Introduction

When the coronavirus pandemic became a widespread threat in the United States and employees had to pack up their things to begin working from home, the data security measures permitted by remote work were low on organizations’ lists of priorities. Leaders were, as they should have been, focused on their employees’ health. Yet, remote work generally poses greater security threats to organizations than in-person work since, for example, employees use home networks and access organizational information on personal devices.

Seven months later, the majority of arts organizations are still not able to open for normal operations or allow all employees to return for in-person work. This pattern is not expected to change for several more months, and many thought leaders project that remote work will remain as a choice for many.

Therefore, now is a good time for arts organizations to evaluate the cybersecurity measures they have in place for remote work. Even before the Covid-19 pandemic, cybersecurity was becoming a bigger threat for smaller organizations and nonprofits, so being aware of these issues can aid arts organizations’ long-term operations and potentially open the door for more remote work opportunities in normal times.

What is Cybersecurity?

According to Cisco, a networking hardware company, cybersecurity is “the practice of protecting systems, networks, and programs from digital attacks.” Digital attacks can take many forms and are not limited to hackers in dark basements trying to steal an organization’s classified information. Several types of attacks are based on social engineering, which tricks an employee into sharing information or taking an action, such as clicking on a link. These forms of attacks then often install malware, “a type of malicious software installed onto a computer or system without the consent or intent of the user.” [1] The following are four major types of social engineering attacks:

1. Baiting: A hacker takes advantage of an individual’s curiosity and uses a false promise to steal the user’s information or install malware. Baiters can accomplish this using hardware, such as a malevolent USB drive left around the office that, when plugged into a computer, compromises the system.

2. Phishing: In this type of attach, hackers send mass emails that include a message meant to trick users into divulging passwords or personal identifiable information (PII). The message might look suspicious and say something like, “click here to reset your password.”

3. Scareware: By convincing users that their systems have been compromised, hackers prompt them to secure their system by installing (malicious) software.

4. Spear Phishing: A form of phishing that targets a specific individual, organization, or business. This could be something like an email designed to look like it’s from your boss, as seen in the video below.

Other types of attacks avoid the social engineering tactic and are designed to disrupt operations or compromise data. Examples of these types are:

1. Advanced Persistent Threat: “A sustained, embedded attack the strives to remain undetected, enabling surveillance, service disruptions, and data theft over a long period of time.” [2]

2. Denial of Service: An attack that blocks users from information system resources or services.

3. Man-in-the-Middle: Hacker inserts themselves between client and server to collect information the individual sends. This can happen, for example, between an unsecured Wi-Fi hotspot and an individual’s computer.

4. Data Extraction Attack: A hacker executes a SQL query to a database using the input data from the client to the server. If they are successful, the hacker can access all the information in the database, modify it, or delete it.

5. Ransomware: A type of malware that threatens to publish its target’s data or permanently block access to it unless the victim pays a ransom. This particular type of cyberattack has been on the rise during the Covid-19 pandemic.

To protect against these attacks, an arts organization would need to prevent outside access to its data, IT systems, and programs. While employee awareness and training can go far to protect against social engineering attacks, organizations may have to implement more technology-based solutions to prevent against attacks intended to disrupt operations or compromise the data in a system.

Why Should Arts Nonprofits Care?

While nonprofit arts organizations may not see themselves as potential targets of cyberattacks since their servers do not hold government secrets, for example, there are many reasons why hackers would want to gain access to their systems. One reason is that nonprofit arts organizations store data about high-profile, wealthy donors that is attractive to bad actors. Other times, hackers are just trying to make money, as in the case of a ransomware attack, and know that smaller nonprofits would be easy targets since they have fewer resources to protect against cyber threats.

There are also risks to arts organizations outside of their small nonprofit status. In May 2020, anonymous hackers completed a ransomware attack on the third-party cloud software company Blackbaud and gained access to the personally identifiable information (PII) of donors to several hundred cultural institutions, including the Smithsonian Institution and the National Trust. Many arts nonprofits store sensitive information about patrons and donors using third-party software, leaving the data’s protection outside of their direct hands. Selecting a secure system is of incredible importance. Even when organizations are able to retrieve their files and no PII is shared publicly after an attack, the knowledge that an organization is vulnerable to these types of attacks leads to a loss in trust in the institution from donors and the public.

