How does a non profit organisation recover from a cyber event?

Recovering from a cyber event can be challenging for any organization, including non-profit organizations in Australia.

Here are some steps that non-profit organizations can take to recover from a cyber event:

Containment and assessment:

The first step in recovering from a cyber event is to contain the incident and assess the damage.

This may involve disconnecting affected systems from the network and determining what data has been compromised.

Response plan activation:

Non-profit organizations should have a response plan in place for cyber incidents, which outlines the steps to be taken in the event of an attack.

This plan should be activated as soon as the incident is detected to ensure a timely and coordinated response.

Notification:

If personal data has been compromised, non-profits may need to notify affected individuals and regulatory authorities, such as the Office of the Australian Information Commissioner (OAIC), under the Notifiable Data Breaches (NDB) scheme.

Non-profits should follow the guidelines set out by the OAIC regarding the content and timing of data breach notifications.

Communication:

Non-profits should communicate with stakeholders, including donors, partners, and staff, about the incident and its impact.

This can help maintain trust and transparency with the organization’s supporters and minimize reputational damage.

Recovery and restoration:

Non-profits should work to restore affected systems and data, including implementing data backups, patching vulnerabilities, and updating security measures.

Non-profits should also review their response plan and security measures to identify areas for improvement.

Review and prevention:

Once the organization has recovered from the cyber event, it’s important to review the incident and identify areas for improvement.

Non-profits should also take steps to prevent future cyber incidents, including implementing stronger security measures and providing ongoing training and education to staff.

Recovering from a cyber event can be a complex and time-consuming process.

Non-profits can benefit from working with cybersecurity experts and seeking advice from relevant regulatory authorities to ensure they are taking appropriate steps to recover and prevent future incidents.

Ransomware and why it has the impact it does

Ok incoming RANT

On the last 3 Mondays, we have had to clean up 5 fully encrypted networks.

Small to Medium organisations, non-profits and businesses.

Each with a server with more than 10 computers and some cloud-based systems.

Their IT department or person who knows computers was in charge.

They were telling management that they were secure.

No tested backup

No resilience

No awareness training

No management systems.

No anti-virus

No updates

Where does that leave them?

At the moment, in a heap of trouble.

When it comes to cybersecurity, talk to an expert.

Everyone is a target of cybercrime, just some are more secure than others.

Not sure what to do – start with this audit here: https://Action.scoreapp.com

Thinking you are immune to a cyber event is a regular occurrence for SME’s

Even if you think you are immune to a cyber attack these ideas are critical to restricting the impact.

I want to talk about some of the problems we have encountered when being called into a cyber event situation for a new client.

Have you looked at all of our business risks?

Risk is the biggest invisible issue in today’s business world.

Most Organisation does not know how to evaluate the risks that their digital component brings to the Organisation because they cannot visualize the risk.

Only by looking at the digital risks will it become apparent that more is needed to be done.

Get some good legal advice!

We regularly come across businesses that do not know what their legal obligations are when it comes to protecting data that they are the custodian of.

If your Organisation collects information about a person or a business you are now the custodian of that data.   The legal implication of being the custodian need to be understood before you make the decisions concerning the information or type of information collected.

Always err on the side of less.  If you cannot justify it do not collect it.

Check your response plan!

When it comes to SME’s, they think they are Bulletproof.

It will never happen to us, we are too small, yadda yadda!

Well, NO.   A cyber event can happen anytime and to anything digital.   When it comes to a true cyber attack you need to have a breach plan.

A plan that tells everyone in your Organisation what you expect them to do, how they will do it, who they report to and the process needed to preserve evidence and get back to business as normal.   Without it, chickens missing heads, running, lots of running, come to mind!

Test your systems with a tabletop war game.

This is absolutely essential to any Organisation with more than 5 staff.

Run some hypothetical scenarios.    Think of a problem and make sure that everyone knows what to do if it ever occurred.   Especially test disaster recovery, business continuity and breach plans.

After testing the system do both a hot wash up (debrief) and a report.

Implement any discovered failures.   Things that could be done better.   Things that were done badly.

You do not want a real emergency to be the first test of these plans.

