2022 Security Best Practices: Top 8 Trends for Associations

It’s no secret that cyberattacks are on the rise, and while most people think the 'IT folks' can protect them simply by investing in advanced firewalls and other security measures, this isn’t the case in 2022.

Threats old and new are bearing down on organizations that decision-makers have to contend with. For example, hackers often use phishing scams to trick employees into giving up their personal information or downloading vicious malware that infects computers.

Needless to say, cyber hygiene and security needs once again topped the list of CIO concerns in 2022. So what actions do associations and nonprofits need to take now to remain resilient against the rising volume and increased complexity of cyber battles?

Here's a list of the top security best practices and megatrends that should be top of mind in 2022 in order to mount a strong defense against more frequent, intricate, and malicious cybercrime incidents. These are the main key initiatives that cybersecurity experts are addressing to prevent attacks on organizations in the year ahead.

The spectrum of ever-evolving attacks covers six main categories: cloud threats, ransomware threats, vulnerability exploits, commodity attacks, IoT (internet of things) threats and supply chain attacks.

Trend #1 - Formalize Your IT Security Policy

Your organization needs formal security policy to protect themselves from data breaches and minimize damages from potential cyberattacks. In fact, creating (and maintaining) a documented policy should be a top cybersecurity priority and the first thing your organization checks off the list.

Security policies are a comprehensive and consistent set of standards that specify how information systems and data should be protected. Include guidelines for policies such as: who is allowed to access certain information, what types of devices have access, processes for sensitive data handling, and routine protocols for preventing unauthorized access.

More importantly, be sure your IT security policy aligns with organizational goals in order to deliver long-term value and a better member experience. Use your security policy to scale up your cybersecurity priorities.

Your people, processes, and technology should be in sync with your privacy and security practices by design. Successful implementation requires support from a well-trained team and strong vendor (and end-user) relationships.

There are tons of ways to develop and document an IT security policy that is accepted and adhered to organization-wide. The important thing is that you do it!

Consider all cybersecurity risks within your policies and procedures. Common types of malware include viruses, trojans, ransomware, spyware, worms, and phishing attacks.

There are also increasingly prevalent “software supply chain” attacks that occur when a third-party vendor is breached. These indirect security threats put your organization’s member and user data at risk of falling into the hands of malicious actors.

A truly comprehensive IT security policy should also highlight your data governance practices and proactive “privacy culture.” In order to secure the integrity of your association’s data and infrastructure in the years ahead, your organization needs a transparent culture of privacy with an integrated governance framework.

Trend #2 - Deploy Identity-First Security Best Practices

Compromised credentials was the most common type of cyberattack in 2021, responsible for 20% of data breach incidents.

You can bet threat actors will continue these “secondary fraud” and “double extortion” attempts going forward, increasing the level of sophistication as they learn and adapt.

To combat these data breaches, identity-first verification is now the focal point of identity and access management (IAM).

The following are examples of identity-first security methods that your organization should adopt and provide to all members, internal employees, and website users to prevent this threat.

Zero Trust

The journey towards mature ‘Zero Trust’ is a cybersecurity transformation based on a “never trust, always verify” approach to digital identities – both for humans and machines. Essentially, this comprehensive IT security model is about not trusting any user or device, even if it’s connected to your network.

Zero Trust adoption, deployment, and innovation is rapidly evolving. The goal is to wrap mature Zero Trust architecture around all available data points. In other words, the user’s identity, location, device, security health, service identity, and permissions are all verified before the user is granted access to your organization’s resources.

The complexities of today’s threat landscape and distributed workforce demands we shift our network defenses towards this proactive and intelligent security posture. Why? Mature Zero Trust prevents breaches, and when the inevitable does happen, it contains the damage and reduces the cost by $1.76 million on average.

So how can you establish trust and confirm the digital identity? There are two primary ways that organizations are ensuring only authorized users are accessing organizational resources:

1. Multi-factor authentication
2. Passwordless authentication

Multi-factor authentication

Multi-factor authentication (MFA), or strong authentication, is a key component of Zero Trust that’s taking center stage in 2022. Truth is, MFA is the only real way to bypass increasingly elaborate cybercrime antics.

