210 --> 00:20:08.050
You know, I think you know, in nonprofit organizations, it just seems like you know, there's always kind of more work to do and not enough time allocated for for it.
00:20:08.050 --> 00:20:16.290
but this is something that you know needs to have kind of formal recognition that this is a responsibility that this person has.
00:20:16.290 --> 00:20:20.690
And we're also gonna give them the time that they need to carry out that work.
00:20:21.090 --> 00:20:30.050
Yeah, I think that's how people or organizations get behind, is it's just something else put on somebody's plate and they didn't make any room on the table for that plate to be on there.
00:20:30.050 --> 00:20:33.010
So making sure that you're supporting that person.
00:20:33.250 --> 00:20:36.050
I'm just gonna show this example very quickly.
00:20:36.050 --> 00:20:45.970
It's an example of an IT roadmap that you might make for this person or the person might make for the organization of what you're gonna do, how urgent it is.
00:20:45.970 --> 00:20:54.930
You can you know put extra columns on here for who's gonna do it, how much it's gonna cost, when it's gonna be done by all of those pieces.
00:20:54.930 --> 00:20:58.450
And that is just like a great way to report back on your progress.
00:20:58.610 --> 00:21:04.450
So, like I said, cybersecurity can feel like you're always what running in place, like there's always more stuff to do.
00:21:04.450 --> 00:21:09.890
So, for a lot of organizations, having some kind of checklist where you're like, look at what you accomplished.
00:21:09.890 --> 00:21:13.650
You didn't have MFA a couple of months ago, and now everybody has it.
00:21:13.650 --> 00:21:16.530
So just being able to check those off is really important.
00:21:16.530 --> 00:21:25.570
and I have a link here that I can share with you about creating an IT roadmap, which could include security.
00:21:25.570 --> 00:21:27.330
You can do it just for security.
00:21:27.650 --> 00:21:33.170
I want to move a little bit quickly through some of these other levels that are in the Playbook.
00:21:33.170 --> 00:21:39.410
If you've downloaded the Playbook, you'll see these other levels, but again, do a risk assessment first.
00:21:39.410 --> 00:21:43.810
Cybersecurity is a journey, not a destination.
00:21:43.810 --> 00:21:50.050
Developing that roadmap, being intentional about improving your cybersecurity will help reduce your risk.
00:21:50.050 --> 00:21:52.770
So it is very worth putting the effort into.
00:21:52.930 --> 00:21:58.370
And I went through that quickly because I wanted to be able to get you to like weigh in on this, Matt.
00:21:58.370 --> 00:22:02.370
So some new twists on some old cybersecurity attacks.
00:22:03.090 --> 00:22:13.090
As we talked about, right, phishing and account compromise, right, and user targeted things are the main are, you know, continue to be the main point of attack for for scammers in in 2026.
00:22:14.530 --> 00:22:18.290
And you know, viruses are back, they're worse than ever.
00:22:18.290 --> 00:22:38.690
you know, there's lots of really sophisticated ways now that adversaries are able to yeah kind of pull on those levers right to get people to to you know click on the link to you know provide that MFA code you know to kind of do the work you know kind of do the work so to speak for them.
00:22:39.250 --> 00:23:10.450
And so you know we certainly see that a lot we've had you know a couple of recent account compromises in both cases they were organizations that didn't have third party spam filtering and you know they got some very convincing messages that they clicked on and then they got forwarded around and it's like it just ends up being a real mess to to try to clean up. S o again the sophisticated email attacks are are you know continue to be very effective for these threat actors.
00:23:10.850 --> 00:23:16.610
I think the new things that we are seeing is that right phishing doesn't always you know kind of come as that link.
00:23:16.610 --> 00:23:25.650
We're starting to see stuff like calendar invites come in, you know, they kind of land and they you know kind of kind of go around a lot of the spam filtering tools.
00:23:25.650 --> 00:23:40.770
You know things are often you know shared as a document and then they have the instructions in the document that kind of conveniently tell you you know how to you know copy and paste maybe a code that's going to allow somebody else to access your system.
00:23:40.930 --> 00:24:02.370
So you know being cautious of you know kind of how you're receiving those even if it's from somebody that you know because it is likely that you know their account could have been compromised and kind of then used to target and pivot to other you know to other email you know kind of contacts that are in that organization's domain.
00:24:04.450 --> 00:24:23.810
We're also seeing you know like I said wire fraud is you know continues to be kind of the big right at the end of the day the amount of financial you know fraud that goes on is is really the main driver and that continues to increase year over year.
00:24:24.050 --> 00:24:47.090
And you know that you know I think gets carried out through a number of different ways from phone calls to updating invoices to payment change requests and so you know all these different methods are kind of new spins on old techniques you know fundamentally designed to get access to banking information that they are not supposed to have.
