Cyber readiness resources for charities

To create a robust password, follow these four steps:

Use unique passwords for each service (work, email, social media, banking etc)

Opt for longer passwords; 24 characters is ideal

Craft memorable phrases (passphrases)

Mix capital letters, numbers and symbols when making your phrases (e.g. Ba8ysF1RSth0L!daywA5FUn)

Store passwords securely by utilising password managers or store them in a secure offline location away from devices if you have to.

Click here to learn more

Adding extra layers of protection to your accounts is now a necessity

Your username and password alone are no longer sufficient for securing your accounts. While it adds an extra step, it can act as a safeguarding factor by using other forms of identification that cybercriminals will not know or have access to. By setting up MFA you can use:

Something you know: password, memorised pin

Something you have: unique SMS code, authenticator app

Something you are: facial or fingerprint recognition (biometrics)

Click here to learn more

Updating software for security is often referred to as 'patching'

One of the most common ways cybercriminals gain access to systems is by exploiting gaps in outdated software. When a vulnerability is discovered, developers work to create a patch that closes the hole. This is deployed through software updates which is why it's so important to stay on top of them. 

Turn on automatic updates

Shut down laptops and computers; closing the lid will not allow updates to take place

Don't ignore or postpone them. Install them as soon as they become available

Click here to learn more 

In the event of a incident, you should have peace of mind that your data is still accessible somewhere, somehow. 

Incident recovery involves restoring backed up data, so ensuring regular, tested backups is key. A good rule to follow is the 3-2-1 backup rule to increase your data's protection: 

Always keep 3 copies of your data 

Use at least 2 different media types (e.g. cloud, data centre)

Keep 1 offline copy at an offsite location. 

Another great thing to do is ensure you have automatic backups enabled on your devices and frequently test if you can successfully restore your data.

Risks can arise offline too. Protect your IT equipment when outside the office.

If you are in the office, try to adhere to a clear desk policy or store your necessary, sensitive files and equipment securely. 

Do not write down sensitive information or passwords. Use encrypted, online data storage tools. 

Consider encrypting device storage using BitLocker or FileVault for added data. security, especially for larger IT estates.

Keep equiptment hidden and secure with locks or access controls when not in use.

People are central to your organisation, but they can also be a big risk factor.

Staff at all levels should engage in cyber security training to avoid human error and this can be done in a number of ways.

• Regular refresher training.
• Simulated phishing exercises.
• Enrol staff in modern training plans.
• Promote the use of the free online cyber security resources that are available to them. 
• Allow your staff time to engage and invest in their education.  
• Remove unused accounts for inactive or old accounts
• Reduce access rights, so only the authorised people have access to privileged information and data

With employees potentially working all over, it's essential to centralise and define security measures to mitigate the potential risks of remote working. 

Enable data encryption on devices.

Any devices used when working from home should be set up with mobile device management for remote wipe/lock.

Ensure VPNs are updated and well-equipped, and store devices safely. These allow remote workers to securely access your IT systems.

Promptly report lost or stolen devices for swift action.

Ensure staff are regularly trained on cyber security risks and measures. 

Communicating with your team mates online, or even with family and friends, has become part of our day to day.

To stay safe while doing so, consider the following: 

Only download software from trusted sources.

Review privacy settings and opt out of data sharing.

Use strong passwords and enable MFA.

Mind your surroundings, consider blurring backgrounds.

Keep calls private, use lobby or passwords to control access.

Phishing attempts can come in many forms, most predominantly via email. Here’s what to check:

• Is the greeting personal or generic?
• Are there grammar and spelling errors?
• Are the email and sender domain matching?
• Are there suspicious attachments or links?
• Evaluate logo and graphics quality. Does it look legit?
• Is there a sense of urgency or threat?
• What are they asking for? Caution any requests for personal info/payment details as official organisations will never ask for these. Call the company to verify if in doubt.
  
•  

If you're in doubt, and it looks too good to be true, do not engage with the content. On some email accounts, there is an option to report Phishing attempts directly, so it's a great idea to use this in that instance. 

Click here to learn more about phishing