WEBVTT

1
00:00:02.990 --> 00:00:20.809
Neon One Webinars: Hey, everybody, it's good to see you all logging in. Will you do me a favor? If you can hear me, let me know that you can hear me in the chat box. I am not in my normal office setup, and I do not have anyone to give me a sound check, so if you can hear me, I would appreciate it. Thank you, Pat.

2
00:00:20.810 --> 00:00:32.350
Neon One Webinars: Wendy, amazing. Thank you so much. I am so excited that you guys are here. Let me know where you're tuning in from. I'm usually in Central Florida. I am up in Michigan right now. I am not accustomed to the cold.

3
00:00:32.580 --> 00:00:34.609
Neon One Webinars: At all, and it's not even that cold.

4
00:00:34.750 --> 00:00:36.410
Neon One Webinars: I'm freezing, though.

5
00:00:37.640 --> 00:00:47.719
Neon One Webinars: Oh, Wendy is laughing at me. Wendy's in Anchorage. Yeah, I am used… it was, it was 107, that was the heat index when I left Florida, and it was…

6
00:00:47.980 --> 00:00:54.059
Neon One Webinars: 50 last night. So your girl is struggling. Pat knows the Pat knows the deal.

7
00:00:54.710 --> 00:01:01.820
Neon One Webinars: Near Austin, Texas, originally from Michigan. Yeah, same struggle, I'm sure, but probably in reverse. You probably had to get used to the heat.

8
00:01:02.930 --> 00:01:09.720
Neon One Webinars: Alright, let me get this ready for you. Let me share my screen.

9
00:01:11.780 --> 00:01:26.860
Neon One Webinars: Okay, thank you everyone for joining today. I know that donor data security is not the most titillating topic, but it is an extremely important one, so I really appreciate you being here with me.

10
00:01:26.860 --> 00:01:34.820
Neon One Webinars: If we haven't met before, my name is Abby. I've been in the nonprofit tech space for a little over 13 and a half years now.

11
00:01:34.820 --> 00:01:49.470
Neon One Webinars: So I've gotten to be really passionate about understanding donors and what they want from the nonprofits they support and what that means for you and your fundraising. But because I've been in the nonprofit technology sector for so long, I've also gotten to learn a lot about cybersecurity.

12
00:01:49.470 --> 00:02:00.929
Neon One Webinars: And steps that nonprofits can take to keep themselves and their donors' information safe. So I'm really happy that you all are here to talk with me today about this important, but not necessarily, like.

13
00:02:00.960 --> 00:02:02.649
Neon One Webinars: Super cool topic.

14
00:02:02.920 --> 00:02:20.669
Neon One Webinars: Just a quick note, this is going to be useful to you regardless of what platform you're using. If you're using Neon One or any of our tools, all of these tools and practices and tips are going to work for you, but they're going to work for you regardless of who you're using, so just keep that in mind.

15
00:02:21.030 --> 00:02:36.760
Neon One Webinars: Couple little housekeeping things. You may have noticed that I like you to talk to me in the chat. I've got you right over here. Do please talk to me in the chat. I'm gonna ask you some questions. I would like to understand where you are and where you're coming from, and I'll kind of adjust my content accordingly.

16
00:02:36.810 --> 00:02:53.229
Neon One Webinars: That said, the chat can move really fast. So if you have a question that you'd like me to answer at the end, please try to drop it in the Q&A box. That doesn't move as quickly. It's easier for me to track questions. So I will see it for sure if you put it over there. Okay.

17
00:02:53.450 --> 00:03:04.769
Neon One Webinars: just to kind of gauge how comfortable you are with the topic after that little prelude. Will you let me know in the chat how comfortable you are on the topic of

18
00:03:04.810 --> 00:03:16.700
Neon One Webinars: Donor data protection and cybersecurity. Are you familiar with the basics? Are you an expert? Are you… this is completely new to you? Let me know.

19
00:03:16.740 --> 00:03:20.179
Neon One Webinars: Eli is ready. Bring it on.

20
00:03:20.400 --> 00:03:36.540
Neon One Webinars: Bring it on. Oh my gosh, still learning. Okay, so Wendy and Eli, I hope you, like, share… newbie, great. I hope the experts here share not only with each other and with everyone else here, but with me. I'm always learning something new.

21
00:03:36.540 --> 00:03:42.179
Neon One Webinars: Especially because the world of cybersecurity can change so rapidly.

