Padlock CC-BY Rachel Titiriga/Flickr

I’d be willing to wager that you, like me, have been offered “credit monitoring services” more than once in the past few years, because a place you’ve done business with or a past employer was hacked, potentially putting your personal data out on the market.

Corporations and governments, while they are struggling to keep up with hacks, do have resources and teams devoted to the battle. But smaller, much more vulnerable victims of attacks deserve our attention too.

Non-profit organizations around the world are also targeted by cybercrime, and don’t have the benefit of expensive services or personnel monitoring or protecting their systems.

And it’s not as if these small organizations don’t have valuable information — from pre-published research to healthcare data, records of environmental transgressions to election monitoring procedures — development and civil society work around the world collects reams of information that, in the wrong hands, can put an organization or its beneficiaries at risk. Even a lost smartphone or laptop will contain contracts, financial data, and private conversations embedded in the constant steam of emails.

Organizational security can feel like an impossible task, and many security audits or “penetration tests” are expensive and can be too aggressive for most small organizations. Vulnerabilities exist but fixing them are not necessarily high-priority for the organization.

Over the past two years, Internews has developed SAFETAG™ (Security Auditing Framework and Evaluation Template for Advocacy Groups) to address this challenge.

What is SAFETAG?

SAFETAG provides a framework that a digital security expert can use to help organizations identify and prioritize the risks they face and suggest a tightly-focused path to mitigating them. This path to increased safety is designed to be responsive to the actual capacity of an organization. This last element is critical. We have learned that even the best-laid plans will go to waste if the organization is not capable of implementation.

Audits based on the SAFETAG methodology start by working with the organization to explore the information and processes that they consider the most valuable.

For a media or journalism organization, for example, there might be calls and emails between a writer and confidential sources, which then turn into a working draft that is emailed between the author and editors before being sent to a webmaster to be added to the website. Are the phone calls sensitive? Should they be made over an encrypted connection? Where are the emails being stored? Work laptops? Personal smartphones? Email servers hosted by the organization?

The answers to each of these questions help the auditor and the organization think about where vulnerabilities that actually matter to the organization might be hiding. The process mixes interviews, exercises and technical verification and scanning, including documenting what the organization thinks it does versus what it actually does. The goal is to make all the organization’s processes and practices — not just the official ones — safe.

At the end of the day, SAFETAG is like the stone soup parable — the deepest impact comes from the organization taking the time to reflect on the threats they realistically face, the danger this puts them in, and their capacity to reduce these risks over time. The auditor is a catalyst with the resources to make it happen.

Radical Openness

Another way that SAFETAG differs from more traditional security audits is that the entire framework is open source and licensed for reuse and re-mixing. Even the trademark on the name “SAFETAG” is meant to encourage organizations to adapt and build on SAFETAG — it requires auditors to avoid calling their work a “SAFETAG audit” but instead use phrases more like “based on SAFETAG.”

SAFETAG continues to evolve — as of today, Internews has trained 13 digital security auditors around the world and performed audits and risk assessments based upon the SAFETAG methodology for 20 at-risk organizations. More exciting than that, however, is organic uptake of the SAFETAG methodology. Other organizations are conducting their own versions of audits based upon SAFETAG.

The entire methodology is open and available on github, with active conversations around the future of the framework visible in the issues queue. “Compiled” versions of SAFETAG are available at https://www.SAFETAG.org .

The future of SAFETAG is to drive — and be driven by — this cross-organizational adoption. Working with this community, Internews is creating a set of practices and a common language that make up the SAFETAG “core activities,” along with with a “plug-in” type approach for advanced SAFETAG topics that auditors can provide to help organizations work through not only digital security risks, but also financial, reputational, or even legal risks.

Interested? We’d love to see you over in our issue queue!

(Image credit: Padlock: Plovdiv, Bulgaria – Rachel Titiriga/CC-BY)