00:24:47.250 --> 00:25:16.370
And then you know we have the last item here right as attacker in the middle attacks continue . And so you know that is where you get a link it looks realistic it even looks like your Office 365 or Google sign-in page but it's going through an attacker's an attacker's kind of framework and so they're actually able to steal your session right they're not taking your password so to speak but they effectively have what they need to appear as you.
00:25:16.380 --> 00:25:26.210
A nd so that's why we are making that push to switch to phish resistant passkeys or security keys as a way to kind of mitigate that risk.
00:25:28.850 --> 00:26:02.850
The next slide you know kind of continuing on some of these other attacks that we are seeing you know are you know kind of job posting HR scams that impersonate your organization. W e're starting to see you know kind of more around deepfakes usually starting to get something out of your organization like money or access but you know many nonprofit organizations are also concerned about deepfakes that would cause you know represent representational harm a reputational harm, by you know misrepresenting policies or staff members' views.
00:26:02.460 --> 00:26:12.770
S o you know there's lots of things to be concerned about in terms of protecting your organization's identity and trust that you've built up over time.
00:26:13.500 --> 00:26:28.610
And so you know these are just kind of new technology tools that are available and organizations are going to need to find ways and strategies to kind of verify and validate and be able to provide assurance that you know the content that you're putting out you know is in fact is in fact you.
00:26:29.890 --> 00:26:40.210
The other piece I did want to highlight here is that you know a lot of this is kind of technology and kind of delivered you know kind of over the over the internet, right?
00:26:40.210 --> 00:26:43.250
Email, you know, web attacks so on and so forth.
00:26:43.490 --> 00:26:52.290
But we've also seen what maybe seem like throwback attacks around wire fraud that's initiated over the phone first.
00:26:52.290 --> 00:27:20.370
Maybe that ties into some of these deep fake capabilities right to to to let people, create you know more polished you know conversational tone and so we have seen or have heard reports where you know the the bank so to speak right calls in to verify some information and and they're able to kind of convince or or kind of get that information from people on on staff.
00:27:19.980 --> 00:27:37.890
A nd so again there's some technology tools that you can have in place maybe to prevent some attacks there's some training tools or if there's some process tools and so uh viewing this as as a holistic perspective on how to protect your organization is going to involve more than just you know buying the spam filter right?
00:27:37.890 --> 00:27:48.130
it's gonna also involve talking about how do we make banking change information that's a conversation you need to have internally and it's a conversation to have with your financial institution as well.
00:27:48.530 --> 00:28:02.450
I want to make sure we talk about that last bullet point because I know we have legal people attending, so I had never heard of this DMCA copyright infringement notices that are fake.
00:28:02.450 --> 00:28:04.610
And so what what is that?
00:28:05.330 --> 00:28:27.970
Yeah so it's a it's kind of a technique you know that actually I think has been in use for a while where you know the Digital Millennium Copyright Act I think you know is a real is a real piece of legislation that's designed to protect those people with digital copyrights, to say hey like you know you can't just use my you know audio or images or whatever without attribution.
00:28:27.020 --> 00:28:44.290
B ut it can also be used and manipulated to create a realistic kind of legal sounding threat that again is just trying to get you to make a payment to a fraudster you know because of some vaguely worded you know kind of legal threat, right?
00:28:44.370 --> 00:28:57.170
I think as soon as everybody's like oh the lawyers are involved I'm getting this you know this legal you know sounding message I need to comply with it, and so again treat those with caution.
00:28:57.170 --> 00:29:15.250
It's not to say right you just want to delete everything because it's 100% a scam that's not true, right, there could be legitimate communication that you're getting because you know somebody accidentally you know or you know didn't didn't get the correct permissions to use a certain piece of media on a website or an appeal.
00:29:15.330 --> 00:29:34.770
So there could be legitimate cases where you receive these takedown notifications but it's also I'd say primarily used by scammers as a way to just kind of worm their way into your organization and you know put up a dollar amount right there it's like oh well it's just cheaper to pay this than to talk to our lawyer about you know whether we should or not.
00:29:35.010 --> 00:29:38.770
So it's just amazing what they will come up with.
00:29:38.770 --> 00:29:39.970
And I mean using that.
00:29:40.050 --> 00:29:46.130
I think one of the things that we teach in that awareness, cybersecurity awareness is look at your emotions.
00:29:46.130 --> 00:30:03.010
Are you, is it trying to appeal to fear or shame or you know some other you know like quit embarrassment, doing something quickly with urgency and just be aware of how you're reacting to something, and have that trigger you to think wait should I be worried about this or not?