22
00:03:42.180 --> 00:03:50.149
Neon One Webinars: So I'm glad that we have a good mix here, and I hope that we all talk to each other in the chat, because it sounds like we can all learn a lot from each other.

23
00:03:50.560 --> 00:04:05.899
Neon One Webinars: The reason we're even having this conversation, and those of you who are experts know, and those of you who are newbies have probably figured out that this is a really important topic because nonprofits are frequently the targets of cyber attacks, and it's starting to ramp up.

24
00:04:06.040 --> 00:04:19.450
Neon One Webinars: That sounds very scary. It's okay, we'll cover some bases here. But, there was a recent study, up to 60% of nonprofits have been the target of a cybersecurity attack, or they've been affected by a data leak.

25
00:04:19.490 --> 00:04:23.740
Neon One Webinars: And leaks can certainly be expensive, of course.

26
00:04:23.740 --> 00:04:42.070
Neon One Webinars: If it is because of something that happened at a platform, like, the platform will usually handle it, but it can be expensive just to make sure that you are recovering as much information as possible. And it can also have a pretty big impact on the relationships that you actually have built with the people in your community.

27
00:04:42.990 --> 00:04:52.179
Neon One Webinars: I don't know about you, I have had my payment information leaked a couple of times and compromised. It's a huge pain, I'm sure we've all been affected by it.

28
00:04:52.180 --> 00:05:11.909
Neon One Webinars: So the good thing is that not all donor data issues are due to something very sophisticated, like a cyber attack or hacking. A lot of the things that can cause security breaches are really simple things like sharing information improperly or little simple mistakes.

29
00:05:11.910 --> 00:05:26.740
Neon One Webinars: So we can touch on some of the big, like, cybersecurity things that platforms like Neon One have to handle. But mostly what we're gonna focus on today are the small steps that you can take at your organization to keep yourself and your and your supporters safe.

30
00:05:26.940 --> 00:05:37.519
Neon One Webinars: I like that Christine called this out. Christine says, we've trusted the systems we're with. I don't know the questions to ask system vendors, and we have a whole section on that, so hopefully that will be helpful to you.

31
00:05:38.350 --> 00:05:51.289
Neon One Webinars: Just to set some expectations, especially for those of you who are new to cybersecurity, there is always at least a little bit of risk with any situation where you're storing, accessing, and using donor data.

32
00:05:51.290 --> 00:06:07.719
Neon One Webinars: We all know that donor data is only really useful if you're using it, and using that plat… or using that data is going to require that you use both platforms, like, like Neon One or QuickBooks, but you also have to share it with other people in your organization.

33
00:06:07.740 --> 00:06:14.269
Neon One Webinars: So there's always going to be a trade-off between making data useful and easy to access and use.

34
00:06:14.270 --> 00:06:29.740
Neon One Webinars: And keeping that information very secure. So today, we're going to focus on some really simple, straightforward steps you can take to mitigate any risk that's there, and hopefully you're going to be able to leave, even for you newbies, with some concrete first steps to use.

35
00:06:29.740 --> 00:06:31.209
Neon One Webinars: So the first thing we're going to do.

36
00:06:31.350 --> 00:06:37.169
Neon One Webinars: It's kind of what Christine alluded to. We're going to take a step back and you're going to evaluate some of the tools that you're using.

37
00:06:38.020 --> 00:06:56.509
Neon One Webinars: Some tools are designed to store your donor data. So, an example is a CRM. You can comfortably keep your donor data in something like a CRM, because any platform you use should have very extensive built-in security measures that will keep you and everyone else safe.

38
00:06:56.820 --> 00:07:06.060
Neon One Webinars: You can probably… how many of you are using spreadsheets for any of this? Let me know over there. You can probably use some data in spreadsheets.

39
00:07:06.110 --> 00:07:18.069
Neon One Webinars: Particularly if that data isn't super sensitive, and as long as it's in a secure drive that is password protected and not accessible to… or by everybody.

40
00:07:18.070 --> 00:07:32.269
Neon One Webinars: Wendy, yes, we use Excel. So you probably know, because you're one of our cybersecurity experts, that Excel is a really useful tool, especially if you're analyzing data, but you do need to take precautions just in how you share that information in Excel.

41
00:07:32.900 --> 00:07:37.850
Neon One Webinars: Other tools are not secure, and they are going to require some additional caution.

