This document outlines Michael Enos' presentation on creating a culture of security. The presentation introduces common cyber threats facing non-profits, such as ransomware, DDoS attacks, and malware. It then discusses the NIST Cybersecurity Framework and how TechSoup has implemented it to identify, protect, detect, respond to, and recover from cyber incidents. The framework guides TechSoup's asset management, risk assessment, access control, data security, and monitoring practices. The presentation concludes by listing additional cybersecurity resources available to non-profits.

1. Creating a Culture of
Security
Michael Enos
Sr Director Community & Platform

2. 2 © TechSoup Global. All Rights Reserved.
Presentation Outline
Topic
Intros
Cyber Threats facing NGOs and Civil Society Organizations
(Ransomware, DDoS, Malware, Cryptomining, Botnets, etc.)
Cyber Security Frameworks & Methodologies in Practice
Cyber Security Frameworks & Methodologies in Practice (NIST)
TechSoup: A Case Study in the NIST Framework Implementation
Resources available for NGOs + Partner Networks
Questions / Discussion

3. 3 © TechSoup Global. All Rights Reserved.
Michael Enos
Senior Director of
Community and Platform
• Michael Enos is Senior Director of Community
and Platform for TechSoup. In his role,
Michael directs dev-ops, enterprise
infrastructure, information and technology
security, and software development teams
that build and support platform products and
services.

4. 4 © TechSoup Global. All Rights Reserved.
Phishing
Data Breach
Service
Disruption
Malware Ransomware
Cyber Threats NGOs Face
NGOs have specific types of data that if compromised, could impede our mission and lose the trust of the communities we serve
• Vulnerable Population’s Personal Information
• Donor Data
• Financial Information

5. 5 © TechSoup Global. All Rights Reserved.

6. 6 © TechSoup Global. All Rights Reserved.
Cyber Security Frameworks
& Methodologies in Practice
Purpose:
• To use proven guidance from Institutional
Leadership bodies
• Audit controls and organization performance
standards are derived from these
Frameworks
• As stewards of data reflecting the critical
infrastructure of Civil Society, it is our duty
and responsibility

7. NIST
Cybersecurity Framework
• What is the Framework?
• The Framework is voluntary guidance, based on
existing standards, guidelines, and practices for
organizations to better manage and reduce
cybersecurity risk. In addition to helping
organizations manage and reduce risks, it was
designed to foster risk and cybersecurity
management communications amongst both
internal and external organizational stakeholders.

8. Cyber Security
Framework version 1.1
Breakdown

9. o Asset Management
o Business Environment
o Governance
o Risk Assessment
o Risk Management Strategy
o Access Control
o Training and Awareness
o Data Security
o Information Protection Processes
o Maintenance

10. o Anomalies and Events
o Security Continuous
Monitoring
o Detection Processes
o Response Planning
o Communications
o Analysis
o Mitigation

11. 11 © TechSoup Global. All Rights Reserved.
• Application Asset Inventory Management
• Mobile Device Management
• Policy-based Governance
• Infrastructure and System Architecture
documentation
Case Study: TechSoup
• Cloud Web Application Firewalls
• Endpoint Protection
• Encryption
• MFA
• Disaster Recovery – Data Loss Protection
• Security Awareness Training
• Privileged Access Management (PAM)
Identify Protect

12. 12 © TechSoup Global. All Rights Reserved.
• Continuous Vulnerability Monitoring and
Assessment
• Attack surface monitoring
• Alerting and Escalation Protocols
• Security Information and Event Management
Case Study: TechSoup
• Incident Response Policy
• Incident Containment
• Disaster Response Protocol
• Internal and External Communication
• Root Cause Analysis
• Future Prevention Learnings
Detect Respond/Recover

13. Resources
• National Cyber Awareness System bulletins from the
Cybersecurity and Infrastructure Security Agency.
• Both Google and Microsoft update their security-
related blogs frequently and are a great resource
even if your organization does not use these
platforms.
• Security-focused firms that have excellent technical
coverage of cyberthreats include Volexity, Rapid7,
and Trend Micro. KrebsOnSecurity is a very well-
known and respected leader in journalistic coverage
of cybersecurity. Zero Day, from the journal ZDNet,
and Threatpost are other excellent online resources
for staying informed about the cybersecurity threat
landscape.
• https://www.techsoup.org/security Leverage your
engagement with Techsoup through the generous
partnership of our Corporate Donors such as Cisco,
Microsoft, Norton, Avast, and Bitdefender.

14. Thank You!
Michael Enos
menos@techsoup.org