I'm Mary Ann Kolbasek McGee, executive editor at Information Security Media Group. Today I'm speaking with Stanley Mirzwap, director of the Center for Cybersecurity at Keene University in New Jersey. Stan will be discussing why non-profit organizations and non-governmental organizations or NGOs involved with public health and medical research are potential targets for cyber attacks during the COVID-19 crisis. So, Stan for starters, what sorts of non-profits and NGOs are potential targets for cyber attacks related to COVID-19 and why?
The one thing I'll start with is that there are many folks may not realize that there's such a mix of non-profits and NGOs that are involved in global public health work and research. And the mix includes things such as international organizations and these could be quite large, think of the likes of the World Bank, WHO, these are very, very large organizations and they have specific missions and driven activities and purposes. There are also scientific organizations and these exist to advance science around the world with research and serving to advance particular missions and calls. And these could be very likely posed for threat factors and attacks mostly because they're involved in researching various factors perhaps related to COVID-19.
Additionally, there is advocacy and policy organizations and they are there pretty much to work to bridge policy and public health communities. They often research and recommend strategies to governments in countries and these could also be targeted mostly because they could be involved in implementing programs that could be domestic or in the developing world. Finally, I would say there's another large segment in those with non-profits and those are foundations. They're very large that could be big ones and small ones and they are often the ones who fund non-profits and NGOs for specific called upon research and programs.
So with regard to COVID-19, any of these listed type of non-profits or NGOs could be targeted for cyber attacks if they are involved in pursuing COVID-19 research and activities. This could be involved in the response to the COVID-19 pandemic or on the research side. And just to note, the United States Agency for International Development, USAID, has made, I believe, upwards of 900 million U.S. dollars available to help you governments internationally and this includes NGOs and other organizations helping to respond with the fight on the ground with COVID-19.
So the funding is to be used to slow the spread, care for the affected via public health research and otherwise. And I raised this because if I'm a non-profit or an NGO, I don't want to hurt my chances for receiving the precious funding available because of a cybersecurity incident. So it's important that even before you get the funding and start to do the work, that a non-profit and NGO have good defenses in place. This is, I think, especially in this current time when donors are making less funding available.
So Stan, how and why are these organizations potentially more at risk or more vulnerable for falling victim to cyber attacks than other healthcare sector-related entities? I will refer back to, in 2017, I initiated a cybersecurity survey of non-profits and NGOs. It was a survey around readiness and preparedness in cyber threats. The survey was made available to IT leaders at a variety of non-profit and NGO organizations.
And one question I posed, queried recipients about whether their organizations contained a formal cybersecurity unit or had specific staff members responsible and assigned to protect the computing environment. And the result of that, one simple question was that 49% of the respondents did not have such a focus. And so for those organizations who answered to not having a formal cybersecurity unit, I also asked if they planned to incorporate one in the following year. And 11% of the organizations said they did have a plan, but an overwhelming 86% said they did not have one in place.
So just thinking of that, and this is just a few years ago, this is an old survey, and perhaps maybe some changes have been made since then, but it's really indicative of how hard it is for a non-profit or NGO to stay on par with other healthcare sector or large organizations, especially since these sorts of operations may require, you know, the large organizations have to rely on HIPAA and other health related regulations, maybe not so with the NGO. So they may have the funding in the large organizations and more resources. But organizations with non-profit budgets may not have the funding available to create information technology and or control assessment units to work towards better protection. So you kind of put yourself in the mind of an NGO or a non-profit, and their primary goal for the most part is to exist to service specific goals.
You know, that is to work towards a mission and focus efforts on obtaining funding and reducing costs and working towards that mission. So their entire incentive structure is built on these goals, and unfortunately, good cybersecurity generally does not accomplish or align with these goals. So I often refer to a number of various based on organizations, but a general figure that's often considered when you think about cybersecurity program percentage-wise of a budget, that's a decent figure. And in most organizations, what you'll hear is, well, about 10% of the IT budget should be focused on cybersecurity.
That could be very difficult to combine a non-profit or NGO. Now, given COVID-19, if there is a heightened potential for a risk event or a cyber event, that number may need to go higher than 10%. So that really will depend on the risk appetite set by the board and the executive team. So if an organization is very risk-averse, I could see that number being 15% of their IT budget.
So the funding mechanism, I think, makes it difficult for some non-profits and NGOs to be able to put forth really extensive cybersecurity programs. So stand with all that said, how do potential attacks on these non-profits and NGOs impact the risks faced by other organizations during COVID-19? If a research-based nonprofit or NGO is involved in any type of activity, there might be some data collection in the course of those activities. Data collection is logging into a system, into a computer, maybe even onto paper, then transposed onto a system.
And especially when it comes to sensitive topics being captured, this could lead to a potential for the threat landscape being compromised. So it's strongly possible that a non-profit or NGO is utilizing, let's say, third-party products or tools in the course of the research. That increases the landscape for both the nonprofit and NGO, but also the third-party provider. So think about it as we're using cloud systems more and more.
