Presentation designed for cybercrime education for nonprofits specifically.

2. Who the Heck is
Denis Wilson
and Why Should
I Listen to Him?
“I am a veteran technology strategist who
specializes in developing highly-effective
and rock-solid computing systems for
small businesses.”
▪ Worked with Microsoft and their partners for over
20 years
▪ Certified by Microsoft on cloud computing and
small business
▪ Very knowledgeable in vertical markets like
healthcare, finance and insurance, legal and CPA
firms, construction and engineering, manufacturing,
and nonprofit
▪ Experienced in compliance environment like HIPAA
and FINRA.
▪ Author and speaker on the subject of SMB
technology for SCORE, SBDCs, EDCs, WBCs, SBA, and a
variety of business associations

3. Slide Deck Availability
Available at:
Slide Share:
http://www.slideshare.net/dwpia/
I also have over 15 presentations that are posted at the same
location for your perusal.
Ask me to connect with you on Facebook, LinkedIn or Twitter if
you would like to get my blog posts, and curated posts on small
business technology and processes.

4. • Overview of Cybercrime
• IssuesThat NonprofitsHave Had
• Tips to Protect Your SmallNonprofit

5. 93 percent of all money is digital. That’s what is at risk here. –Bill Nelson
Bill Nelson, Financial Services Information Sharing & Analysis Center
What is cybercrime?
Cybercrime is criminal activity involving the internet, a computer system, or
computer technology.
http://news.microsoft.com/stories/cybercrime/index.html

6. Cybercrime activity is the highest, ever
Cybercrime is a big global business
• The cybercrime industry has evolved with
the PC/computer/mobile device
ecosystem
• Today, cybercrime is more organized and
motivated than at any time in history
Insights about one group of three
Blackhats indicted in 2018
• Stole information on 100 million people
• Breached 12 companies, including
• Concealed at least $100 million in Swiss
and other accounts
• Hackers and conspirators were in more
than a dozen countries
• One of the indicted had hundreds of
employees
http://www.bloomberg.com/news/articles/2018-11-10/hackers-accused-by-u-s-of-targeting-top-banks-mutual-funds

7. The bad actors are not a monolithic group
Tools, techniques, motivations, and business models vary by cybercriminal region
Non-Professional
• Non-professional
cybercriminals
• Use crime kits to make
spending money
• Little to no business or
technical expertise
• Even though they are not
professional, their impact
can be significant
Blackhats
• Treatcybercrime asa
business
• Businessandtechnical
expertise
• Oftenworkinaclosed
groupofother
professional
cybercriminals
• Criminalreputationis
everything
Grayhats
• Theybelievetheyare
offeringlegitimate
services. However,their
customerscanbeboth
“legitimate”orcriminal
• Ranasabusiness
Hactivists
• Individualsorgroups
whohackforasocial
cause,without
economicmotivation
• Havebothtechnical
peopleandfollowers
State
Sponsored
• Nationalsecurityand/or
economicmotivation
• Technicalexpertise
• Work inaclosedgroupof
otherprofessionals
• OftenuseBlackhat
resourcesand/or
techniquestomasktheir
identity
Some elite Blackhats, some elite
hactivists, and most state sponsored
actors use “APT” techniques
Often defenders treat all bad actors the same

8. The cybercrime problem is broad
• More professional cybercrime services make
it easier for would-be attackers to become
cybercriminals
• Many cybercriminals don’t need technical abilities
when entering the world of cybercrime
• In many regions, it is socially acceptable to
steal from victims on the Internet
• The line is blurring between state sponsored
attackers and cybercriminals
• Elite teams of attackers that have the same
resources, skills, and patience as state actors
8
and getting worse

10. • The Urban Institute’s National Center for Charitable Statistics was
the victim of a malicious attack that compromised 600–700
organizations.
• In Muncie, Indiana, a small nonprofit organization called the Little
Red Door had all their data stolen from their server and held
ransom for a whopping $43,000. If the nonprofit paid, the hackers
claimed, they would return the data and not publish it.

13. Tips to keep your
nonprofit business
safe

14. Our data has
to be secure.
What does
my modern
business need?
We need to reopen our
business quickly after an
emergency.
40% of businesses
hit by disaster
never reopen
FEMA 2013
60% SMB technology leaders
cited data security or privacy
as a concern
Boston Consulting Group study

15. Protect and control
your data
Be prepared for the
unexpected
The manageable
side of risk
management.

16. What my modern business does not need

17. Step 1
Follow best practices when using
your computer resources

18. Strengthen your computer’s
defenses
Keep the firewall on (work, home, and public networks)
Install legitimate anti-malware software (http:/aka.ms/wkactd )
Keep software up to date (automatically)
1 statistics noted from Flexera software
1

19. Get business apps up and running
now
BACK UP – BACK UP – BACK UP
Use a cost-effective disaster recovery to bring back computer
functionality
Use cloud for hosting and/or backup
Replica software, or other similar utilities
1 statistics noted from Flexera software

20. Step 2
Train your users
on to deal with
malware when
it happens

21. ➢ Train your users to use
malware and phishing
protection in their
browsers.
➢ Keep Antivirus on and
updated
Don’t be tricked into downloading malware

22. Ctrl F4
Don’t be tricked into downloading malware
Close pop-up messages carefully

23. Step 3
Protect company
data and
financial assets

24. Controlling access
Managing mobile devices
Protecting data
Backing up your files
Ready for the unexpected
Solutions for safeguarding your business

25. Protect company data and financial assets
Encrypt confidential data
Use rights management solutions to handle sensitive data
Train your users to identify scams and fraud
Use HoneyTrap accounts in your domain. Notify on
successful and unsuccessful logins

26. How to evade scams
Look for telltale signs
Think before you click
Keep sensitive information private
Train employees to identify socially engineered
attacks
www.snopes.com

27. Step 4
Create strong
passwords
Keep them private
Don’t reuse them

28. Create strong passwords
Which passwords are strong?
Password1 123456
$wanR!ceRedD00r
qwerty
MsAw3yO!D
SwanRiceRedDoor
My son Aiden was 3 years old in December
DenisW

29. Strong passwords are not enough
Protect your accounts and passwords
Make passwords strong (still needed)
Keep them private (don’t share among users)
Use unique passwords for different websites
Employees should not use company e-mail accounts as their identifier
(on third-party website)
Defend against checkers
Enable disabling accounts on too many invalid login attempts
Don’t use unsure interfaces (e.g. unprotected POP/IMAP/SMTP)
Monitor for compromised account checkers

30. Step 5
Guard data and
devices when
you’re on the go

31. Guard company data when you’re on the go
Connect securely
Save sensitive activities for trusted connections
Confirm the connection
Encrypt storage on mobile devices
Flash drives: watch out for unknowns and disable auto run
Enable features like Work Folders and cloud storage to
manage work data on mobile devices

32. What to do if there are problems
Have a predefined process and checklist to identify company
identities, data, services, and applications on the device
Report abuse and other problems
Immediately report phishing
Immediately report missing devices or theft of company data
Change all passwords
Wipe mobile phones

33. bit.ly/2kQygk2
This is the link for our quick
survey and the chance at the
door-prize

34. bit.ly/2kQygk2
Telephone: 866-995-4488
Email: info@DWPInformationArchitects.com
Website: www.DWPInformationArchitects.com