Month: October 2024

Data can reveal hidden insights you might otherwise miss. These can point you to the next big trend in your industry or show a surge in enquiries about a specific product.
But it’s not magic. You need to take complete control of your data to optimise its use. This article can show you just how to do that through Data Governance.

The Value of Data: Your Untapped Resource

Data is no longer just numbers on a spreadsheet. It has become the new gold – a highly valuable asset that can propel your organisation to success. For example:

• Researchers can speed up the development of life-saving treatments, using patterns from patient data.
• A Nonprofit can increase its resources by tailoring fundraising campaigns, based on an analysis of donor data.
• A school can improve student outcomes by personalising learning experiences, after gaining insights from student data.

Data can be a very powerful resource IF managed properly. On the other hand, poor data management can cause data breaches, penalties, and loss of customer trust. However, you can mitigate these risks via a strong Data Governance strategy.

What is Data Governance?

Data Governance is the practice of ensuring that data is collected, stored, used, and protected in a way that is consistent with an organisation’s policies and objectives. An effective Data Governance framework covers the following:

Data Ownership: Who is responsible for data?

This establishes clear roles and responsibilities for managing different types of data. For example, in a medical practice, the head clinician might be responsible for patient data, while the IT department oversees system security.

Data Quality: How can you ensure accuracy and reliability?

Data Quality ensures your data is accurate, complete, and up-to-date. This data governance policy often involves data validation processes and regular audits.

Data Security: How can you keep your data safe?

This involves implementing strong security measures to protect sensitive information from unauthorised access or data breaches. This could include password protocols, encryption, and staff training.

Data Privacy: How do you protect the rights of your customers?

You must ensure you’re collecting, storing, and using data ethically. This includes obtaining user consent for data collection and providing clear information about how their data is used.

Benefits of Data Governance to Your Organisation

Data Governance can help your business succeed through these advantages:

Improved Decision-Making

Data Governance can ensure you have accurate, high-quality data at your fingertips, helping you make informed decisions that drive winning outcomes.

Enhanced Compliance

While data privacy regulations can be a challenge, Data Governance provides a clear roadmap to help you stay on top of compliance requirements with confidence.

Reduced Risk

Data breaches can be devastating, leading to financial losses, reputational harm, and legal trouble. Data Governance can minimise these risks through robust security measures.

Customer Satisfaction

Understanding your customers’ or donors’ needs and preferences can build strong relationships. Data Governance helps you put the structure in place to be able to leverage data to personalise your interactions and target communications more effectively.

New Opportunities

Valuable insights can be buried within your data, awaiting discovery. Effective Data Governance empowers you to analyse trends, identify areas for improvement, and develop innovative strategies.

Ethical Data Management

Data can also become a liability. To prevent this, you must give emphasis to key Data Governance areas such as data collection, retention, and disposal, especially for Personally Identifiable Information (PII) or sensitive data.

PII is any information or opinion about a person that can identify them, whether it’s true or not, and whether it’s written down or not. Sensitive data is a type of personal information that includes details such as race, beliefs, health, or biometric data (like fingerprints).

Data Collection

Your organisation must collect only necessary data and do so ethically and legally. Clearly define your purpose for collecting such data. Gather only what is essential for your specific purpose and avoid collecting irrelevant information.

Ask questions like:

• Does it contribute to your specific goal?
• Is it necessary for your operations?
• Is it critical for decision-making?
• Will it improve your processes or outcomes?

You must also get informed consent from individuals. Although the terminology in the Privacy Act isn’t defined, be transparent about what data is being collected, why it is needed, and how it will be used. Provide clear and accessible privacy notices, and ensure that individuals can opt-in or opt-out.

It is important to note that the Privacy Act specifies the need for “express” consent when collecting Personal Information or Sensitive Information. This means that individuals must clearly and explicitly agree to the collection and use of their data. Ambiguous or implied consent is not sufficient under the Privacy Act. Therefore, ensure that your consent mechanisms are robust and leave no room for misunderstanding.

Data Retention and Disposal

Establish retention policies based on legal requirements, business needs, and risk assessment. Set retention schedules and regularly review them, so they reflect changes in laws, needs, and data usage patterns. Set up alerts for relevant personnel to act promptly when data is due for review or deletion. When possible, you could automate data retention and deletion processes.

