Training Nonprofit Employees to Combat Hackers

Introduction:

To ensure the effectiveness of your nonprofit organization's cybersecurity program, it is crucial to properly train your employees. Their actions, such as visiting risky websites, mixing personal and work accounts, and falling for social engineering schemes, can inadvertently open doors for hackers. By providing comprehensive training for both new hires and long-term staff, you can protect your organization from cyber threats.

The Leading Cause of Data Loss:

Studies have shown that employee negligence is the primary cause of data loss incidents. In fact, nearly 60% of organizations experienced data loss due to employee mistakes involving email in the previous year. This issue becomes even more critical with the rise of remote work, which is increasingly common for nonprofits. The number of remote workers in an organization has been found to have a strong correlation with the cost of a data breach. However, certain factors, such as employee training, have been associated with lower-than-average breach costs.

The Threat of Social Engineering:

One of the most significant cybersecurity threats to your organization is social engineering. It is crucial to make social engineering attacks, including phishing schemes, a central focus of your employee training. Cybercriminals employ social skills to obtain data or compromise networks in these attacks. According to the Ponemon Institute, phishing alone accounts for 16% of data breaches. However, phishing is just one example of the social engineering threats your employees might encounter. Other techniques like vishing (voice communication-based attacks) and smishing (SMS messages with dangerous links) can also be used.

Promoting Safe Technology Practices:

Another common risk arises when employees mix business and personal accounts, information, and devices. It is essential to explain why conducting business activities on personal devices, sharing hardware between personal and work devices, or downloading software from unknown sources is risky. Creating a culture of safe browsing becomes particularly important with the prevalence of remote work. Employees should be cautious about suspicious attachments and links and encouraged to use a virtual private network (VPN) when accessing the organization's systems to establish a secure, encrypted connection that protects data from cybercriminals.

Training Format:

While the content of employee cybersecurity training is critical, the format is equally important. One-sided lectures and slide shows are unlikely to engage or leave a lasting impact on the audience. To ensure that employees are ready to apply the lessons learned, opt for interactive training methods. For example, incorporate simulations during or after training sessions, allowing trainees to put their knowledge to the test. Real-time assessments conducted during work hours can provide valuable insights into employees' retention of actionable knowledge compared to a standard quiz during training.

Addressing Security Incidents:

Despite best efforts, if your network falls victim to a hacking incident, it is crucial not to handle the situation on your own. Work with security experts to repair the damage and regain control. If you require assistance in creating a more risk-averse environment or strengthening your cybersecurity measures, do not hesitate to seek external help.

Conclusion:

Training your nonprofit employees to combat hackers is essential for safeguarding your organization's cybersecurity. By implementing a comprehensive training program, focusing on social engineering threats, promoting safe technology practices, and utilizing interactive training methods, you can empower your employees to be the first line of defense against cyber attacks. Remember to continuously update and adapt your training program to address emerging threats. Together with other cybersecurity measures, a well-trained workforce will significantly enhance your organization's security posture.

How HoganTaylor Can Help

The HoganTaylor Nonprofit team of business advisors and CPAs is comprised of former CFOs, controllers, and industry experts with extensive experience providing the guidance organizations need to lean forward again in their leadership. If you have any questions about this content, or if you would like more information about HoganTaylor’s Nonprofit practice, please contact Jack Murray, CPA, Nonprofit Practice Lead.

INFORMATIONAL PURPOSE ONLY. This content is for informational purposes only. This content does not constitute professional advice and should not be relied upon by you or any third party, including to operate or promote your business, secure financing or capital in any form, obtain any regulatory or governmental approvals, or otherwise be used in connection with procuring services or other benefits from any entity. Before making any decision or taking any action, you should consult with professional advisors.