A smart cybersecurity checklist can be your first step in protection against cyber threats. We all know that we’re living and working in a fast-growing, ever-changing world of tech. And though we’re not all IT experts, we must be aware of how to keep ours and other people’s data as safe and secure as possible.
Data Protection Against Cybercrime
It’s not a secret that people across the world use technology in every aspect of work and life. To keep up, your religious organization must reach beyond its physical walls. That’s where technology can help out a lot. In fact, if you’re not using it already then you’re being left behind. But, while using technology offers great opportunities, it also presents new risks. Hackers and human error can cause a major disruption in your best efforts to serve your community.
Churches, schools, and nonprofits of all sizes may dismiss their organization as a target of hacking attempts. After all, don’t hackers go after large businesses and government entities? In fact, the opposite is true. These entities don’t see themselves as targets which makes them prime prey. A cybersecurity checklist is a good start in your awareness.
With this in mind, there are things you can do and precautions you can take to protect against cybercrime. At Beacon, we have years of experience in offering clients guidance and protection. Helping them to shield assets, employees, and members against risks of all kinds. And, taking measures for cybersecurity is a crucial part of helping protect them in every way possible.
Your Cybersecurity Checklist
At Beacon Insurance Agency, we know firsthand how busy church leaders are. It is also daunting to make sense of all the new information on internet security. That is, how to keep your complete online and digital presence safe and secure. That’s why we created this in-depth cybersecurity checklist. Here in Pensacola, Florida our city government was cyber hacked in a scheme so large that it caught the attention of national media outlets.
We recommend to our clients that they meet with an IT specialist in reviewing their cybersecurity checklist. This is to make sure that IT security policies have been properly put into place. In your discussion, ask questions and explain your process so you have a rough idea of how things might work. Here are important actions you can take for effective IT Security:
Cyber team and team leader
One of the most valuable measures is for you to create a cyber safety team that has a clearly defined leader. The leader is the one who handles, strengthens, and enforces cybersecurity policies. Also, all employees should be made aware of how crucial it is to maintain information security.
Firewall protection
A firewall filters incoming traffic and manages outbound traffic on your network. This prevents unauthorized access of the network from hackers on the internet. It also controls what websites can be accessed from your network. In essence, firewalls are the first line of defense against potential external threats. They can also be configured in such a way to filter traffic according to certain defined factors.
Antivirus protection
Installing antivirus software on all computers and servers on a network is important. So is running frequent updates on virus definitions on the software. This helps protect against threats that might have gotten by the firewall or introduced by some other means. This is often a neglected part of a cybersecurity checklist.
Password security
Creating passwords that are complex is essential in protecting computers and networks. Sometimes overlooked, a week password is easy to compromise. A common mistake is people make their password simple so they can remember it. But, it’s far better to write it down and keep somewhere secure for easy reference.
Be sure to use special characters in your password like @, !, #, %, or ^ and mix in some upper and lower case letters. Stay away from birth dates, consecutive numbers, or using easy to guess words like “water”. Also, change the passwords every 90-days or when an employee is no longer employed there. All employees should be well educated on the importance of maintaining strong passwords. And, don’t use the same password for other logins.
Wireless networks
Use of non-secure Wi-Fi networks for work should be strictly prohibited. Unsecure Wi-Fi creates a significant point of vulnerability to data viewed or transmitted. If you offer public Wi-Fi, be sure to warn users that it’s not secure and to not use it for anything that is private. This is a must for any cybersecurity checklist.
Operating System and software updates
Software updates, when released, should be installed on all computers and cell phones. These updates will patch vulnerabilities as well as repair software errors. Although people often forget this task, it will greatly reduce the risk of a breach.
Unified Threat Management (UTM) tools
A UTM has many tools used to prevent a multitude of common security threats. This includes such things as firewall, antivirus protection, anti-spam capabilities, and content filtering. One of the great features of a UTM is that it’s simple to install and manage.
Data encryption
Email messages and data drives should be encrypted using the Advanced Encryption Standard (AES). This will ensure that information is secure if the device on which it is stored is stolen or tampered with.
Data backup
Incremental data backups should be conducted on a regular basis. Also, full data backups should be done periodically. All backup files should be stored in a safe, secure location that is separate from the original files. Backup recovery procedures should be implemented as well. In the event of a cyber incident, access to uncorrupted files on a backup become invaluable. Should a complete system failure occur, backup servers should be available to ensure that business can proceed.