42
00:07:37.850 --> 00:07:58.420
Neon One Webinars: So, a common example that we've seen a lot of talk about lately is AI platforms. If any of you are using AI-powered tools to do data analysis, you're going to want to make sure that no donor data, so names, addresses, email addresses, phone numbers, none of that information should end up in any

43
00:07:58.740 --> 00:08:01.159
Neon One Webinars: Paid personal or personal account?

44
00:08:01.810 --> 00:08:07.059
Neon One Webinars: Unless you are paying for a business or enterprise-level account.

45
00:08:07.520 --> 00:08:19.770
Neon One Webinars: a tool like Claude or ChatGPT is gonna use your data to train their models. Even if you're using a personal payment or personal one and have opted out of training the models, that's still a privacy concern.

46
00:08:20.230 --> 00:08:39.999
Neon One Webinars: Things like open drives or public computers can also be really tricky if you're trying to keep information secure. So, say you're having internet problems at home, and you go to the library, and you download a donor data report on one of the library computers.

47
00:08:40.000 --> 00:08:50.920
Neon One Webinars: That information may be accessible to anyone who uses that computer anytime after you're done, and it may even be visible to other people who are on the same network.

48
00:08:51.310 --> 00:09:08.770
Neon One Webinars: If you're using any kind of physical storage device, that can also be tricky. I remember one instance a number of years ago, it's been a long time now, we had a woman who downloaded a bunch of her donor data on a thumb drive as a backup measure.

49
00:09:08.880 --> 00:09:10.980
Neon One Webinars: And then she lost to the thumb drive.

50
00:09:11.360 --> 00:09:12.470
Neon One Webinars: And…

51
00:09:12.500 --> 00:09:30.399
Neon One Webinars: anyone who found that thumb drive then could have access to all of her donor's information, not only their, their, like, contact information, but also some of their payment histories. So you'll want to be really intentional about which tools you use, because not all tools are created equal.

52
00:09:30.400 --> 00:09:41.840
Neon One Webinars: And neither, for that matter, is data. So some data is less sensitive than others. If you lost a thumb drive that only had on it a list of donor names and their email addresses.

53
00:09:41.870 --> 00:09:54.650
Neon One Webinars: I mean, that's obviously not ideal. Someone could find that and access that information. But it also doesn't inherently put you or your supporters at any real risk beyond potentially getting some annoying emails.

54
00:09:55.060 --> 00:10:14.079
Neon One Webinars: The more sensitive the data you're handling, the more cautious you're going to be about how you store and access it. Some information, like someone's payment information, like their payment details, shouldn't be stored at all. So you should never have someone's credit card information written down. You would be probably surprised at how frequently that happens.

55
00:10:15.110 --> 00:10:22.869
Neon One Webinars: Stuff like that should only flow through your payment processor, because that has extensive and very strenuous security measures in place.

56
00:10:22.870 --> 00:10:37.020
Neon One Webinars: So, not all tools are created equal, not all data is created equal. And being able to kind of step back and evaluate what you're using, how you're using it, and what's in that platform is a very important first step for you to take.

57
00:10:37.880 --> 00:10:43.790
Neon One Webinars: The other thing that I always caution people on is to be safe even with the safe tools.

58
00:10:43.830 --> 00:11:03.569
Neon One Webinars: Even the safest platforms can be compromised, and the good part about that is that most of the ways safe platforms are compromised is easily avoidable, at least on your end. So, question for you all. How many of you have recently, maybe within the last 12 months, had someone depart your organization?

59
00:11:03.570 --> 00:11:08.490
Neon One Webinars: Doesn't have to be staff, it can be volunteer, or board member, or someone like that.

60
00:11:08.490 --> 00:11:26.330
Neon One Webinars: One thing that I see all the time is, we have a nonprofit, and they've had an employee leave, or a board member's term is up, or something like that happens, and that person is no longer affiliated with the nonprofit, but they still have permissions to access

61
00:11:26.330 --> 00:11:32.290
Neon One Webinars: the CRM, or fundraising platform, or email platform, or whatever, where all of that information is stored.

62
00:11:32.460 --> 00:11:41.600
Neon One Webinars: So something you can do right now today to make sure that you're keeping your donors a little extra safe is to go into the platforms that you use and just look at your user lists.

