Security

1. Data protection

Our participant data is the number one target for cyber-attackers. So, we prioritize data security when strengthening network security. To fortify against cyber threats, our data protection strategy is multifaceted. We employ advanced encryption for all sensitive data, ensuring it's secure whether stored or transmitted.

• Transit Data Protection. Use encryption for data at rest and in transit (SSL/TLS).
• Sensitive Data Protection. Classify and protect all sensitive data with secure encryption.
• Couple encryption with Data Loss Prevention (DLP) tools. These tools track critical data and block exfiltration attempts by unauthorized users.
• We limit staff access to confidential data. This restricts the threat surface for cybercriminals. If malicious actors gain access, they will have limited access to the data that matters. Measures include:
  • Applying the principle of least privilege via access controls. Authorized users have access only to the resources they need. But the rest of the network is off-limits without authorization.
  • Minimizing the number of accounts with administrative privileges. Developers cannot make global changes without approval from our Chief Technology officer or higher seniority level. We routinely remove unused or over-privileged accounts.
  • 2FA Authentication. Software used for handling data has two-factor authentication before accessing them.

2. Incident response

A natural disaster could occur at any time. We have a robust incident response plan in place, providing a roadmap to system restoration and threat containment.

Incident response plans activate when attacks take place and feature the following steps:

• Threat identification and containment
• Protection of critical data
• Threat elimination and mitigation
• Restoration of system functionality
• Mapping network damage or loss of data integrity
• Auditing the incident response process and learning lessons to improve the security posture.

We carry out testing drills that simulate real-life attacks and make sure all staff know their role in the incident response. We try to balance thoroughness and speed when responding. We are clear about when to move to the next stage but move as quickly as possible.

3. Backups

We have a cybersecurity plan that requires backups of data and critical workloads before attacks occur.

• We store all critical data. We categorize databases and workloads according to their importance.
• Our backup data is required to restore network and website functionality in the event of ransomware attacks.
• We chose a cloud backup partner that encrypts our files securely and provides rapid access to company data when needed.

4. Education

We ensure staff are aware of phishing risks, and focus on the dangers associated with unsolicited email attachments. Business phishing is becoming increasingly sophisticated. All our network users must be aware of how to detect malicious messages.

We help to train staff to use access controls safely. We explain why multi-factor authentication exists and how authentication systems work. We write clear policies explaining the security obligations of staff. And include details about how to change security settings via secure channels. We store our security policies centrally, and make them freely available to all our network users, on request.

5. Remote access

Our Security measures include:

• User access via Virtual Private Networks or secure remote access software or platform.
• Denial of access from insecure public Wi-Fi networks.
• Central approval of all remote work devices.
• IP allowlists and adaptive access controls to block unapproved devices.
• Training to enforce password hygiene and anti-phishing knowledge.
• Mandatory reporting of lost devices. Automated removal of access rights for users affected by device theft.

6. User Access

Users have an option to link and login using other platforms like Gmail. These increase their account protection by anchoring to well-established secured third-party account providers.

7. Strong passwords

• We make password hygiene a core part of our security training procedures.
• We require strong passwords with a mix of lower- and upper-case letters, as well as non-alphabetic characters.
• We enforce mandatory password changes. Users should change passwords at least quarterly to protect against credential thefts.
• We source a secure password manager to automate password management and make this available to all network users.

8. Regularly updating software and systems

• We automate updates on all network applications and devices. This includes servers, routers, and hardware firewalls.
• Audit software updates at least once a year. Apply any patches missed by automated delivery systems.
• Regularly consult threat databases to stay aware of current exploits. Remember to check exploits to SaaS services as well as on-premises applications.

9. Managing vendor and third-party risks

When choosing third parties to work with, we assess potential partners carefully. They should have clear security policies, including information about data collection and sharing. And ensure potential partners are happy to adapt to our access management practices. We treat third-party accounts just like our staff. We add them to centralized access management systems, and limit their privileges to prevent access to confidential data. We make sure staff gain approval for all third-party access, including non-human APIs associated with cloud services.