You need at least one extra layer of security in your digital identity validation process (hence, 2FA, aka two-step authentication or dual-factor verification). Single-factor authentication just isn’t cutting it anymore. You need to confirm users are who they say they are at every access attempt.

Really, the strongest and most sustainable identity-first security solution is MFA. Multilayered identity-confirmation also enhances protection in remote access situations, distributed workforce arrangements, and other “perimeter-less” environments.

Here’s the difference between 2FA and MFA authentication mechanisms.

• 2FA works like this: when you log into a site, you’ll be asked to provide two pieces of information (typically, username and password). 
• MFA pairs an additional layer of validation to 2FA: typically, sending an approval code via text or email over an encrypted channel to verify your digital identity. This way, even if someone manages to steal your username and password, they won’t be able to access your account without also having access to your phone.

Passwordless and SSO

Passwordless authentication will also (finally) start taking off in 2022. And for good reason — passwords are a real headache for the people who use them and who manage them.

Because of its frictionless login experience, passwordless authentication (aka modern authentication) is a particularly attractive identity-first mechanism for associations that still have a multitude of loosely integrated or non-integrated software systems and applications.

With it's uptick in popularity, hackers will inevitably find a way to beat the system — it’s not a matter of if, but when. So, for passwordless identity confirmation to be effective long term, you’ll need to adopt MFA as well.

Single sign-on (SSO) will continue to be important as well in order to increase cybersecurity without sacrificing the end-user experience. SSO simplifies the member experience for associations that haven’t invested in integration platforms.

Also, be sure every staff member and volunteer in your association integrates identity-first security processes on their social media accounts, email providers, banks, etc. to keep themselves (and others) protected.

Trend #3 - Implement Security Awareness Training

A cyberattack can come at any time, to any organization. It doesn't matter how advanced your firewall is or how much you invest in security measures – if someone knows what they're doing, it's easy enough to trick an employee into downloading malware or other fraudulent attempts to compromise personal data.

That’s why organizations in 2022 are working on integrating cybersecurity awareness training programs. Include your training regime and protocols in your security policy to shift your organization towards a ‘cyber smart’ mindset, not necessarily ‘cyber hard.’

In fact, regular security awareness programs are one of the most important things that your association can do to avoid a cybersecurity breach and privacy compliance violation. Taking only a few minutes, a single staff training session could save hours or even days of wasted time and millions of dollars ameliorating the consequences of an attack.

Data governance and specialized training are vital components of security awareness programs. Refer to your formal security policy and governance procedures when identifying specialized training needs and countermeasures. Your policy will clarify specialized IT cybersecurity roles, responsibilities, and competencies of relevant staff members.

Identifying and responding to threats

The primary purpose of cybersecurity awareness programs is to teach your staff how to detect, report, and respond to different types of cyber threats and third-party vendor “software supply chain” vulnerabilities that threaten your data, systems, and organization as a whole.

Phishing scams are a particularly common cyber assault. Every day, phishers steal millions of dollars – and these social engineering attacks are only becoming more sophisticated and brazen with each passing day.

Phishing attacks involve sending an email or text message with malicious links or attachments that trick people into revealing their personal information or downloading malware. It’s much easier to break through firewalls using phishing email and text scams, which is why they’re so popular.

Point is, everyone in your association should be aware of any and all direct and indirect security dangers lurking around the corner at all times, regardless of how brazen, dangerous, or frequent they may be.

Key cybersecurity training best practices

Here are some key tips and tricks to keep in mind when developing your awareness program:

• Data governance should be an integral part of your training program to solidify the lines of authority while empowering all staff against cybercrime and compliance violations.
• Equip staff with the knowledge and training to protect themselves from each type of identity theft and security risks.
• Analyze training methods and associated security best practices for specialized roles.
• Regularly hosting training sessions incrementally increases defenses across individual staff and departments.
• Balance accountability and feasibility organization-wide when determining training frequency.

