To say cyber-attacks can be devastating is an understatement. But when you consider how underfunded charity organisations and their teams are in particular, the realisation that the not-for-profit sector is one of the most targeted is a difficult one to swallow.

Across the UK, there are almost 200,000 registered charities in total – from animal welfare and child protection services, through to cancer relief and mental health support.

And while it should seem unconscionable to pose threat to any of these organisations, the number of perpetrators seeking financial gain from stealing valuable data is evident.

According to the National Cyber Security Centre’s (NCSC) Cyber Threat Assessment, valuable funds, supporter details, and information on beneficiaries, remain primary motivations across the board.

So, what can be done to mitigate these growing risks? Here, client director at Central Networks, Mike Dunleavy, offers some crucial insight…

Understand the risks and how to spot them 

As with any organisation, employees are the first – and often most powerful – line of defence against cyber-attacks. That’s why developing a detailed understanding of what motivates threat actors, as well as how they might attempt to compromise vulnerabilities within your systems, is crucial.

It shouldn’t just be a tick-box exercise, but something that’s constantly on the agenda from one month to the next. Running regular audits of your tech environment and testing employees on their ability to spot malicious phishing or malware attempts are just some examples to help fortify your charity organisation. 

Be mindful though, because trying to adopt a one-size-fits all approach to educating your teams will only result in low engagement. Instead, ensure that training programmes and cyber security insights are specific to individual roles and responsibilities.

By resonating with the day-to-day minutiae of a person’s routine, they can see the true scale of the problem, how exactly it might impact their own work, and what a ‘best practice’ approach to help mitigate any dangers might look like. 

Remember that prevention is always better than the cure 

Once you’re aware of the risks you face as an organisation, you’ll have a better understanding of how you can bolster lines of defence.

With the increasing sophistication of cyber-attacks, it should go without saying that it’s important to get the basics right. Think watertight password policies, multi-factor authentication, and being vigilant when it comes to opening unknown links and accessing unfamiliar sites. 

But if the shift to ‘work from anywhere’ models has taught us anything, it’s that the most effective cyber security strategies run much deeper. No matter where your teams work, a dedicated IT division should have complete control over every device.

This not only enables full visibility over software updates, anti-virus technology, firewalls, Virtual Private Networks (VPNs), and more, but it also enables more robust access control – ensuring only authorised personnel within your non-profit organisation can gain entry to sensitive data. 

From part-time volunteers to full-time employees, it’s important that every colleague knows how to uphold the security stance of the charity right from the very beginning. 

Invest in a tough business continuity plan 

According to The Charity Commission, one in eight charities (12%) have experienced cyber-crime in the past year – yet just 55% see enhanced security as a fairly or very high priority. The reality is, the benevolent nature of these firms places them at a growing risk.

But let’s say all the right procedures are in place, and a perpetrator still manages to slip through the net undetected. What happens then? To help minimise downtime and reverse the effects of a breach as quickly as possible, having a robust business continuity plan in place is a must. 

Whilst the purpose of disaster recovery is to find and repair the root cause of the problem, this strategy helps to keep mission-critical operations running as smoothly as possible on the route to reinstating ‘business as usual’.

As a living document, this should constantly evolve in line with your charity’s evolving needs – with periodical testing ensuring every detail is appropriate, and the person in charge is still capable of carrying our designated tasks.

Such a proactive approach may seem full on, but it will pay dividends if it’s ever needed. And trust us when we say disaster will usually strike when you least expect it. 

Turn the tables on attackers 

Charity or not, anyone who has fallen victim to a cyber security attack will have at least one thing in common: they never thought it would be them. That’s why it’s better to ask too many questions before handing over sensitive data, rather than asking too few and it ending up in the wrong hands. 

Better still, beat attackers to it. While defence is a crucial part of the cyber security equation, it’s only half of the puzzle. Instead of waiting to be notified about a breach, offensive approaches tap into the hacker tradecraft, and utilise human analysts who can think like the enemy to identify any warning signs.

Penetration testing, for example, simulates a real-life attack and shows how the action would unfold, step-by-step – rather than simply scanning for vulnerabilities and handing the insight over in a report. It’s the perfect way for charities to stay agile in today’s constantly evolving cyberwar landscape.

One of our partners, Cyphere, recently spoke about this defence mechanism in greater depth, in our recent Q&A.

Of course, budgets are a significant restraint for any non-profit organisation, but combining as many of these examples as possible will maximise security posture, help protect precious data, and mitigate any financial or reputational damage in the long run.

Keen to continue the conversation? Central Networks has a glowing reputation when it comes to arming companies in this space – from social housing organisations to hospice care services.

If you want to know more about creating a bullet-proof cyber security strategy for your charity, please don’t hesitate to get in touch. We’d be happy to have a no-obligation chat about your requirements. 