63
00:11:41.840 --> 00:11:58.649
Neon One Webinars: Remove anyone who is not actively working with your organization, and make sure that they can't access your donor information now that they're no longer working with you. You can also review permissions, and permissions will vary based on platform, or from platform to platform.

64
00:11:59.090 --> 00:12:12.020
Neon One Webinars: But if you have multiple people who are accessing something like your CRM or your email platform, make sure they can only access the information that they need to do their job.

65
00:12:12.440 --> 00:12:25.689
Neon One Webinars: That sounds very vague, so here's an example. If you have a volunteer who's helping you manage an event, and you notice that they're set up in your CRM as a user admin.

66
00:12:25.690 --> 00:12:38.199
Neon One Webinars: That means that not only can they access the event management tools that they need, they can also access all of the information for all of the donors that are in your CRM. That's not necessary for them as a volunteer.

67
00:12:38.260 --> 00:12:49.449
Neon One Webinars: So what you can do is update their permissions so they can access the event management tools, but they can't access, edit, or even view donor or supporter information.

68
00:12:49.590 --> 00:12:50.520
Neon One Webinars: So.

69
00:12:50.910 --> 00:13:06.489
Neon One Webinars: Beyond that, you can just make sure that you're updating your passwords regularly. We'll touch on that in a second. And then just making sure that anything you do in terms of downloading any donor information from your various platforms is done thoughtfully and carefully.

70
00:13:07.590 --> 00:13:27.320
Neon One Webinars: So, evaluate your tools, evaluate the permissions and the people who can use those tools, and then the last thing I would encourage you to do here is just kind of evaluate some of the workflows that you're doing. So, a really common workflow, just for example, involves moving donor data from a CRM like Neon One.

71
00:13:27.470 --> 00:13:31.349
Neon One Webinars: to a bookkeeping platform, maybe like, QuickBooks.

72
00:13:31.660 --> 00:13:45.059
Neon One Webinars: That's a pretty safe workflow, because you've got a protected platform on one end, the data is moving between the two platforms, and the second one is protected also. It's really hard to intercept any of that information.

73
00:13:45.620 --> 00:13:55.110
Neon One Webinars: Moving the same data from the same CRM into a personal ChatGPT, though, is not safe. So it's…

74
00:13:55.570 --> 00:14:10.859
Neon One Webinars: the same kind of workflow, same kind of outputs, but one is safe and one is not. Downloading a report of recent donors and their email addresses from your CRM, and then uploading it into a protected email platform is pretty safe.

75
00:14:10.990 --> 00:14:17.449
Neon One Webinars: Especially if you make sure to go back and delete that, that spreadsheet later.

76
00:14:17.730 --> 00:14:23.279
Neon One Webinars: Both of the platforms that you're using, the CRM and the email platform, will have built-in security measures.

77
00:14:23.310 --> 00:14:40.099
Neon One Webinars: But downloading that report and then emailing it to a board member is much less safe, because you can't be sure that that board member has security measures in place, you can't be sure she locks her computer, you don't know what she's gonna do with that file or that data after you send it to her.

78
00:14:40.100 --> 00:14:49.229
Neon One Webinars: So you may not want to avoid that. Email is also not the most secure way to transmit the information at all, let alone donor information.

79
00:14:49.480 --> 00:15:08.089
Neon One Webinars: Evaluate the tools that you're using, evaluate who's using those tools, and then evaluate the work… the workflows that you have in place. Keeping an eye on all of that, anywhere where you're storing, accessing, or using data, and then the processes that you use to move that data around. It's a really important step that you can take toward better security.

80
00:15:08.780 --> 00:15:21.469
Neon One Webinars: Alright, Christine, this one's for you. So, once you've evaluated the existing tools and processes that you have in place, you're going to want to consider how you evaluate any tool that you add to that tech stack in the future.

81
00:15:21.690 --> 00:15:33.969
Neon One Webinars: So, whether you're actively looking for a provider now, or are going to do so in the future, asking potential vendors about their own security processes is going to be key.

82
00:15:34.240 --> 00:15:46.799
Neon One Webinars: So, when you evaluate a tool that will store or touch or manipulate donor data at all, you want to make sure that you cover a few topics with them before you actually sign anything.

83
00:15:47.430 --> 00:15:56.289
Neon One Webinars: So actually, those of you who are experts especially, I'd love for you to drop in the chat what questions you ask. This is… these are some of the questions that I would ask.

