Soapbox Engage Blog

Cybersecurity is something all organizations need to pay attention to, but especially nonprofits. At nonprofits, we handle sensitive data such as donor information, financial transactions, and more. We use online tools to communicate, store information, and fundraise. Many nonprofits do not have many measures to protect against cyber-attacks. This makes our sector a prime target for hackers who want to steal data, extort money, or disrupt operations.

This blog post will explore common cybersecurity risks that nonprofits face, and how you can protect your organization by following best practices.

Common Cybersecurity Risks

Nonprofits face the same type of security risks as any other organization. But it’s likely you have fewer resources and expertise to resolve them. Here are some common risks:

• Data theft: Cybercriminals may try to access your data by hacking into your systems or by tricking you into giving them your credentials. They may use this data for identity theft, fraud, blackmail, or selling it on the dark web.


• Ransomware: Ransomware is a type of malware that encrypts your files and demands a ransom to unlock them. If you don’t pay, you may lose your data permanently. Ransomware can affect your computers, servers, cloud storage, or even your website.


• Denial-of-service attacks: A denial-of-service attack is when a cybercriminal floods your website or network with traffic or requests, making it slow or unavailable. This can affect your online presence, reputation, and ability to serve your community.


• Website defacement: Website defacement is when a cybercriminal alters your website’s appearance or content, usually with malicious or offensive messages. This can damage your credibility and trust with your audience.

If you have internal data of your donors and volunteers and suffer a data breach, you may face legal liability, regulatory fines, reputational damage, loss of funding, as well as a loss of trust. You can also jeopardize the safety of your community members. This is why it’s so important to take cybersecurity seriously and work to mitigate these risks to prevent this from happening.

Best Cybersecurity Practices for Nonprofits

1. Use a Secure Fundraising Software

Fundraising is a central activity for most nonprofits, and it involves collecting and processing personal and financial data from donors. This data needs to be protected from unauthorized access, use, or disclosure. It’s important to use a secure fundraising software that offers features such as encryption, compliance, backup, and audit.

With Soapbox Engage’s Donations app, you are guaranteed safe & secure online fundraising. Credit card and donor information is secure with an encrypted form. There is PCI compliance, meaning the software follows the relevant laws and regulations for data protection. There is also automatic fraud detection & monitoring, enabling you to have a worry-free fundraising experience!

2. Use Strong Passwords

Passwords are the first line of defense for your online accounts and devices. They should be long, complex, unique, and hard to guess. A strong password should include a combination of uppercase and lowercase letters, numbers, symbols, and spaces. It should also avoid common words, names, dates, or phrases.

For example, a weak password would be something like password123 or nonprofit2023. A strong password could be something like n4nPr0f!t$3cur!ty@2023.

3. Watch Out for Suspicious Emails

Email is one of the most common ways that cybercriminals try to trick you into giving them access to your systems. They may send you emails that look legitimate but contain malicious links or attachments that can infect your device with malware or direct you to fake websites that ask for your credentials.

These emails are known as phishing scams and they can be very convincing. They may use logos, names, addresses, or other details that mimic those of legitimate organizations or people you know. They may also create a sense of urgency or curiosity to make you click on their links or attachments.

To avoid falling victim to phishing scams, you should always check the sender’s email address carefully and look for any spelling or grammar errors in the message. You should also hover over any links before clicking on them and see if they match the expected destination. If you’re not sure about an email’s authenticity or legitimacy, don’t open it or reply to it. Instead, contact the sender directly using another channel or report it as spam.

4. Use a Password Manager

As we said earlier, passwords are essential for securing your online accounts and devices. But managing multiple passwords can be challenging and time-consuming. You may have dozens or even hundreds of passwords to remember and enter for different apps or services. You may also have to change them frequently or share them with others.

That’s where a password manager can help you. A password manager is a tool that stores and manages your passwords securely, so you don’t have to remember them or write them down. It also helps you create strong passwords for each account and autofill them when you log in.

5. Enable Two-Factor Authentication

Two-factor authentication (2FA) is an extra layer of security that requires you to enter a code or use a device in addition to your password when logging into an account. This way, even if someone steals or guesses your password, they won’t be able to access your account without the second factor.

You should enable 2FA for all your online accounts that support it, especially those that handle sensitive data or transactions. You can use various methods for 2FA, such as SMS codes, email codes, authenticator apps, or hardware tokens.

6. Educate Your Staff

One of the most important aspects of cybersecurity is human behavior. Your staff are the ones who use your systems and devices, and they can either be your greatest asset or your weakest link when it comes to security. That’s why you should educate your staff on security best practices and how to recognize and avoid common threats. Make sure they are aware of all the threats outlined in this blog post, and how to avoid them. It’s important to create a security culture within your organization, where security is seen as everyone’s responsibility and not just an IT issue.

---

And there you have it. These tips will help you on your journey to taking cybersecurity seriously in your organization. If you have more questions about how Soapbox Engage can keep your data secure with our tools, reach out to us to get your questions answered.

Here are three more resources to support your fundraising journey:

• 8 Tips to Optimize Nonprofit Funding Conversion Rates: Your fundraising conversion rate is a key indicator of how effective your website is. This blog post has 8 tips for optimizing your conversion rate, and bringing in more donations on your website.


• 4 Ways Donation Transparency Increases Fundraising Success: Whether they’re new donors or long-term donors, it’s important that your donors are very clear about where their money is going! This blog post shares four ways donation transparency can make your fundraising more successful.


• Giving Trends Highlight the Importance of Attracting New Donors: Recently, Giving U.S.A released their 2023 report on giving trends. This blog post shares what these trends show, and how to respond in your fundraising within your organization