There's a potential, if it's being used by an organization targeted, maybe the cloud provider might face some risks as well. So on other areas, I would say connectivity to various suppliers or supply chain, that would be another avenue for another organization connected with the nonprofit or NGO donor systems. As you receive funding from organizations, as I mentioned earlier, from foundations, for example, there might be a donor system involved. It's not owned by the nonprofit or NGO, but to be utilized, perhaps, for logging, reporting information.
And that could have an impact to their threat landscape and widen it as well. Now, please note, there are current pharmaceutical for-profit companies now working on treatment and vaccines for COVID-19. And this could be in the developing world. Now these internationally developed or international developing world efforts, many times will include NGOs or non-profits as part of their team.
And that's mostly because of the on-the-ground tasks. It would be better for them, more efficient for these organizations coming up with these products to partner with an NGO or non-profit if it's to be done in the developing world because they have more access locally. So, bad actors may initially target the software targets, in this case, being the smaller outfits connected with these large organizations. So, Stan, what are the cyber attackers and cyber criminals potentially after when they attack these non-profits and NGO?
For instance, are they hacktivists? Are they looking to steal research data and intellectual property? Are they looking to disrupt operations and supply chains, extort money? What would be the motivation?
There's many, and it could be difficult to say exactly for what the bad actors or cyber attackers are after. But if one is to consider specific motives that may be approached in the current pandemic environment, it's possible that gaining intellectual property related to research, biomedical research, global public health, response mitigation strategy, general research data that may benefit the bad actors or the organizations behind them, that could be one angle. The adversaries may set as a goal just to get a foothold into a partner or connected organization being a non-profit or NGO. That could be for use later on, for example.
So, there's lots of different areas, but the motives will be dependent upon those bad actors and what where they feel there's a greater benefit in using legal activities. So, Stan, what is your security advice for how these non-profits and NGOs can better prevent falling victim to these potential attacks? What other steps can these organizations take to prevent cyber attacks from ultimately impacting their organizations, but also other entities and possibly patients? You know, there are simple steps that could be taken, and sometimes it's the more humble approach to get started that would be beneficial.
But if I'm a non-profit or NGO that maybe doesn't have a true cybersecurity unit or focus or can't afford to have one, it might be wise to have a third party firm evaluate their cyber defenses. And just performing rapid cybersecurity risk assessment, you know, this sort of outside evaluation will be valuable in obtaining a nine-biased report of the organization's defenses, and it would be better to try and head off any of these, maybe as I like to say, low-hanging fruit attacks, especially if the non-profit or NGO is involved in any sort of COVID-19 related efforts or research. On top of that, you know, if you want to get a bit more technical, what most organizations need to employ when it comes to, at a grand, you know, looking at this from a 30,000 foot view, some of the mitigating factors to help mitigate risks would include segmenting your network. You know, you want to ensure that you're not all that flat when it comes to your network, because without, you know, these segmentation safeguards, you know, could be a major playground for threat actors.
You want to make sure you have good strong identity and access management in place. Use multi-factor authentication. We hear that over and over and over, but there are plenty of systems and solutions and organizational critical products that don't employ that. Goodness, employ at least privilege access, minimize the threat footprint, right?
Might be difficult in a smaller organization, non-profit or NGO, because they may have one person doing two or three jobs, but to the extent possible, you need to do that. More granular administration access. So for those staff members who are accessing the systems at an admin or root level, for example, use privilege account management, limiting the time frame that an administrator can walk into a system, make it a bit more difficult for the administrators to access it, which could be seen as cumbersome for admins, but it does track what's going on and it minimizes risks. One last thing I would say, especially because there's the potential for incidents, is review your cyber insurance protection.
When is the last time that was done in a non-profit or NGO? You'll go through the evaluation process with an insurance firm and broker. Focus on cyber. What is their feedback?
You may learn a whole lot from just the process without even buying additional insurance. Finally, I would say if you are attacked and you need to respond, ensure you have an incident response plan in place and ensure the plan is exercised. Run the plan both internally but also with your supply chain. As we're talking about here, connecting, we're in such a team environment today with collaborations amongst organizations, especially when it comes to research and where non-profits and NGOs get involved, run it with the suppliers in mind.
Engage your plan with open communication. Don't forget to exclude your legal department, your communications folks, your tech support, your frontline folks answering the phone so they are aware of what's going on. It's still recommended that when it comes to threat actors, we're not going to negotiate. If there are those sorts of situations, keep in mind that the Department of Homeland Security, CISA, and the FBI can be called upon to assist in these situations.
I don't know if IT teams are aware they could reach out if necessary, and ensure this is very important that you're careful with your evidence, your forensic evidence. You don't want to harm it or disqualify it from being useful if an investigation is required. So I said a lot of things there, but you know, there are steps that could be taken perhaps without lots of spending, but at least to get some awareness and knowledge into how well-posed the non-profit or NGO is. Thanks, Dan.
I've been speaking to Stan Merzwa. I'm Mary Ann Kolbusak-McGee, of Information Security Media Group. Thanks for listening.