84
00:15:56.390 --> 00:16:08.849
Neon One Webinars: For any platform that is processing financial transactions, so fundraising platforms, merchandising platforms like Shopify.

85
00:16:08.960 --> 00:16:17.959
Neon One Webinars: email management platforms, anything that touches financial information. Ask those vendors about their level of PCI compliance.

86
00:16:18.210 --> 00:16:36.180
Neon One Webinars: PCI stands for Payment Card Industry, and PC… and the payment card industry has set forth, an extensive and very rigorous set of rules that any vendor, like Neon One or any other company that touches transactions, we have to follow those rules.

87
00:16:36.370 --> 00:16:49.679
Neon One Webinars: So ask your vendors about their PCI compliance, and ask about the level of PCI compliance they have. The… without getting really into the weeds of the technical part of it, the more

88
00:16:49.850 --> 00:17:06.080
Neon One Webinars: transactions a vendor processes throughout the year, the more secure they have to be. So if you're processing something and you're going with a larger organization that processes lots of transactions, they should be able to tell you about their PCI compliance and the level.

89
00:17:06.079 --> 00:17:10.189
Neon One Webinars: So the highest level is PCI compliance level one. That's what you're looking for.

90
00:17:10.930 --> 00:17:21.669
Neon One Webinars: If you're talking to vendors, you may also want to ask about their security measures and how they handle security incidents. So what measures do they have in place to keep you safe?

91
00:17:21.890 --> 00:17:37.790
Neon One Webinars: And then what measures do they have to keep you safe if something happens? A good vendor should be able to tell you about the protections they have in place. They should be able to tell you about how they protect you from, car testing. They should be able to tell you how they…

92
00:17:37.850 --> 00:17:50.649
Neon One Webinars: keep their information safe. They should be able to tell you what their response plan, if there is a cybersecurity incident. They should be able to tell you all of that. And if they can't, that's a big red flag.

93
00:17:50.820 --> 00:18:07.319
Neon One Webinars: So I would also ask you, or encourage you to ask about permissions. So we kind of touched on permissions a minute ago. People who are using your systems should only be able to access the donor information that they need to do their job.

94
00:18:07.360 --> 00:18:15.610
Neon One Webinars: So they should have a series of permissions where you can limit the amount of information that people can access in your tool.

95
00:18:15.900 --> 00:18:25.060
Neon One Webinars: Another thing that I would ask you to consider, especially if you're using any platform that has built-in AI tools.

96
00:18:25.130 --> 00:18:36.089
Neon One Webinars: Ask them how your donor's data will work with those tools. And what you're looking for is you're looking for a vendor with something called a zero retention agreement in place.

97
00:18:36.110 --> 00:18:53.269
Neon One Webinars: And what that means is that if they're… so that vendor will be using an AI platform, and if they have a zero retention agreement in place, that means your donor's data will never be retained, and it will never be shared with those larger models. So it's a really important way to keep them safe.

98
00:18:53.360 --> 00:19:10.259
Neon One Webinars: So I'd love for you to let me know if you can think of anything that you would add to the list. To answer Ashton's question, Ashton, I would encourage you to reach out to our team if you have very specific questions in place, because I could talk to you all day about all of the security measures we have in place.

99
00:19:10.260 --> 00:19:14.720
Neon One Webinars: I can tell you that we maintain a Level 1 PCI compliance.

100
00:19:14.720 --> 00:19:24.519
Neon One Webinars: I can tell you that we have a zero retention agreement in place for any AI tool in the system. So your donor's data is never, never there or never used to train models.

101
00:19:24.520 --> 00:19:31.640
Neon One Webinars: We have extensive permissions, levels, so you can easily go into your system

102
00:19:31.640 --> 00:19:44.759
Neon One Webinars: add a user, make sure they can only access these tools. You can even actually set up permissions levels so someone can see donor data, but they can't change anything. That's a really popular kind of setting that you have.

103
00:19:44.760 --> 00:19:50.750
Neon One Webinars: When it comes to the, where we could really get into the weeds or some of the measures we have in place to protect.

104
00:19:50.770 --> 00:19:53.520
Neon One Webinars: Protect information.

105
00:19:53.520 --> 00:20:11.110
Neon One Webinars: Some of that is quite technical, so we can get into it there, but we do extensive testing to make sure that our systems are secure. We maintain very high security levels. We have extensive processes in place to prevent carding attacks.