You must dispose data that is no longer needed as it is essential for security, storage and compliance reasons. Follow industry-standard methods for data destruction, such as secure shredding for physical documents and data wiping for electronic records.

The Increasing Complexity of Data Privacy Regulations

Data privacy regulations have become increasingly stringent and complex in recent years, reflecting growing concerns about the misuse of personal information. Standards such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) have shaped the global landscape.

In Australia, we have the Privacy Act 1988 which outlines the principles for collecting, handling, and storing personal information, with recent amendments focusing on transparency and accountability.

ADITS offer the only assessment tool for the Privacy Act in Australia so you can assess your compliance with a yearly assessment.

Find out more about CyberShield+

Successfully Implementing a Data Governance Framework

Taking control of your data through Data Governance is achievable even for smaller organisations. Here’s how to get started:

Start Small, Scale Up

Begin by focusing on high-risk areas first, like sensitive personal data or financial records. Once you have a solid foundation in these areas, you can gradually expand your framework to encompass all your data assets.

Engage Stakeholders

Data Governance isn’t a solo act. Involve key stakeholders across your organisation from the outset, including your leadership team, department heads, and even data users. Encourage open communication and collaboration to gain valuable insights and build buy-in for your data governance initiatives.

Practical Steps for Building Your Framework

Data Governance doesn’t have to be complex or expensive. Here’s a simple guide:

1. Appoint a Data Governance Champion: This dedicated individual will spearhead the implementation process and drive a data governance culture within your organisation.
2. Conduct a Data Inventory: Take stock of the data you collect, store, and use. Understanding your data landscape is crucial for establishing effective governance.
3. Develop Data Policies & Procedures: These documents will outline data ownership, security protocols, and access controls – the “rules of the road” for your data ecosystem.
4. Invest in Data Training & Awareness: Equip your team with the knowledge and skills they need to handle data responsibly. Training can range from basic data security practices to user awareness campaigns.
5. Continually Monitor & Improve: Data Governance is an ongoing process. Regularly review your policies and procedures, addressing any gaps or adapting to new regulations or technologies.

Data Governance in the Age of AI

The importance of data governance is further amplified in the context of AI.

Firstly, AI systems rely heavily on large amounts of high-quality data to learn and make accurate predictions. Poor data quality or inconsistencies can lead to biased or inaccurate results. Data governance ensures that the data used to train AI models is reliable, relevant, and consistent, mitigating the risk of biased or unfair outcomes.

Additionally, AI often involves the processing of sensitive personal data, making data security and privacy a paramount concern. Data governance helps to protect this data from unauthorised access, use, or disclosure, ensuring compliance with privacy regulations. By implementing effective data governance practices, you can harness the power of AI while minimising its risks and ensuring ethical and responsible use.

You can ensure your organisation in Brisbane, Townsville, or beyond gets the most from AI whilst ensuring data privacy by reading our comprehensive eBook, Step into AI: Your Playbook for Secure and Compliant Integration. We’ve also included a bonus AI Kickstarter Guide so you can begin your journey safely and securely.

DOWNLOAD THE EBOOK NOW

Australians have been losing $40 million monthly through social engineering scams. The Not-For-Profit (NFP) sector is not spared. While the Australian Charities and Not-for-profits Commission (ACNC) had warned of scams impersonating charities, the Australian Signals Directorate (ASD) confirmed NFPs are “prime targets for cybercriminals.”

Understanding and mitigating threats such as social engineering attacks is crucial for protecting your organisation’s mission and reputation.

What is Social Engineering?

Social engineering is any tactic that manipulates people into divulging confidential information or performing actions that compromise security. Common social engineering methods include:

• Phishing: Fake emails or messages that appear to come from reputable sources, prompting recipients to click on malicious links or provide sensitive information.
• Spear Phishing: Targeted phishing aimed at specific individuals or organisations, often using personal information to appear more convincing.
• Pretexting: Creating a fabricated scenario to obtain information from a target, often by impersonating someone trustworthy.
• Baiting: Offering something enticing to lure victims into a trap, such as a free download that would actually install malware.