Trend #4 - Establish an Incident Response Team

2022 will be a tipping-point year for incident response and holistic threat detection. If one member of your association suffers a data privacy breach – whether by a hacker or another member of the staff – your whole association will suffer as well.

To avoid such a disaster, every association should have a formal, security-savvy incident management team. The goals of the incident response team are to:

1. maintain IT security and threat intelligence for ongoing operations
2. identify and remediate vulnerabilities
3. minimize business disruption and protect operational continuity

This incident response team should also be in charge of risk management and preventative controls. For example, this team should perform routine data backups to keep everyone’s information safe in case one computer or employee device is compromised.

Data backups also make recovering from a cyberattack much easier. All you need to do is restore the backup files on another device. This process can take minutes without having to interrupt normal operations.

Trend #5 - Adopt Cloud Security Best Practices

Digital transformation has propelled cloud adoption forward, bringing with it a new set of cyber threats. In order to get these security risks under control, organizations are moving further away from on-premise infrastructure. If you haven't already, it's time to prioritize comprehensive cloud security posture management (CSPM).

Similar to IT cybersecurity in general, cloud security best practices maximize data protection, Zero Trust, and risk management. It’s also important to partner with a trusted and reliable cloud provider when migrating to centralized cloud services.

Another megatrend in 2022 is cloud security through automation.

Trend #6 - Leverage Cybersecurity Automation

When regularly updated, automated security artificial intelligence (AI) is much, MUCH better at detecting and responding to ever-changing cybercrime events and the growing volume of attacks than humanly possible.

Smart deployment of security automation essentially handles the monitoring and remediation of data breaches. In turn, your IT staff can remain focused on value-added activities that drive business results.

Plus, full deployment of advanced security AI has the greatest cost-mitigating effect on data breaches, reducing costs by as much as $3.81 million. Before you can automate any process though, you have to formalize all related processes in your security policy.

Include your plan for regularly checking anti-virus programs and anti-malware apps to ensure they’re always up-to-date and running effectively on all computers in your organization.

Automated anti-virus and anti-malware programs

Anti-malware programs essentially scan, identify, and remove different types of malware (aka “malicious software” files) that steal personal information or hold files hostage.

While these malware “guardrails” won’t detect and destroy every threat lurking in the depths of your computer, anti-virus software minimizes the likelihood of an attack. For example, installing these programs reduces the chances of hackers stealing personal information, infecting your organization’s operating systems, and even rendering your entire network inoperable.

Keep in mind: anti-malware programs only work well if they’re updated regularly.

Trend #7 - Get Cyber Insurance

Another risk management priority in 2022 is cyber insurance. Cyber insurers hone in on your information systems security, preventative control, and auditing practices.

Your organization must have proper protections in place to get cyber insurance at a doable price, or at all, in 2022. For example, you need layered identity verification (aka multi-factor authentication).

Trend #8 - Update Your Security Assessment for 2022

It’s high time that associations and organizations of all kinds update our security best practices to fit the increasingly interconnected digital age. The days when we thought in terms of firewalls and isolated breach instances are long gone.

Getting a formal IT security policy in place and beginning your journey towards a unified Zero Trust environment should be top organizational security priorities in 2022. Include robust identity-first access mechanisms and specialized training programs within your policies and procedures.

Prioritizing these cybersecurity best practices will help prevent credential theft and increase the resiliency of your software supply chain. The most comprehensive and effective way to understand the state of cybersecurity and identify specific initiatives to prepare your association for the cyber challenges today and digital vulnerabilities yet to come is to conduct an independent security assessment.

This will tell you how secure your systems are, what vulnerabilities need to be addressed, and where you can improve security.  It’s also important for associations to periodically update their security risk assessments so they’re always up-to-date with the latest cyber threats.

Our certified security experts at Cimatri can help demystify the steps you should be taking to protect your association in a digital world.

Check out our full suite of IT assessments (including Security) here.