106
00:20:11.110 --> 00:20:20.190
Neon One Webinars: And then we do have a system in place for disclosing donor data leakage, which I've never heard of that happening here.

107
00:20:20.190 --> 00:20:33.440
Neon One Webinars: So if you'd like to get super technical, Ashton, you can email me, and I'll get you access to some of that. You can also reach out to our team if you're a user, and you can request that information from us, and we can happily share that with you.

108
00:20:33.440 --> 00:20:40.870
Neon One Webinars: It is pretty technical. I read through some of the documentation and I understood like 80% of it because I'm not a cybersecurity professional.

109
00:20:41.410 --> 00:20:45.619
Neon One Webinars: So we've gone through evaluating current

110
00:20:45.630 --> 00:21:08.029
Neon One Webinars: technology, current permissions, some simple steps you can take to lock those down and keep them safe. We've evaluated or talked about some of the questions you can ask future vendors, but one of the most important things you can do, actually, like Neon One, it's on us to have very extensive security protocols, but some of the most important things you can do is simply to train your staff.

111
00:21:08.030 --> 00:21:09.010
Neon One Webinars: On this.

112
00:21:09.010 --> 00:21:14.180
Neon One Webinars: And I'm probably going to share some pretty funny stories here that you may be able to relate with.

113
00:21:14.550 --> 00:21:31.999
Neon One Webinars: I've worked in the nonprofit sector for a really long time, and that means I have done dozens of cybersecurity courses, I've done lots of trainings. Actually, at Neon One and at the company I worked with prior, all staff have to do yearly training, because that's part of our PCI compliance.

114
00:21:32.000 --> 00:21:38.990
Neon One Webinars: But in every single training I've done, every single class I've done, I was on a crisis response team for a long time at another company.

115
00:21:38.990 --> 00:21:51.460
Neon One Webinars: Every time we are told that the number one security risk is not a platform, it's not a permission settings, it's not a password, the number one security risk is always a human being.

116
00:21:52.050 --> 00:22:04.390
Neon One Webinars: And that sounds kind of intimidating, but the silver lining there is that humans are the easiest security risk to address. And if you train your staff now on simple measures that they can take.

117
00:22:04.550 --> 00:22:09.050
Neon One Webinars: You'll be able to keep everybody much safer. So…

118
00:22:09.330 --> 00:22:27.789
Neon One Webinars: some simple steps you can take. If it's been a while since you've updated your passwords, or if you have shared passwords, which I really hope you aren't doing, go through and update those passwords. Passwords should be updated regularly, it's a huge pain in the butt, I understand that. However…

119
00:22:28.010 --> 00:22:37.030
Neon One Webinars: Because there are cybersecurity incidents all the time, keeping your password up to date and making sure that you have good passwords.

120
00:22:37.030 --> 00:22:52.129
Neon One Webinars: is a simple and very effective way to keep everybody safe. You could have the highest security system in the world, but if your password is just password, it's not very safe. People will be able to get into your system. So update your old passwords.

121
00:22:52.870 --> 00:23:08.660
Neon One Webinars: I don't know if you are like me, but if you heard that you should update your passwords regularly, and you kind of groaned inwardly because keeping track of changing passwords is such a pain, I would really encourage you to use a password manager.

122
00:23:08.740 --> 00:23:20.180
Neon One Webinars: Especially if you are using shared passwords. LastPass is kind of the standard. I use LastPass for everything. There are other options out there.

123
00:23:20.180 --> 00:23:30.529
Neon One Webinars: But the upside to LastPass is… or something similar. You can update your passwords regularly, and you don't have to worry about remembering it. All you have to remember is your LastPass password.

124
00:23:30.530 --> 00:23:49.249
Neon One Webinars: And the other thing that you should be able to do with a tool like that is share a password securely. So, if you have an intern… I'm making this up. If you have an intern who needs to access your CRM, but you don't have, for whatever reason, the ability to create a new account for them.

125
00:23:49.250 --> 00:23:52.470
Neon One Webinars: Share your login information, but do it through a password.

126
00:23:52.670 --> 00:23:59.129
Neon One Webinars: manager, because it's much easier for you to do that securely without anyone else.

127
00:23:59.230 --> 00:24:08.139
Neon One Webinars: kind of accessing it. This is a funny one and a simple one, but lock your computer screen if you step away from your computer.