Risks Caused by the Covid-19 Pandemic

The Covid-19 pandemic and widespread implementation of remote work has exacerbated the need for cybersecurity policies and procedures. Because the onset was abrupt, arts organizations did not have the chance to make sure there were procedures in place to create the most secure remote working systems.

Remote work creates risk because employees access organizational information on personal devices in the case that they did not bring a work computer home (which is often true with arts organizations’ limited resources) and use their home or public networks to work. Both personal devices and alternative networks are less secure than what employees would use in the office. According to Sean Mooney with Cybereason, “personal devices often lack the strong antivirus software, customized firewalls, and automatic online backup tools built in to business networks.” Additionally, many people do not change their home router password after it is first installed, leaving their entire home network vulnerable.

Since people are more digitally connected during the pandemic, there has been an alarming increase in cyberattacks. According to the FBI, its Cyber Division is receiving as many as 4,000 complaints of cyberattacks a day—a 400% increase from before the pandemic. This increase includes coronavirus-themed phishing and other social engineering attacks, which prey on people’s fears and vulnerabilities. Since many people are online all the time, it is generally easier for hackers to successfully execute cyberattacks. Arts organizations need to be aware of this environment as they continue to work from home and develop plans to do so more securely.

Overview of Solutions

Since many arts organizations are continuing to work from home, and remote work seems to be sticking around in some capacity for the foreseeable future, arts organizations should start implementing some basic solutions to increase cybersecurity. Solutions are not just about spending money on new technological solutions; human action also plays a major role in making remote work more secure. Below is a general overview of the steps arts nonprofits can take towards stronger cybersecurity.

As indicated in the first step of the infographic, now would be a good time for arts managers to evaluate the cybersecurity protections offered by software they are already using. While, in the Blackbaud case, the company handled the breach swiftly and paid the ransom, Tyler Cohen-Wood, a cyber-security consultant and the former cyber deputy chief of the Defense Intelligence Agency, pointed out that Blackbaud merely took the hackers’ word that the copy of the stolen data was destroyed. To find a software company that is reliably secure, according to Artnet, “[Cohen-Wood] advises that museums employing third-party providers familiarize themselves with the company’s procedures for handling ransomware attacks and to have secure data backups, even if that means paying extra.”[3]

In an upcoming post about what cybersecurity measures arts organizations should have in place for remote work, I will include specific recommendations based on what a selection of arts organizations are doing. For now, an easy first action that arts organizations could take is asking employees to be more vigilant with the emails they are sending and receiving with the knowledge that the pandemic has led to an increase in phishing attacks. Organizations could also remind employees to have strong passwords on their home networks, personal devices, and accounts.

In general, some basic solutions for work-from-home security problems that arts organizations commonly face are cloud storage, virtual private networks (VPNs), password managers, multi-factor authentication, and mobile device management (MDM).

• Cloud storage, when chosen well, provides a secure way for all employees to access files remotely.

• VPNs “bypass geographic restrictions on streaming sites and other location-specific content” and provide a more secure way to access information by encrypting all internet traffic, making it unreadable to anyone who intercepts it.[4]

• Password managers and multi-factor authentication both add extra layers of security to employees’ individual passwords

• Mobile device management solutions allow for “the remote implementation of a number of security measures, including data encryption, malware scans, and wiping data on stolen devices.”[5]

CONCLUSION

It may seem fatalistic to ask arts organizations to prepare for the worst cyberattack situation—one that might seem unlikely—but managers should think of cybersecurity as another aspect of making their organization stronger, just like ensuring patrons’ physical safety and protecting the organization’s financial health. Now that the pandemic has forced many aspects of arts organizations’ operations online, managers can use this opportunity to survey their organization’s digital landscape.

[1] Afua Bruce, Cybersecurity for Nonprofits: A Guide, NTEN, February 2020.

[2] Bruce, Cybersecurity for Nonprofits: A Guide, NTEN.

[3] Sarah Cascone, “Hackers Have Stolen Private Information From Donor Lists to 200 Institutions, Including the Smithsonian and the UK’s National Trust,” ArtNet News, September 2, 2020, https://news.artnet.com/art-world/hackers-hit-smithsonian-parrish-corning-1905256.

[4] Sean Mooney, “Cyber Security Tips For Allowing Employees To Work From Home,” Cybereason, August 20, 2020, https://www.cybereason.com/blog/cyber-security-tips-for-allowing-employees-to-work-from-home.

[5] Mooney, “Cyber Security Tips For Allowing Employees To Work From Home.”