Month: October 2022

Common Red Flags to Help you Identify Phishing Emails and Texts

• The email address contains a random mix of letters and numbers
• The text is from an unknown number
• The email or text contains typos or odd language
• The email or text asks you to buy something
• The email or text asks you to provide financial information
• The email or text asks you to provide personal information about yourself or someone else at the church, especially the senior/executive pastor, a decision maker, etc.
• The email or text asks you to download an attachment or click a link — if someone you do not know is asking you to do either of these things, that is suspicious!!!
• The email or text asks you to purchase gift cards (iTunes, Apple or other gift cards) and then send the activation code on the back of the gift card

One tip for preventing these types of emails from ending up in your inbox in the first place is to avoid posting your staff email addresses on your website in plain text or with an email link. Cyber criminals can easily crawl your website for email addresses, so if you include everyone’s information in an online staff directory, you are making yourself an easy target for receiving these emails. An alternative is to only have one general email address on your website that all online inquiries go to. Whoever manages that email address can forward requests accordingly, and this person needs to be sure they are trained in cybersecurity and hyper-aware when sifting through emails.

 

Sample Bulletin Announcement about Emails or Texts Impersonating Priest or Someone from the Parish

By policy of the Diocese of Sioux Falls, priests and deacons will not request financial assistance for their personal needs (cash or gift cards) from you via text message or email. As many have posed as our clergy while trying to scam parishioners of funds, we urge individuals to first verify they know the sender before ever giving money. If you are in doubt, please call the parish’s office.

Multi-factor authentication (“MFA”) has emerged as an important tool to provide an additional level of verification beyond user passwords to protect information systems and user data. The goal of MFA is to verify identity and to make sure the person logging into an account really is the person they are claiming to be. MFA is FREE and one of the easiest things you can do today to significantly increase the security of your church staff and their accounts. Overall, we strongly believe that MFA is a vital element in any comprehensive approach to security.

Passwords Aren’t Enough

Why is this necessary? Security experts know that passwords alone simply are not an effective deterrent to cybercrime and security breaches, because there are so many problems with the way that most people handle their passwords, from creation to use.

The most common password mistakes include:

• Using easy-to-guess passwords, e.g. birthdays, addresses, pet names, etc.
• Writing and/or storing their passwords in easy to find places (hint: the sticky note on your monitor or desk is not secure!)
• People share their passwords with others.
• Many people use the very same password for all or multiple services, applications, devices, accounts, etc., thereby creating unnecessary exposure for themselves in many important areas of their life and work.
• Many have unwittingly provided their password via spoofed sites or phishing emails that are created to steal these passwords.

As a result, passwords are stolen and compromised all the time. Your own passwords may very well be compromised and residing on a list of thousands of other stolen passwords for sale to those who would use them for negative purposes.

How Does MFA Work?

So what does that have to do with your church? Well, churches maintain a lot of personal data, including very sensitive data about member’s giving and financials, staff social security and payroll data, and pastoral counseling notes. The church staff has to be able to trust that systems are secure and working properly so they can perform their ministry jobs. A breach could be harmful, embarrassing and costly. This is where multi-factor authentication comes in.

MFA provides a second layer of security by adding a step to the sign-in process when someone uses their password to log in to an MFA-enabled account. How does it work? Typically, MFA employs a code that is updated on a timer. This code is sent to the user’s trusted secondary device via a text message (or a pre-downloaded app) when they use their password to log into a MFA-enabled account. The user is prompted to enter the current MFA code. Without using the MFA code or the verification app, access to the account is prevented, regardless of whether a user has the proper password. There are typically multiple options for delivery, including text, email, or app, for the user’s convenience.

While it can be argued that MFA adds a basic level of complexity to the log-in process and the need for some basic user training, the benefits of the level of security it provides to user accounts is far greater than these small adjustments. The main “barrier” is the necessity of a smart phone or secondary device, but is safe to say that almost everyone has one of those these days.

The Benefits of MFA

When you really break down the process, it is quite simple and user-friendly. It simply makes it harder for OTHER people to log in to your account. Not every single product and platform supports MFA, but it is our best practice recommendation that if MFA is an option, you should enable it.

The main benefits of MFA are:

1. It is FREE!
2. It is an easy way to immediately increase the security of accounts for every user in your organization
3. It is increasingly available on most platforms that include a log-in system

At this point in the cybersecurity game, Multi-Factor Authentication is a necessary element of a basic user-security setup. The minor inconveniences of a slightly longer sign-in process and training are far outweighed by the extra level of security it provides. Of course, it is not a “silver bullet” that will solve all of your problems. MFA covers breaches at the log-in step, but it does not cover voice phishing, physical security, a lost USB stick, or an end-user falling for social engineering tricks. Tools like MFA must be coupled with solid end-user security awareness training, the most important layer of security to which organizations must give their attention. Awareness of the types of schemes employed by cyber criminals and others who would cause harm is the most effective protection against security threats. Nevertheless, MFA is an effective, accessible and easily-implemented step in creating a more secure environment for your church.

This article was pulled from enableministry.com

Multi-Factor Authentication: A Must-Have for your Church!