Digital security for organizations

How does an org navigate digital security? The anatomy and roles of that process

Why does an org start? - fear - motivation - justice

Remember the CIA: - Confidentiality - keep the private stuff private - Integrity - has it been changed? hacked? corrupted? - Availability - keep it available to people who need it when they need it - stop the DDoSing

1. Grounding - Before starting, you must foment motivation to create digital security. - takes the longest period of time - convincing leaders to prioritize security is the hardest and most important thing - lead by facilitators; role needs no special training - Why does an org start?

 - fear
 - motivation
 - justice

- harm reduction - many groups, especially marginalized groups, are already sensitive to this

 - not about eliminating threats, rather, about minimizing risk
 - best practices
 - reduce risk without compromizing values or overcommitting

- holistic security

 - digital security, border crossings, secure communication, protected archives, protection from physical threats
 - cataloguing all threats to a population and thinking about ways to reduce them
 - Holistic Security Manual
 - digital, physical, mental / emotional wellness

- everyone in the community and org are involved

 - when you lack full buy-in,
   - if at leadership level, you are stumped
   - if below leadership level, work with leaders to bring everyone in 
   - work with everyone to build awareness and buy-in around why security is important

- facilitators can start and hold process - what does safety and security mean to you? - data is at risk, not only from bad actors, but from natural disasters - frame it as collaborative, rather than brought in by external experts

2a. digital assessment - can happen concurrently with 2b - how do you use tech?

 - email
 - dropbox
 - slack
 - where is your data kept?
 - who has access?

- includes data privacy, but is not limited to

 - security is vs an external attack 
 - privacy is a function of internal workflow

2b. risk assessment - also called threat modelling - surveillance - doxxing - how likely is it that a bad actor will try? - how likely is it that a bad actor will succeed? - if a bad actor succeeds, what will the consequences be?

3. analysis and recommendations - hardening - tighten all the security screws - anti-doxxing training - remediation plans

4. implementation and training - digital security trainings at this step

5. and repeat - think of how long it takes people to floss consistently. security is not a silver bullet; it’s a practice. - build towards sustainability - think of it as data hygiene - sometimes security changes, and you have to re-train - build security and privacy into the culture, so it doesn’t feel like a strain - gamify - levelup.cc

Practices: - https://ecl.gy/sec-check - readiness assessment tool

 - consistent tech support
 - build comfort around tech
 - build a culture of training and learning

- email safety checklist

 - encryption
 - ethical providers

- wireless safety checklist - password and authentication best practices checklist - endpoint security checklist - devices - GSuite checklist - keep yr software and websites up to date - little documentation reminders - encourage orgs to allot more general operating funds - most breaches are human, not technical

 - like password conventions
 - or someone calling up, claiming to be a temp, and asking for a password reminder
 - or leaving your passwords written on post-its

- Twillio or GVoice to protect private phone numbers - just don’t use private phones! you want to own and control all data in your ecosystem, to wipe data from devices if they get lost or stolen