We've Been Hacked! & Smart Data Storage

Tony Martignetti
Hello and welcome to Tony Martignetti Nonprofit Radio, big nonprofit ideas for the other 95%. I'm your aptly named host and the podfather of your favorite hebdomadal podcast. And I'm glad you're with us. I'd suffer the embarrassment of salpingum fraxis if I had to hear that you missed this week's show. Here's our associate producer Kate with what's coming.

Kate Martignetti
Hey, Tony. This week we return to our 25NTC coverage with We've Been Hacked. Our panel from the 2025 Nonprofit Technology Conference helps you with actionable takeaways to strengthen your incident response plan. You do have an incident response plan, right? They reveal the right responses and responsibilities for your leadership, IT, communications, and other key roles. They are Steve Sharer from RipRap Security and Danielle Eliser with Chef Ann Foundation. Then smart data storage. Brian Cavanaugh and Tiffany Nyklickova want you to avoid common data pitfalls while ensuring your data is smart, secure, and searchable. They consider the pros and cons of cloud versus onsite storage and explain how folder structures, file names, and metadata make your data organized and easy to retrieve. Brian is at the Vilcek Foundation, And Tiffany is from Services in Action. On Tony's Take 2,

Tony Martignetti
self-care.

Kate Martignetti
Here is We've Been Hacked.

Tony Martignetti
Hello and welcome to Tony Martignetti Nonprofit Radio coverage of 25NTC, the 2025 Nonprofit Technology Conference at the Baltimore Convention Center. Our coverage is sponsored by Heller Consulting. technology consulting for nonprofits. With me now are Steve Sharer and Danielle Eliser. Steve is CEO and co-founder of RipRap Security, and Danielle Eliser is Senior Director of Technology at Chef Ann Foundation. Steve, Danielle, welcome.

Danielle Eliser
Thank you. Thanks so much.

Steve Sharer
Thanks for having us.

Tony Martignetti
Steve, welcome back.

Steve Sharer
Yeah, thank you.

Tony Martignetti
Last year's NTC as well. Your session topic is We've Been Hacked. An interactive incident response tabletop exercise workshop. There's a lot there.

Steve Sharer
A lot of nouns. Yeah. Yeah.

Tony Martignetti
Well, you did. Yeah. There's only one verb in all that, right? There is only one verb in all that, in those 2 sentences. Steve, our resident security expert, why don't you give us a high-level view of what your session covered earlier yesterday?

Steve Sharer
Sure. Yeah. Yeah. So our session was all about How to prepare for a cybersecurity incident and how one of the main ways that you can prepare is by undergoing a tabletop exercise to simulate what an incident is like with your staff before you actually have an incident. So you get a chance of what it feels like and what you should be doing and if your plans are set up in a way that's actually going to help you.

Tony Martignetti
All right. Now, we're not going to have the luxury of an exercise here on Nonprofit Radio, but I know you both have takeaways. Either from strategies in general, but also maybe takeaways from yesterday's session. So let's see, Danielle, why don't you start with some substance? Like, what should we be thinking about? This is all in preparation. So we're not gonna have, like I said, we're not gonna be doing the exercise, but what should we be thinking about in advance so that when we do call Steve because we've been hacked, Yeah. his response can be, I guess, as seamless as possible, or at least we're as best prepared as we can be for the— for what we hope never happens.

Danielle Eliser
Sure. I think the big thing we realized when we were putting this presentation together was that a tabletop game is very similar to a cybersecurity incident in that you have some rules, but you don't know all of the information and it's going to change and you are not going to be able to predict where you go. And so you really have to be flexible When an incident occurs, I think the first step is calling someone trusted or having someone on your team to cover the security, and then just giving them as much information that you know and working from there. It's a really flexible process that you have to be able to pivot through depending on what you find out.

Tony Martignetti
So you really would like to know who you're going to be calling?

Danielle Eliser
Yes.