00:30:03.010 --> 00:30:04.450
Are they just trying to get me?
00:30:04.930 --> 00:30:09.730
So unfortunately we're kind of running out of time for the QA.
00:30:09.730 --> 00:30:20.130
So what I'm gonna propose Matt is that we just go over to Reddit after this and so if you have more questions go ahead and join us on Reddit over there and Matt will be there to answer questions.
00:30:20.530 --> 00:30:34.210
I wanted to make sure to go back over our learning objectives we had for today which was that you know learn our basic approach to cybersecurity understand the new threats in the age of AI we've talked about many of them.
00:30:34.220 --> 00:30:41.330
A nd I think you know there's kind of a theme of if AI can make it convincing a scammer is gonna do that.
00:30:41.330 --> 00:30:55.410
So there are going to be new brand new things - like doing those patches right away keeping an eye out for stories that are coming out about you know new scams that are coming out is just really - it's changing so quickly so keep an eye on that.
00:30:55.730 --> 00:31:01.650
Learn the foundational level that we recommend that is in our basics download it's also in the Playbook.
00:31:01.650 --> 00:31:12.290
And then the takeaways is you know kind of those first steps and best practices in managing cybersecurity at your nonprofit we shared that checklist that you can use, it is in the basics download that you can use.
00:31:12.290 --> 00:31:15.810
And here are those two links again to the URLs.
00:31:16.210 --> 00:31:29.170
Before you go I want to make sure to invite you back next month for our final webinar of 2026 and this is a you know just a little topic a little you know side note should your nonprofit use AI?
00:31:29.170 --> 00:31:31.330
So this is a question we get asked a lot.
00:31:31.330 --> 00:31:34.530
It's out there in the nonprofit environment a lot.
00:31:34.690 --> 00:31:38.530
We're gonna do a kind of different format with this webinar to talk about it.
00:31:38.530 --> 00:31:55.250
I'm gonna be joined by Steve Longenecker who's our director of IT consulting and Nuradeen Aboki who's our senior consultant both of them have worked with a lot of clients on AI and AI implementation and readiness but they've also worked with clients that don't want to do AI.
00:31:55.330 --> 00:32:05.890
So we're gonna answer five or six common questions that nonprofits have about AI, starting with that existential one, moving on to readiness, security, impact.
00:32:05.890 --> 00:32:11.250
The three of us have very different experiences with AI tools and with the ways our clients use them.
00:32:11.250 --> 00:32:12.610
We don't always agree.
00:32:12.770 --> 00:32:27.490
So I'm really looking forward to this conversation it's gonna be at 3 p.m eastern noon Pacific on Wednesday November 18th please join us and we if you submit your questions at registration we might answer one of them on our panel.
00:32:27.490 --> 00:32:33.490
You can register now on our website at communityit.com and I'm putting that in the chat as well.
00:32:33.490 --> 00:32:35.410
So go ahead and register for that.
00:32:35.570 --> 00:32:47.250
Don't forget as you exit the webinar today to take our short survey one lucky winner chosen at random receives a $25 gift certificate for helping us learn how we're doing join us over on Reddit.
00:32:47.250 --> 00:32:49.650
Matt's going to answer some questions over there.
00:32:49.890 --> 00:33:02.850
Matt, I want to thank you so much for your time today and for all your work on helping update this Playbook and develop the basics download so that you know our community really has what they need to get started.
00:33:02.850 --> 00:33:12.770
Cybersecurity can be so lingo ridden and emotional you know, it's you want to put it in the in the drawer and just not worry about it.
00:33:12.930 --> 00:33:18.050
So really appreciate your time and helping inform us and help us educate ourselves.
00:33:18.050 --> 00:33:34.130
I want to appreciate everyone on the webinar today your gift of an hour with us is something we don't take lightly you're in the right place you're worried about cybersecurity and getting better at it getting better at it is something that we really believe all of us can do.
00:33:34.130 --> 00:33:42.130
It is not beyond you so go ahead and download these free guides and Matt thank you again so much for your time today.
00:33:42.610 --> 00:34:07.810
Yes thank you Carolyn and and I'll just yeah highlight you know my meeting information is up it was posted there again there's lots of stuff that you know you can read and try to understand but I'm also happy to yeah have a short conversation and just clarify some of those questions that yeah that that that come up it's really important for us to help build that foundational knowledge around protecting your organization's data from all the threats that are out there.
00:34:07.810 --> 00:34:16.449
Yeah we just want the nonprofit sector to be doing this as well as we can, so thank you again and we will see you over there on Reddit.
00:34:16.530 --> 00:34:29.570
Thanks everyone thank you for joining this Community IT podcast part two you can find part one in your podcast feed if you subscribe wherever you listen to podcasts