Test some “what if …” plans.

Another alternative is to come up with some unusual issues.

A fire in the building that does not impact your business but your business is in the same location and your staff can no longer get to the office, showroom, shop for a week.

What is the impact?   What is your solution?

Tested our backup, we have.

We have a rule.   When it comes to backups we have the 3-2-1 rule.

There are 3 copies of all data.   The original data plus 2 other copies.   Those 2 copies consist of an on-site incremental data copy and an off-site copy.  There is always 1 copy of the data stored off-site.

Once again a backup is useless unless it has been tested.    A regular restore copy of a couple of files should be documented every month.   A full-blown restore of the system should be done every year from both locations.

Who do we have to report to?

When it comes to a breach there also needs to be a reporting structure.   Part of your business continuity plan should be a list of people who are allowed to talk to the media, post on social media, talk to vendors or talk internally and to who.

Reputation always impacts needs to be controlled as much as possible in today’s live world.   The policies, plans, and tests will ensure that everyone knows what they need to do.

Does anyone know how to preserve evidence?

If you are knee-deep in a cyber event the last thing that anyone is going to think about is the preservation of evidence.

Once again if the breach plan has been tested then you will know what has to be done.   If would be cold comfort to know that someone who has ruined you life will not face the consequences because there is no evidence against them.

Preservation of digital evidence can also include the information and machine learning that comes from your System Information and Event Management system (SIEM).

Train everyone, security should be part of everyone’s role in the organisation.

Social engineering is the process of targeting people.

It is used to great effect against everyone in business.   Social engineering is a 2 fold process – the bait, the email SPAM, phishing and the bad technology – link, application or attachment.

Combined together they are an effective attack system for the bad guys.

To counteract the social engineering you need to educate everyone.   There are free online courses but additional resources can include competitions, posters.

Get a framework and implement it.

One of the best protective strategies any business can implement is a framework.   I recommend the National Institute of Standards and Technology (NIST) Cybersecurity framework.

By answering the 98 questions, you get an instant base level indication of where your Organisation is in regards to the security maturity.

A framework does a number of things.   It gives you a base level, it gives you a score between 0 and 4, it ensures that you do not forget anything and gives you a road map for business security within your Organisation.

As a flow-on effect, it gives you a score that you can compare apples with apples (security maturity with security maturity) against other Organisations.   When it comes to data sharing you can make informed decisions on how secure the other Organisation will be in regards to data protection.

You have done a vulnerability assessment

Every device that is connected to a network has the capability of compromising the whole network.   The first law of Cybersecurity is “if there is a vulnerability it will be discovered and it will be exploited – no exceptions”.

To ensure that those vulnerabilities are addressed you need to do regular vulnerability scans on the network.

This can be achieved with expensive or free systems.   Either type it is important that vulnerability scans are completed and mitigated and vulnerabilities are patched and managed correctly.

Cybersecurity is not easy!

There’s no such thing as set and forget when it comes to protecting your Organisation from a cyber event.

It is a diligent and continuous process that needs to be done correctly to protect the integrity of the data within your custodianship.

Keep it safe, protect it, monitor it and ensure that if something does happen you have a way back to business as normal.

How fast will your business be back to business as normal after a disaster?

Encryption and Backups are your fall back position

When it comes to business security there are 2 systems that will save you after the impact of a cyber event.   The first is a good backup and the second in encryption.

Neither of them is as foolproof as business owners think.

Understanding the importance of backups.

The whole point of a comprehensive back up regime is to be able to get back to business as normal as fast as possible.

A good backup will help you achieve that.   So will a good disaster recovery plan, a decent business continuity plan as well as building in as much resilience as possible into the organisation itself.

Like any plan or solution it has to be tested, it has to be stressed and more importantly, everyone in the organisation needs to know what to do, where information is and how to implement those plans.

Failing to test or improve from the experiences of real-time tests and war-games is usually where an organisation fails.

You cannot improve a system unless it is tested regularly.   Once tested you can rectify issues discovered during the testing.

You DO NOT want to have the cyber event as the first test of system failure and recovery.

What to do with backups.

When it comes to a backup it needs the following items in place.