Data retention
Digital files that are covered by a retention policy should be classified and given defined timelines for storage. In addition, old or outdated files should be destroyed periodically using clear procedures. This helps to ensure that sensitive and classified information is not compromised. This is often omitted from many cybersecurity checklists.
Vendor/contractor management
First, security practices of the vendors and contractors holding your data should be reviewed. Second, contracts should made to establish terms of liability in the event of a data breach. Though using off-site storage is often necessary, these third parties are also at risk of a breach. You could be held liable if this information has been compromised. With a contract, you can define them as the liable party if such circumstances should arise.
Human resource management
Train employees and enforce end-user computer policies for them to follow. Limit employee access to data and systems and monitor employees when they are on the network. Further, establish rules for the use of mobile devices like laptops and cell phones. Immediately report any lost or stolen mobile device and hardware like thumb drives. Also, make sure they are encrypting data that is being transmitted or stored. This includes all remote workers too. Taking such steps with your employees ensures that security procedures are well defined from day one.
Moreover, tell the employee of the penalties in putting your security at risk. When an employee leaves or gets fired, remember to reiterate this in their exit interview. Don’t forget to disable their user account, get back company data files, and change all passwords for shared accounts.
Computer log files
Log files are beneficial in determining when a cybercriminal had access to your network. They also show what they might have seen or done in the event of a breach. Log files should be on all servers and routinely checked to ensure that information is being properly recorded.
Top 3 Internet Security Threats to Religious Organizations
In addition to this cybersecurity checklist, below are the top 3 internet security threats to all churches, private schools, and nonprofits.
- Phishing Attacks
This begins by getting a deceitful email in your inbox, a text message from an unknown number, or a spam phone call. A cybercriminal tries to impersonate a trusted entity and is often very talented at it. This can be convincing especially to church staff who are more trusting than others. They are able to trick people into giving sensitive info like login or financial details. A phishing attack usually leads to security breaches, financial theft, and malware installation. - Ransomware Attacks
This starts when a computer gets infected with malicious software or malware. Malware is easily introduced into any organization through phishing emails. Also, it can get on a computer by unknowingly visiting an infected website. This software denies access to important data files until a ransom is paid. The attack can disrupt church services, online giving, and communications until payment is made. It also leads to major financial loss in paying the ransom and/or data recovery service. - Data Breaches
This can happen when a computer has been hacked due to weak security or an insider threat. Most churches receive and store personal information about their members. Contact details, financial donation history, and sometimes even more sensitive data than that. A data breach is when an unauthorized person gets access to this information. This can lead to identity theft for members and legal liabilities for the church. Not to mention damage to the church’s reputation and a loss of trust within the congregation.
Pre-planning for a Cybersecurity Incident
Your cybersecurity checklist is a great start. Next, make sure you pre-plan with precautionary measures before a cybersecurity incident occurs. Also, meet with your IT team to have a Cyber Incident Response Plan put into place just in case.
Consider Church Cyber Insurance in Your Cybersecurity Checklist
No matter how strong your cybersecurity may be, it’s impossible to be financially protected from cyber crime. For this reason, you need cyber liability insurance on your church, school, or nonprofit. Just like you need insurance to protect your property and your employees. Cyber insurance helps protect you against losses from cyberattacks and security breaches.
Conclusion
We truly hope that reading this article and using the cybersecurity checklist helps your organization. Your efforts show your commitment in protecting the resources and data that’s entrusted to you by others. Remember, you’re mitigating risk as well as making a more secure and trustworthy place for others. One that is necessary for your ministry to thrive. So, embrace this opportunity to be a wise steward of your data in this digital age. Doing so helps ensure your organization continues to shine its light for years to come.
Experience You Can Trust
Since 2009, Beacon has helped countless churches in Florida and Alabama. We offer custom insurance plans to meet the unique needs of their organization. Also, our partnership with GuideOne allows us to provide invaluable resources. Resources that help them navigate the risks they face in this unpredictable world. Our greatest service is in meeting the needs of those called to make a change in people’s lives. Call us at (850) 994-7944 or send us an email on our Contact Us page. We can review your existing insurance policy and discuss the cost of securing new or adding insurance coverage.
