BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT Raf Portnoy SVP, Technology Steve Sheinberg General Counsel SVP, Privacy & Security BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT

THINKING ABOUT DATA GOVERNANCE Create employee policies and build a culture that recognizes that employees are the main threat vector. Teach employees, especially about social engineering. Talk to the CIO. Get your board onboard. Get good agreements with vendors and key employees. Plan well and strive for Cyber Resiliency. Update software, install patches, remove non-approved software and hardware. Follow the principle of least privilege. Use two-factor authentication. Ensure that your physical security is sufficient. Encrypt all data, period. Segregate differing data onto separate networks. Monitor network traffic. {Most of this is policy, not tech, driven} Sheinberg and Portnoy

Asking: who is storing what information and where… GOVERN follow information governance best practices DETERMINE which data you need to protect IDENTIFY the data you have Asking: who is storing what information and where… Consider the risk of loss: Political, Ethical, Social, Legal How will you protect your data going forward?

Mission Mission: The mission of the Information Security and Privacy Program is to provide exceptional, secure infrastructure support and innovation in the delivery of information technology security products and services to Your Organization staff and clients. Improve cyber security awareness and data asset management. Protect information and systems to ensure that the confidentiality, integrity, and availability of all information is consistent with mission needs, internal and external threats, information value, and industry compliance.

Information Security Needs The number and complexity of information security threats are increasing. Advanced Persistent Threats (APTs) have penetrated environments that were previously thought to have been adequately secured and can remain unnoticed for extended periods of time. Data system growth is compounding the need for increased security attention. Additionally, mobile security, cloud security, big data security, and social media security are now “today’s problems.”

Information Security Needs How do we know this is enough? We are employing cybersecurity best practices We are following the recommendations made by our IT auditors. We are following recommendations by our Security Compliance consultants.

Information Security Program Confidentiality – Client, Employee and Organizational information Integrity – Consistent and accurate data Availability - Easily and safely accessible information Integrity Availability Confidentiality Identity & Access Management Security Strategy & Communication Security Policy & Procedures Security Culture & Awareness

Information Security Program Confidentiality Integrity Availability Identity & Access Management Security Strategy & Communication Security Policy & Procedures Security Culture & Awareness Traditional Cyber Security Triangle Confidentially Integrity Availability Cybersecurity Framework core: Identify Protect Detect Recover Restore

Information Security Measures Network Vulnerability Assessment Annual independent analysis that identifies and quantifies security vulnerabilities on network systems IT Systems Disaster Recovery Well-defined, documented policies and procedures on how to establish access to IT services in case of the disaster Network access and files monitoring Real-time email alerts and logs upon changes to confidential folders, or user accounts E-Mail Encryption Secure messages and information Mobile Device Management Manage mobile devices ensuring secure data on mobile devices Private Printing Secure printing to most network printers Single Sign-On Access multiple application with one credential Secure Remote Access Secure and seamless remote access Desktop and Server Management Patch and update desktops and servers Software deployment and configuration management Restricted Access to Client Management Systems (CMS) Access restricted to within the organization’s network Cybersecurity Awareness Program Training and Communiques

Thank you! Questions?