  • A copy of all critical and non-critical data stored in another location.
  • A copy of that information only connected to the system when it is doing a backup
  • A process that has no human requirements except to check it has happened and fixing it when it fails (immediately)
  • A system that is regularly tested and improved.  In business everything changes, the systems and data need to be tested but the people involved as well.

Protecting your encryption keys

The second component is encryption.   Seen by many as the silver bullet of data security, it is just another deterrent.   If your data is stolen then encryption will ensure that the data is unreadable, unless the bad guys have the keys.

The most important component of encryption is the security of those keys, if the keys are stolen or get out the encryption is useless.

So protecting those keys is more important than protecting the data the keys are securing.

When it comes to SME’s, not for profit organisations and charities we often find the security keys, especially for securing websites, just lying around a system.   Usually, they are saved in a folder called certificates with no added security around those files.

Protecting your encryption

There are many ways of using encryption and all of them cannot be discussed here so here are a few ideas.

  • Make sure your encryption key is not hardcoded into the applications using it.
  • Make sure your encryption key is your property and not owned by a third party.
  • The encryption keys should never be stored on or in the same system using them.
  • Make sure there is an audit trail in their use.
  • Only use one administrative account to encrypt data, record that account and the password in an out of band location, only used for that specific role.
  • Your keys can be encrypted!
  • Cryptographic keys change regularly, create a policy, process and procedure around that requirement.
  • Back them up.   The keys can be stored on an encrypted thumb drive and stored in a secure location. IE – a safe (part of the policy?)

To stop a cyber event instead of just recovering from one you also need to implement other components.   To survive the onslaught of cybercrime, follow and implement the best practices documented all over the internet.

A plan B is important, just like insurance is important.   When everything else fails your recovery is critical.

The CareMIT Security Methodology will help you secure your systems, people and data.

Why you need an off-site backup

Off-site, secure, out of band backups are your only hope for recovery in a cyber event

Ransomware, the scourge of today’s business, is literally a click away from crippling your business and organisation.

Attackers can reportedly execute the malware and begin encrypting most file types and removing all local backups. It is still unclear how much the demanded ransom is, but researchers have found that TFlower doesn’t append the encrypted files’ extensions.” Connor Madsen webroot. https://www.webroot.com/blog/2019/09/20/cyber-news-rundown-tflower-ransomware-exploiting-rdp

A determined crypto-virus attack on your organisation can reduce the organisations chance to make money, it can impact your reputation and can cause problems for months if not years.

Even an accidental infection, most result from an accident, can cause similar effects.

In the event of a crypto-virus attack, especially for small and medium enterprises, you have 2 options.

  • You pay the ransom – you may get your data back, you may get some of it back or you may get none of it back, we are after all talking about a criminal organisation that is holding your data to ransom.
  • You recover from your backup.

Paying the ransom is up to you, most security and ICT companies will say not to pay.

If you have a security or ICT company, or someone in your organisation that does the job they would have told you to do a backup.

Your back up has to cover the following:

  • It should be regular – depending on your requirements for the data and access to the data a back up should be completed every 24 hours.   A better solution is to have an incremental backup every 15 minutes.
  • It should have no human intervention – the backup has to run no matter what.  If you are backing up to a hard drive, connected to your device and you require someone to change drives then human error comes into it.   The old adage that the backup will fail the same day you need it is true.
  • It should be off-site – As in totally away from the business but also not connected to the business except when it is doing a backup.
  • It should be secure – all the data, no matter where it is stored should have encryption wrapped around it.   It should be encrypted at rest (stored on the location), it should be encrypted in transport (getting there and back) and it should be encrypted if you are going to use it.  This stops the information being stolen but also being accidentally accessed by the provider.
  • It should be tested regularly – you have done a backup and that’s all I have to do.   No, you need to test it regularly.   Do a regular restore to test that it works and also to ensure that you are backing up ALL of your essential data.   You do not want to be in a situation where a failure is your first test.

Achieving all of these components is difficult.   Try talking to us or a reputable ICT and security provider concerning your options!

Click here for your free trial of a secure, out of band off-site backup solution.