September 11, 2015 By David Strom 3 min read

Running an IT security department in a nonprofit or charitable agency is very different from what’s found in a typical for-profit corporation. I spoke to David Goodman, who has held CIO jobs in a variety of nonprofits and is now the CIO-in-residence for NetHope, a membership organization serving the needs of the CIOs from 43 of the largest international nongovernmental agencies, including World Vision, Save the Children, The Nature Conservancy and Oxfam. To his knowledge, only one has a dedicated CISO.

In his universe, Goodman rarely sees the kinds of regulatory and compliance structures and level of security that are commonplace in the average bank or even a local business.

The Importance of People

Goodman likes to talk about “people security” being the main concern in many of the organizations he works with. “Some of the staff are working in places that are literally dangerous, and they could be in harm’s way or arrested or abducted,” he said. “If certain information gets into the wrong hands, people could die.”

Goodman noted that most nonprofits run very lean and don’t have huge IT budgets. “We are probably decades behind the for-profit sector in our use of technology. Many organizations are just at the beginning of using technology and how it gets baked into their operations. This means that typical tech VPs have had 25 years under their belts at a profit-making company. But in the nonprofit world, a typical VP probably has never seen much in the way of deploying technology and in many cases is just beginning to use it. So the usual scenario is that most nonprofits are trying to figure their technology out, [and] in some cases starting from a clean slate.”

Two Steps Forward, One Step Back

That doesn’t mean that everyone is behind the times. When he worked at the International Rescue Committee, the organization registered some of its refugees with retinal scanners so it could track them and what services had already been provided to each individual. But it employed a third-party vendor for this service and relied heavily on its efforts to maintain overall operational security for this particular application.

Goodman has also seen that the typical nonprofit doesn’t have any global security strategy. They usually don’t even know where their critical data is stored or how it is cared for. “Sometimes we actually use paper files!” he remarked.

Nonprofits Struggle With the Budget

The hard part, as most of us know, is that being secure is quite expensive, both in terms of tools and training. “All of this costs a lot of money, and most nonprofits generally don’t have it to spend or want to spend it on their programming or mission,” Goodman said.

“Even something as common as a simple spreadsheet gets complicated if it is stored on someone’s local hard drive,” he says. “There is no backup, no central mechanism to identify where this file is located or even make a copy to the corporate network. Data is all over the place. Many organizations operate in very distributed environments in very austere places. They are in some small village or someplace where they can’t easily connect up with the corporate network with poor bandwidth. They have to develop their own solutions. While having a cloud-based solution helps, they need the training to use it effectively.”

Speaking of the cloud, the advantages usually cited by for-profit companies don’t usually work for nonprofits. “The problem is that a cloud solution like Box doesn’t replace anything that was used before. It isn’t like we can retire an old server and pay for it out of that savings. Instead, having a cloud solution means spending opex funds, which is a lot harder for nonprofits because they operate so leanly. With nonprofits, it is usually easier to pay for technology out of capex funds. In the end, you have to make tradeoffs, and security doesn’t always get the top of mind.”

Recruiting employees or volunteers who are adept at cybersecurity or IT techniques could be a huge boon for these nonprofits, but they’ll still face big challenges with regard to budgets, data storage and training. Still, these organizations cannot afford to fall even further behind.

More from CISO

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Boardroom cyber expertise comes under scrutiny

3 min read - Why are companies concerned about cybersecurity? Some of the main drivers are data protection, compliance, risk management and ensuring business continuity. None of these are minor issues. Then why do board members frequently keep their distance when it comes to cyber concerns?A report released last year showed that just 5% of CISOs reported directly to the CEO. This was actually down from 8% in 2022 and 11% in 2021. But even if board members don’t want to get too close…

The CISO’s guide to accelerating quantum-safe readiness

3 min read - Quantum computing presents both opportunities and challenges for the modern enterprise. While quantum computers are expected to help solve some of the world’s most complex problems, they also pose a risk to traditional cryptographic systems, particularly public-key encryption. To ensure their organization’s data remains secure now and in the future, chief information security officers (CISOs) should educate themselves about quantum computing, proactively address the coming quantum risks to cybersecurity and work to establish cryptographic agility in their enterprise.A future cryptographically…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today