128
00:24:08.230 --> 00:24:20.679
Neon One Webinars: I don't know about you all, I work from home, usually, but if you're in an office, oh my gosh, or especially if you are working out in public, and you have to step away from your computer, make sure you lock your computer screen.

129
00:24:21.630 --> 00:24:42.480
Neon One Webinars: This was actually something that I was, I saw in action during a PCI compliance testing. So for organizations like Neon One who maintain very high PCI compliance levels, we have to have on-site visits to make sure that we are keeping people's information secure. And years and years and years ago, a company that I worked with

130
00:24:42.580 --> 00:25:00.809
Neon One Webinars: noticed that one staff person got up from her computer and went to the bathroom and didn't lock it, and we were told that that was something that needed to be remedied. So you could be sure that when we took our security training, the next day, like, we really emphasized locking computer screens. It's such a simple thing, but it is very important.

131
00:25:01.330 --> 00:25:17.860
Neon One Webinars: The other thing I would encourage you all to do, if you are sharing information, especially with people like board members, or those who are not outside your organization, instead of downloading a file, especially if you've got, like, more sensitive information in your reports.

132
00:25:17.860 --> 00:25:22.969
Neon One Webinars: Instead of downloading a report file and attaching it to an email.

133
00:25:22.970 --> 00:25:34.270
Neon One Webinars: Use something like Google Drive or Microsoft's OneDrive or something like that and send a share link with access permissions instead of just sending the file.

134
00:25:34.270 --> 00:25:43.150
Neon One Webinars: It's not much more difficult. It is easier sometimes for people to manage than accessing attachments.

135
00:25:43.150 --> 00:25:56.219
Neon One Webinars: But it just… it's one extra security level that will keep information safe between you and whoever you're talking to. So, that board member that we talked about earlier, instead of downloading a report and sending it to her, send her a Google Drive link.

136
00:25:56.390 --> 00:26:01.989
Neon One Webinars: And just make sure that anyone who has the link can view it, but can't necessarily do anything with it.

137
00:26:02.720 --> 00:26:11.850
Neon One Webinars: So, just kind of wrap us up before we take a couple questions. Some immediate steps that you can take, and this is for… this is for the newbies, immediate steps you can take.

138
00:26:11.850 --> 00:26:23.269
Neon One Webinars: Look it through your platforms, look at the users who are there, make sure you get rid of old users who don't need to access that information anymore, and then update permissions to make sure that people can only access the data that they need.

139
00:26:23.450 --> 00:26:33.840
Neon One Webinars: Related to that, if you have… how many of you, actually, I'm curious about this for other reasons, how many of you have an off-boarding process? So if someone leaves.

140
00:26:33.840 --> 00:26:51.739
Neon One Webinars: Do you have an off-boarding process? We have one on my team. If someone leaves, we make sure that we update the passwords to any platform that might potentially have customer data in there, because we want to make sure that they, once they leave, they can't access private information.

141
00:26:52.330 --> 00:27:09.170
Neon One Webinars: Spend some time learning about phishing and what I broadly refer to as other online shenanigans. It is very easy to be bamboozled. My sister nearly got got the other day. She got, she was checking out on a website.

142
00:27:09.330 --> 00:27:22.930
Neon One Webinars: And, she was asked to complete a CAPTCHA to make sure that she wasn't a robot, and the CAPTCHA box opened something unusual, opened a dialogue box in her operating system, not in the browser, and it was a phishing attack. So…

143
00:27:22.930 --> 00:27:34.779
Neon One Webinars: Just read up on phishing and some simple ways that you can protect yourself from various online shenanigans. And then, write up just a simple incident response plan.

144
00:27:34.930 --> 00:27:37.539
Neon One Webinars: It doesn't need to be dramatic.

145
00:27:37.650 --> 00:27:56.839
Neon One Webinars: What… who needs to know if donors' information is compromised? What do you need to do? What do you need to disclose? How should you do it? That's all you need to cover. I love that Christine has an off-boarding plan with reminders that have to be checked off, and then Wendy, I like, here's no, we only have one part-time employee. That's pretty easy to manage.

146
00:27:57.390 --> 00:28:02.659
Neon One Webinars: If you want to do some more, like, intermediate steps, go… oh.

