View source for Digital risk assessment

There's a continuum when talking about security

* High Security => Lower Function
* Low Security => Faster Response

* Different contexts require different contexts of discussion
* Women have a great intuitive sense of risk assessment

 Real security is about processes and people, not tools
 —Ken


==Questions to Ask About Data You Want to Secure?==
1. What Am I Trying to Protect
* List of addresses
* social security numbers
* contacts of activists
* Info on my phone
2. Who am I protecting it from?
* Government
* Crackers (malicious hackers)
* Commercial entities
** Paid shills/moles
** Koch brothers counter-intelligence
3. What Happens if the Data Leaks?
* CA has notification laws
* What could happen to individuals and businesses? There may be monetory penalties
* Even nonprofits can be sued over data breaches
* Think up best/mid/worst case scenarios
4. What Am I Willing to Do to Protect it?
* Will I encrypt it and what level of encryption is appropriate?
** End to end? General?
		
		
==Culture of Security==
* Fundamental piece of security is open communication with your team
* Keep each other informed about what sensitive stuff is going on
* You can't secure what you don't know

==Data Containerization==
* Depending on the risk level, Ken's org will store different stuff on different servers
* Must assess what you're collecting and decide what must be done with it
* There are laws regarding storage of things like credit card info and medical info
** That's why you should outsource responsibility when needed
** Storing CC info is a lawsuit waiting to happen. Let your payment processor handle it. They're better at it

==Context Matters==
* If you're involved with confrontational politics, you're going to want to utilize higher security measures
* The government has a long, shameful history of counterintelligence, subversion, surveillence, and illegal action against political bodies
* It's important to understand the big picture of surveillance and understand where exactly we fit into this picture


==Tools==
* Sophos Point Protection
** Data loss protection
** Notifies you of downloads and uploads
** Staff click-through tracking
* LastPass password managment
** Great nonprofit discount if you ask for it
* Two-Factor Authentication
** Must perform second, person specific action to log in
* Federated Login
** Like when you can `Log in with Google` to a service like StackOverflow

[[Category:2016 Watsonville]]