Tools of the Trade:
Stocking a Technology Security Toolbox for Your Nonprofit
Nonprofit managers have an array of tools to choose from that can protect an organization's technology from intentional and accidental harm. Your strategy for protecting technological assets from harm could be simple and relatively inexpensive, or elaborate and costly. We've assembled an array of tools that provide technology security. It's up to you to decide which tools are appropriate for your nonprofit in light of your operating environment, equipment specifications, and resources.
Passwords
The most basic form of protection is six characters long - it's your password. Access to your organization's network and other vital resources should be maintained using a password system. Everyone can afford to do this; the expensive part is if you fail to have them. (The high-end alternative is an expensive, high-tech biometric system.) Good passwords should have the following characteristics:
- a combination of letters, numbers and symbols
- at least six characters
- easy to remember but hard to guess
- not easily obtainable - never use your birthday, anniversary, or child's name
- private - never shared with others
- changed regularly (every 60 - 90 days)
- NEVER written down and left where they can be found by anyone
If each person's user name and password is taped to his or her computer monitor or keyboard, how hard is it for a disgruntled employee or former employee to do mischief or serious damage?
Backups
Maintaining useful backups is vital to your organization's ongoing health. In the event of a security breach, computer crash, file server theft, fire or other disaster, you can restore your data and work products to the date of the most recent backup. This, too, is relatively inexpensive: the cost of extra floppy disks, CD-ROMs or tapes, perhaps and external hard drive. The expensive part is if you fail to run the backups and the system is damaged or destroyed.
Backups should be run each day, on a two- to four- week cycle. Aim to replace your backup medium every six months, based on how frequently it's used in the cycle. For instance, if you alternate two disks, CDs or tapes, they will wear out more quickly than if you have five separate disks, CDs or tapes, one each for Monday through Friday.
Periodically run the restore procedure of your backup program to test your disks, CDs or tapes for their ability to restore your data properly. They are of no use to you otherwise. Store your backups offsite and/or in a fireproof safe. Remember that if a thief takes all the computer backups along with the server or if the building burns, you won't have the necessary means to get your nonprofit up and running. There will be disappointed clients, disgruntled board members and employees at a loss.
Although difficult for those on tight budgets, to be safe, you should have some form of backup for network devices, servers and power systems. At a minimum, this requires an uninterruptible power supply, a backup hard drive for the server (complete with current copies of server software and all the data and applications on the server), and extra copies of devices, such as modems, needed for remote access. If you can, maintain an understudy server waiting in the wings that can be put into service if the main server goes down. Perhaps you can put the specifications for the hardware on your donor wish list or forgo another budget item until this is purchased.
Virus-protection Software
It's estimated that each month, 200 to 300 computer viruses are transmitted over the Internet. A growing percentage of Internet users have downloaded viruses that have damaged systems or data. A virus may be packaged with an appealing e-mail subject line to entice the recipient to find out more. Generally speaking, it's when the recipient opens the e-mail attachment that the damage is done. Viruses can range from highly damaging, such as one that corrupts data on a hard drive, to benign, such as one that displays a humorous message or joke. Sometimes they do both. In either case, removing a virus from your systems can be time consuming and potentially costly. Files that have been corrupted by a virus have to be restored, or in some cases, recreated, and infected systems have to be carefully contained and cleaned or they risk infecting other machines. One industry estimate puts the price tag for repairing and restoring systems infected with the "Love Bug" virus at more than $2 billion.
Several good virus-protection programs exist on the market today, although they must be regularly updated to provide adequate protection. McAfee and Symantec produce the top-selling virus-protection software. Both companies sell packages for as few as one user to as many as thousands, and both offer online updates of virus definitions as long as your service agreement is valid. They are relatively inexpensive and can save you a great deal of time and trouble. Providers update virus definitions often. Honor provider alerts, which are sometimes sent more than once a week, to protect against the latest bugs. Some virus-protection packages designed for small businesses (less than 10 users, in one case) require that each user periodically update virus definitions from his or her computer. A license for a large system will enable the definitions to be updated from the server. If you're relying on each staff member to update his or her virus definitions, make sure they understand the importance of this step and know what to do. In addition, visit your vendor's Web site to download the latest patches recommended for your software.
Surge Protectors
A vast number of events could cause your critical computer system to experience trauma or break down altogether. Power surges - an unusually high demand for energy, such as during a heat wave; power spikes - a short-term high level of demand for energy; and line noise - general electrical static that produces small interruptions in energy flow are among the most common. Most surges in power don't affect your systems if you have a surge suppressor, commonly known as a surge protector and are relatively inexpensive. They vary in size and run from $10 to $60; it's worthwhile to shop around for the best value. The simplest surge protector can be purchased for every computer. You've seen them. They're long rectangular solids with multiple outlets that plug into the wall outlet and have on/off switches. One of the problems with surge protectors is that when they are working properly, they wear out. They should be replaced every three to four years.
Uninterruptible Power Supply
An organization needs protection against partial and total power losses, as well as the unintentional, but potentially harmful, trip-over-the-power-cord incidents. The tool for this job is an Uninterruptible Power Supply unit. A UPS unit senses dips or surges in voltage and immediately switches from electric current to battery power. The battery life of your UPS will determine the price you pay, ranging from $80 to $5,000. To determine how much capacity your nonprofit needs, visit the UPS selector form at the American Power Conversion Web site, www.apc.com. Large networks with heavy power requirements require greater UPS capacity than smaller networks. For instance, a vital, heavy-duty server in a large organization may need to have a longer battery life for an emergency shutdown than one in a less critical environment, which may only take a minute or two to shut down and runs only moderately vital tasks.
Firewalls
A firewall is the first line of defense to block intruders from your network while allowing authorized users the maximum flexibility. Located between your nonprofit computer network and your Internet connection, this separate program or device allows or denies entry. While it isn't a perfect device, a firewall is a strong deterrent to those who would seek to breach your nonprofit's computer network security. Firewalls help keep hackers out by adding an additional level of security to your basic system, and most have the capability of generating activity logs so you can see who tried to access your system and what kind of system traffic you have. It can be as simple as a DSL modem with built-in firewall. There are also stand-alone firewalls costing around $500. Other products combine hardware and software, or hardware and operating system and firewall software.
According to Russ King in the TechSoup Special Report Firewalls and You: You're not paranoid, if they ARE watching you, software costs between $2,000 and $10,000. He claims "hardware systems are often much easier to install and require lower system resources."
The firewall can take a variety of forms, from personal firewalls that protect individual PCs to high-level network firewalls, which are a must for any organization whose users have a broadband (high speed) "always-on" connection to the Internet (such as cable modems and DSL).
Firewall products are available from a number of vendors, including Check Point Software Technologies Inc., Cisco Systems, Intel, Zone Labs, McAfee and Symantec. To learn more, visit the guide to firewalls featured at www.interhack.net/pubs/fwfaq.
Before you begin shopping around to get the most capability for the least price, ask yourself these questions:
- What do you want to pass through the firewall: e-mail, authorized users' Internet access, etc.?
- What is the purpose of your firewall: regulating and monitoring traffic, or restricting everything except HTTP/Web traffic?
- What risks come with these choices?
- What's more important - security or usability?
Put Your Tools to Work
Once you've selected and assembled your tools, you're prepared, but you're not finished. You have to keep your tools in working order, replace them on the schedule suggested, and use them appropriately. Otherwise, your nonprofit is needlessly vulnerable to losses and other harm. Which means less time and resources will be available for your community-serving mission. Take care of business and your mission by fortifying your equipment and systems, today.
Back to top
|