Many of these are done via email, SMS, social media, and messaging apps. A few involve in-person activities, such as tailgating, or gaining unauthorised physical access by following someone with legitimate access.

How Social Engineering Affects Nonprofits

Social engineering attacks can have very serious impacts on an organisation, including:

• Disruption of Operations: Interruptions to NFP operations and services
• Financial Loss: Direct theft of funds or costs associated with remediation
• Reputation Damage: Loss of trust from donors, partners, and the public
• Legal and Regulatory Issues: Potential fines and legal action due to data breaches

The mental health of employees can also be affected by social engineering incidents. They can cause psychological distress to victims, including guilt, anxiety, fear, loss of trust, and a sense of helplessness. In turn, workplace productivity can decrease.

Additionally, understanding how to protect personal and sensitive information is key to maintaining trust and credibility with your stakeholders. For more insights on this, refer to our article.

Real-Life Cyber Incidents and Social Engineering Attacks on NFPs

The Cancer Council Australia was one of the Nonprofits affected by the data breach at fundraising services provider, Pareto Phone. It exposed names, dates of birth, addresses, email addresses, and phone numbers of donors and stakeholders. In a separate incident, Cancer Council Tasmania advised donors and prospects about hoax emails and website scams asking for donations.

The Australian Cyber Security Centre (ACSC) had also cited social engineering cases involving nonprofits. One involved a charity supporting families in need. Cybercriminals gained access to a staff email that did not use multi-factor authentication. They sent a fake invoice to the finance department and tricked them into sending over $30,000.

In another case, a corporate donor was defrauded via email spoofing. The attackers impersonated a Nonprofit supporting healthcare professionals, using a spoofed email domain ending in “.org” instead of “.org.au”. The corporate donor was convinced to redirect $20,000 to a fraudulent account.

Top Strategies for Preventing Social Engineering

To protect your NFP, consider implementing the following strategies:

1. Employee Education and Awareness

Ongoing training is essential to help employees recognise and respond to social engineering threats. Training should cover:

• Recognising phishing emails
• Creating and maintaining strong passwords
• Understanding the importance of verifying requests for sensitive information

Also, provide employees with ongoing support, regular updates, and other resources to help them stay informed and vigilant.

2. Security Policies and Procedures

Draft clear guidelines to guide staff about their role in maintaining security and what to do when threats arise. Key policies should include:

• Procedures for verifying the identity of individuals requesting sensitive information
• Guidelines for handling suspicious emails and messages

To remain effective, you must regularly review and update these policies.

3. Technical Controls

Implementing measures such as below can significantly reduce the risk of social engineering attacks:

• Email Filtering and Spam Protection: To block malicious emails before they reach employees
• Multi-Factor Authentication (MFA): Adds an extra layer of security by requiring multiple forms of verification
• Intrusion Detection Systems (IDS): Monitors network traffic for suspicious activity

4. Incident Response Planning

Having a plan in place for responding to social engineering attacks is crucial. This plan should include:

• Steps for containing and mitigating the attack
• Designating a response team for handling security incidents.
• Procedures for notifying affected parties
• Regular testing and updating of the plan to ensure its effectiveness
• Post-incident activities to identify weaknesses and improve future responses

5. Regular Security Audits

Conduct regular audits to identify vulnerabilities and ensure compliance with security policies. Regularly review internal processes and systems for potential security gaps. You may also engage third-party experts to do comprehensive security assessments.

6. Secure Communication Channels

Ensure that sensitive information is communicated only through secure channels, such as encrypted emails and secure messaging apps.

7. Third-Party Security

Ensure that your stakeholders also adhere to strong security practices. Perform partner assessments regularly to evaluate their security practices. Include security requirements in contracts with third parties.

All these strategies can help you build a strong defence against social engineering attacks.

Protect Your Nonprofit Today

With the right strategies, you can protect your organisation against social engineering threats and therefore safeguard your mission. To help NFPs across Queensland, including those in Brisbane, Townsville, and surrounding areas, ADITS has designed a unique approach called CyberShield combining managed IT and essential cyber security services and IT governance. Find out how we can help you today.

Secure Your Mission with CyberShield