RENXT Security / Anti-Hacking Measures

Suzie Capps

Hi everyone,

Following the news of a recent cyberattack on another CRM system (not Blackbaud, and not one we use), I started wondering about how protected RE NXT data would be in a similar scenario.

If an attacker were able to obtain a copy of a database backup, would Blackbaud's encrypted fields remain unreadable within that backup, or are there limitations to that protection?

Also, has this influenced what types of constituent or supporter information you do or don't store in RE NXT? I'd be really interested to hear how others are balancing usability with security and data minimisation.

Thanks!

Rachel Cavalier

I was thinking about this because I'm a supporter of a couple of charities who use the CRM you're probably talking about, and I got their notification emails about the attack on Monday.

I don't think this has influenced the type of information we store or how long we retain it in RE NXT any more than GDPR and other previous regulations and internal policies already had done so. I think some of my colleagues would love if we had more demographic information about our supporters, but it's just not something we've ever really collected so it's not in there.

Additionally, the database for the people we serve is unconnected to RE - so the more sensitive data that could potentially be there is kept separate. The only "connection" is that someone checks our list of supporters who have passed away in the last week and updates the records of any that match in that database.

Bill Connors

Suzie, good questions. You might find helpful the links in the 4th-6th bullets from this page of my website:

https://billconnors.com/resources

Alan Cole

This is unfortunately a sign of times we live in today. The sad truth of the matter is the cyber security is often reactive to breaches. When system gets hacked, the security folks build a new lock. Then the thieves build a new lockpick and cycle continues. If cybercrime is being government sponsored as news agencies have sometimes claimed, then one must assume that nothing is safe.

Maybe someone will figure it out one day, but in the meantime, you can only make is as hard as your resources allow. This is why Blackbaud added a $600 fee to our annual contracts… They needed more resources to thwart future attempts after the Ransomware incident in 2020.

But as referenced by few folks already, start by asking yourself do you really need all the sensitive data you collect. In cases where you don't, then don't keep it. For examples, the college I work at needs each student's social security number. The school's foundation does not… so the foundation doesn't get access to it. Security is all about layers aimed at making it as hard as possible for sensitive data to be exposed. There isn't a magic bullet that does it all.