147
00:28:02.660 --> 00:28:19.919
Neon One Webinars: Did I skip the beginning one? I did. If we want to get a little more advanced, these are for you cybersecurity experts, consider, well, maybe Wendy, not you, if you only have one part-time employee, if you have a number of staff, consider purchasing and completing an online security training course.

148
00:28:20.000 --> 00:28:37.330
Neon One Webinars: I don't have any real recommendations. I know at Neon One, we complete all of our training through a platform called KnowBefore. This is a little advanced. You can probably find some free, free courses. You may even be able to find some simple security, even videos, just on YouTube.

149
00:28:37.460 --> 00:28:56.820
Neon One Webinars: Try putting together and adopting a data governance policy. That policy will dictate what data you store, what platforms you use, what data you do not store, what platforms you do not use to manage donor data, and then acceptable uses. So.

150
00:28:56.820 --> 00:29:12.040
Neon One Webinars: What will you use donor data for and what will you not ever use donor data for? That is really useful internally. So when you hire someone and you're training them on your processes and you touch on cybersecurity, which I hope you do, you can point to that data governance policy.

151
00:29:12.040 --> 00:29:21.239
Neon One Webinars: It's also really useful for donors if they are ever concerned about donor data and how their information is stored and used. You can point them to that.

152
00:29:21.710 --> 00:29:30.669
Neon One Webinars: And then the other thing I would encourage you to do, I put this on the advanced step slides, but it's really appropriate for everybody. Just have regular security audits, so…

153
00:29:30.670 --> 00:29:42.850
Neon One Webinars: That can be anything as complicated as penetration testing, which I don't imagine any of you would ever have to do. And something as simple as just how you off-board people. But put together a security audit.

154
00:29:42.870 --> 00:29:50.289
Neon One Webinars: And then have ongoing training, even if it's as simple as keeping up with a cybersecurity account on YouTube.

155
00:29:50.330 --> 00:30:02.179
Neon One Webinars: The people who are bad actors who are looking to do things like access your donor's information, their methods are always changing, so staying up to speed on what to look for and how to handle it is going to be key.

156
00:30:02.800 --> 00:30:17.990
Neon One Webinars: So the number one thing to remember, and this all sounds very intimidating, especially if you are newer to cybersecurity, there's always risk inherent with storing data. And this isn't just donor data, this is any data that you have. There's always a little bit of risk.

157
00:30:18.040 --> 00:30:37.750
Neon One Webinars: Anytime you have it, and anytime you use it. But the most effective way that you can mitigate that risk, aside from using platforms that will mitigate a lot of that risk for you, is simply to take proactive steps to keep people safe, even simple ones, like having strong passwords, cleaning up permissions.

158
00:30:37.780 --> 00:30:43.370
Neon One Webinars: And thinking very carefully through how you share information and move it from platform to platform.

159
00:30:44.210 --> 00:30:57.670
Neon One Webinars: Okay, that is what I have for you today. Do you have any questions I can answer for you? I saw the one earlier from Ashton, which we touched on, which is how we keep… how we keep information safe here at Neon One.

160
00:30:57.670 --> 00:31:05.450
Neon One Webinars: If you have any additional questions, I'd love to answer them for you. I'll keep an eye on the chat for the next few minutes, but I will tell you this while I wait.

161
00:31:05.500 --> 00:31:08.450
Neon One Webinars: You are going to get a recording of this session.

162
00:31:08.590 --> 00:31:20.179
Neon One Webinars: You'll get an email from me tomorrow morning that will have a link to this session. It'll have a link to the slides and the transcript. And then we have some additional resources in there for you if you need it.

163
00:31:20.180 --> 00:31:33.569
Neon One Webinars: Do feel free to send this to anyone you need, or who you think needs to learn a little more about cybersecurity. This could be a useful way to, nudge maybe a board member or a volunteer into, getting a little more

164
00:31:33.600 --> 00:31:36.419
Neon One Webinars: More up to speed on some simple measures they can take.

165
00:31:37.090 --> 00:31:59.669
Neon One Webinars: All right, everyone, that is the time we have together today. Thank you so much for joining me. I know that cybersecurity is not the most thrilling topic, but it is an important one. I also know that you're very busy, so I appreciate you being here and hanging out and learning about this topic. You guys are lovely. I hope you have a wonderful Wednesday. I will email you tomorrow with the recording and some of the resources.

166
00:31:59.670 --> 00:32:01.789
Neon One Webinars: So I will talk to you then. Bye, everyone.