This article was originally written by Avanade alum Cory Missimore.

Like many other businesses, nonprofits, including charities, non-governmental organizations, and private foundations, are recovering from the economic and personal impacts of COVID-19. A survey conducted by a partnership between the Federal Reserve System’s community and development function and other national partners such as the National Council of Nonprofits and NeighborWorks, found that:

• Almost 70% indicated COVID-19 significantly disrupted the entities they represent during the peak of distress.
• Almost 70% of respondents indicated that demand for their services increased compared with pre-pandemic levels.
• Slightly less than half (46%) noted a decrease in ability to serve their clients and communities with nearly 70% indicating that their expenses had increased compared to pre-pandemic levels.
• 60% of those respondents indicated their entities could operate for less than a year in the current environment before exhibiting financial distress.

Further preventing nonprofits from accomplishing their objectives is the increasing threat from cyberattacks. In Microsoft’s Digital Defense Report 2022, think tanks/NGOs were the second most frequently targeted industry. Cybercrime continues to rise as the industrialization of cybercrime lowers the skill barrier for new attackers. A 2021 Cybersecurity Guide for Nonprofit Organizations noted that up to 70% of charity networks lack a comprehensive vulnerability assessment to determine risk.

Nonprofit organizations are a lucrative target for cybersecurity attacks, due in part to the sensitive information they possess on their donors, volunteers, and employees and the limited cybersecurity resources in place.

And while recovering from COVID-19 and mitigating cyberattacks might seem daunting, there is good news: Nonprofits can deploy a variety of measures proactively, utilizing the latest in advanced automation and threat intelligence, to help identify and address security risks in their ecosystem. Following the next steps below will help you better secure your nonprofit’s cyber ecosystem.

Knowing your areas of risk
Knowing what to protect and how to best protect it are the first steps in securing your cyber ecosystem. Start by performing a cybersecurity assessment.

• Know what data is collected, how is it accessed and managed, and who is responsible for it is required to protect it effectively.
• Understand where and how your nonprofit operates and what laws, rules, standards, or regulations you may be required to adhere to. According to the National Council of Nonprofits, in the United States there are 47 state laws regarding nonprofits and data breach requirements, and 31 state laws on data disposal. This provides your nonprofit with strategic intelligence of your cyber ecosystem. Next you must have tactical intelligence. Conduct Cyber Threat Intelligence (CTI), an evidence-based way to understand the nature, scope, and severity of current and future cyber threats facing your organization. This enables you to prioritize your cybersecurity investments through identifying vulnerable assets, determining appropriate security controls, and enabling a secure cyber incident response plan

Nonprofits can obtain CTI on their ecosystem using Microsoft Sentinel, a cloud native Security Information and Event Management (SIEM) solution. Sentinel’s CTI, also known as tactical intelligence, reviews artifacts such as URLs, file hashes, or IP, uses advanced automation to address identified threat activities such as phishing, botnets, or malware against security products in your ecosystem.

Doing more with less
Today, it is nearly impossible to think of cybersecurity, or IT in general, and not include automation. Automation allows nonprofits the ability to accelerate productivity at scale while being secure and compliant. From a cybersecurity perspective, automation focuses on Security Orchestration, Automation, and Response (SOAR). Microsoft’s Sentinel is a SIEM/SOAR solution. Automation comes in the form of rules and playbooks. Through automation rules, you can automate responses outside of a playbook, from tagging, assigning, or closing out incidents, assigning tasks and simplifying workflows when responding to incidents.

With Sentinel playbooks (a collection of procedures that can be run from Microsoft Sentinel in response to an alert or incident), you can use them to automatically assign incidents to the right personnel, close noisy incidents or known false positives, change their severity, and add tags. Setup correctly, this is done automatically, saving valuable time and resources if an incident occurs. Using best practices for security operations saw a 70% reduction in the amount of time it takes for an organization to identify, analyze and begin mitigating security attacks.

Trust your identity fabric
One of the most virulent cyberthreats facing nonprofits is phishing attacks and compromised identities. Phishing and password-based attacks remain the main source of identity compromise, but other types of attacks are emerging. Therefore, protecting your users (donors, volunteers, and employees) – and your reputation – is paramount.

Services like Microsoft Entra will verify all types of identities, secure, manage, and govern those identities across hybrid and multi-cloud environments and simplify the user experience with real-time intelligent access decisions. Strong authentication, conditional access capabilities and multi-factor authentication are needed. Sophisticated attacks continue to rise, underscoring the need for phish-resistant factors of multifactor authentication. However, these measures will not be sufficient alone.

Encrypt, encrypt, encrypt
Technology is advancing at an exponential rate. While society and communities benefit from its advancements, so do cyber criminals. Quantum computers, machines using the properties of quantum physics to store data and perform computations, are opening new horizons for data encryption and processing. However, this means that even encrypted data is not 100% secure. Cybercriminals can obtain encrypted data and then use quantum computing capabilities to exploit it. Nonprofits should be prepared to use different public key algorithms for encryption, key exchange, and signatures.

Technology is advancing at an exponential rate. While society and communities benefit from its advancements, so do cyber criminals. Quantum computers, machines using the properties of quantum physics to store data and perform computations, are opening new horizons for data encryption and processing. However, this means that even encrypted data is not 100% secure. Cybercriminals can obtain encrypted data and then use quantum computing capabilities to exploit it. Nonprofits should be prepared to use different public key algorithms for encryption, key exchange, and signatures.

Training matters
All the security tools and configurations in the world cannot stop a resolute attacker, or a moment of human error. Training your employees in security and privacy on a technical, operational, and strategic level is the foundation to an enduring and adaptable posture for nonprofits. Additionally, your users should also be aware of common and up-incoming attack strategies and methodologies. This ensures a level of confidence and transparency in your cyber ecosystem, critical to a nonprofit’s success, is earned and maintained.

Following these steps will further support your nonprofit in fulfilling its mission while securing the ecosystems and maintaining operational costs to a minimum. Protecting and automating your cyber ecosystem will allow you to continue to do work that matters. In our next blog we will discuss how the cloud can provide a secure ecommerce location, built on financial automation capabilities supported by learning and management system functionality.

Find out how Avanade is enabling clients to build resilience and minimize the impact of security incidents.