In today’s cyberwar climate, everyone is a target – not least for malicious phishing emails.

An attack vector used by criminals to gain access to personal information – such as login credentials or banking details – phishing usually manifests in email, SMS, or telephone messaging. By posing as a trusted sender to dupe targets, perpetrators present a significant threat to organisations large and small, with the potential to gain dangerous foothold into corporate networks and compromise sensitive information.

What’s more, with the increasing sophistication of cybersecurity attacks, it can be hard to differentiate genuine digital communications from fraudulent ones. Emails sent from malignant senders may read well and look professional – sharing an acute likeness with examples that have landed in your inbox before – but that doesn’t always mean they’re legitimate.

However, by exercising caution and looking out for the major warning signs, there are ways to arm yourself from these invasive attacks. Although state-of-the-art technology is available to help identify threats, it’s unrealistic not to expect some to slip through the digital net – that’s why humans must be a primary defence, too.

So, without further ado, here are five tell-tale signs that you should bear in mind…

1. Grammatical errors and misspellings

An immediate signal that an email has come from an untrusted source is that it contains grammatical errors and spelling mistakes – whether that’s one or two, or riddled throughout the entire copy.

This is because phishers don’t have access to the same resources that professional writers do, and so their work has seldom been proofed and standardised by another pair of eyes. Because cybercriminals also spend a lot of their time distributing malicious messaging, their attacks are often rushed and therefore more likely to contain errors.

Of course, legitimate emails can sometimes land with minor mistakes, likewise fraudulent ones aren’t always replete with typos, so be sure to consider other factors before jumping to conclusions.

2. Inconsistencies in email addresses, link, and domain names

Looking for discrepancies in email addresses, links, and domains is another way to identify potential phishing attempts. Unless made explicit previously, a sender’s email address should align with prior correspondence – if it doesn’t, this should raise alarm bells.

It’s also worth checking that embedded links throughout a message correlate with the pop-up that appears when a cursor is hovered over the top. For example, if you have received an alleged email from Central Networks, yet the domain of the link doesn’t include ‘centralnetworks.co.uk’, you should flag this as a potential threat. Checking for misspelling is also crucial here, as a sender may pose an almost identical alternative, such as ‘centrallnetworks.co.uk’.

3. Suspicious attachments

Stretched, blurred, or pixelated images – as well as attachments that are unexpected, don’t offer a preview, or have an extension commonly associated with malware downloads (.sys, .exe, etc.) – should arouse suspicion. However, with the right software, recipients can scan these for viruses before choosing how to act.

If an infected attachment is presumed to be benign and opened, it will unleash malware onto the victim’s computer and enable cybercriminals to perform any number of nefarious activities.

Unless you’re entirely confident in the legitimacy of an image or attachment, it’s always best practice to leave them unopened. You could always contact the sender through an alternative method to verify the contents, if you think it might be important.

4. A sense of urgency

Perpetrators have a tendency to create panic in their digital communications, largely because swift decision-making has the ability to cloud judgement and leave errors undetected – ultimately ruining their plans to compromise your data.

While urgency can take shape in various ways – such as suggesting that an account is restricted, that details have expired, or even threatening negative consequences if a demand is not met – the likelihood is, someone who had a genuine need for haste would reach you on a personal contact number to speak directly.

Always be cautious with time-sensitive requests, and make sure they align with something you’d expect. For example, if you’ve just had a failed attempt to log into a Microsoft account and received an email saying that your password must be reset, it’s probably real – though be sure to check for other areas of concern so you can be confident it’s not a cyber-attack.

5. Unusual requests or an unfamiliar tone

Intuition is a real virtue in the digital world. If an email arouses suspicion because it doesn’t seem like something you’d usually be approached for, or how someone would usually communicate with you, it’s a good idea to trust your senses.

For instance, if a colleague is overly familiar – despite having only engaged with you once or twice – or a company that you don’t recall having any involvement with requests updated information, this should raise a red flag. It’s always a good idea to look for other indicators that such examples could be illegitimate.

Identification is the first step in any cybersecurity strategy, which is why employee awareness of phishing scams is crucial. The chances are, if one member of the team is on the receiving end of a threat, others are too. By reporting suspected fraudulent emails to the incident and security response team  – or your organisational equivalent – employees can enable rapid responses to potential phishing attacks and help mitigate the risks of sabotage.

Falling prey to cybercriminals can be daunting, but with the right knowledge and procedures in place, it’s an avoidable feat that can help protect not only your personal data, but also your reputation, time, and expenses.

For further support on phishing, please don’t hesitate to contact our team. Or if you’re seeking assistance with a wider variety of professional IT services – to help streamline operations and spearhead strategic growth – we’d love to chat about that, too.

You can reach us on 01706 747 474, or by emailing info@centralnetworks.co.uk.