Tony Martignetti
Maybe, maybe it's 2 different teams in case one is not available or something, or—

Danielle Eliser
Step one is have somebody on your phone. Yeah, because time is of the essence and you don't have a lot of time to spare. So knowing who you're going to call is probably the first step. We were very fortunate that when we had an incident, we had RipRap already contracted with us, and they were my very first call, and they jumped in right away. So knowing who you have on your team that's going to be able to help support you is going to be such, such an easier path than trying to figure it out when you're in the crisis.

Tony Martignetti
Yeah, I know. I mean, you'd be interviewing firms in the midst of a crisis. Your head is not going to be on the interview process and what's your timeline and what's our budget. I mean, we need to— all right, so these things all need to be in place.

Danielle Eliser
Exactly.

Tony Martignetti
You should be having these conversations now.

Danielle Eliser
Right. Unfortunately, it's very common to find somebody while you're in the middle of a crisis. I know Steve has mentioned that a little bit, of they often get these panicked calls and everybody jumps on board and does the best they can. Oh, they

Tony Martignetti
don't know your platforms, they don't know your user base. I mean, well, Steve is going to tell us all the things that he wants to know when you make that call. Um, can— what can you share about the, the Chef Ann hacking?

Danielle Eliser
Yeah, so I'll keep it general. Um, we had actually started working with RipRap a couple of months prior, and so we had some things in place, but not nearly— we weren't, you know, robust, uh, in the way that we had hoped. And, um, You know, we just started getting prepared and an email came through to our accounting department. They had, they had the right form, they had the right invoice, they had everything looked good of like, oh my gosh, we have to get this check out by the end of this week. Can you guys just make this happen? Everything looked good. And somebody within our accounting platform just flagged it a little bit of like, this is unusual. Usually I hear about this beforehand and pass it up to me.

Tony Martignetti
Gut check or instinct?

Danielle Eliser
Instinct.

Tony Martignetti
Is there value, Steve, in instinct?

Steve Sharer
For sure. There's a ton of value in instinct. Okay. Yeah, for sure. I mean, it's that— listen to your gut. That if it looks weird, smells weird, it most likely is weird.

Tony Martignetti
Raise a flag.

Steve Sharer
Yeah.

Tony Martignetti
At least raise a flag like this person in accounting did. Right. So go ahead.

Danielle Eliser
And she was even apologetic too. She was like, I just don't want to bother you. And I was like, oh no, no, no. You think this is weird? I think this is weird. Let's go. And so we were able to bring in RipRap immediately and resolve it. And thankfully there was no impact. We caught it early, but I can't overstate how quick it was and how unexpected it was. You know, it was a random Tuesday. You know, like nobody expects this on a Tuesday. And so it was really, really, really beneficial to have somebody on our side already and just not something we ever expected, even though we had already been preparing with them. So it can really happen to anyone.

Tony Martignetti
And after the fact, RipRap maybe did forensic work for you or something. Did you figure out, was it based on artificial intelligence, or had they penetrated part of your system to get the— you said it looked authentic, it had the right data. How did they get what they needed to make it look so good?

Danielle Eliser
Yeah, I'm trying to remember. This was about a year ago.

Steve Sharer
Yeah, so a lot of times the attackers will try to elicit, like, payment forms, invoice forms from organizations by pretending to be somebody that's maybe in their world or in their network, saying, hey, we're a new vendor, and they'll get some of this paperwork already. Oh, okay. Um, even if they haven't conducted a breach of the actual nonprofit. So that, that wasn't their case, luckily. They didn't have— the attackers did not have access to the Chef Ann Foundation computing resources, which is, which is great. Um, but you, These, these hackers, they don't need it a lot of the times. They can, they can socially engineer and elicit a lot of this information from the finance staff and the other staff that are out there in the community.

Tony Martignetti
I have a panel coming up on the show, uh, yeah, later, later today talking about the use of artificial intelligence in, in, in gathering personally, personally identifiable information. So they're not, not, uh, again, like to your point, not needing to go into the platform or the resources of the organization. But through artificial intelligence, putting it all together to make an invoice look real, or, you know, whatever it is that they're— whatever their mechanism is for infiltrating, making it look very authentic because it has so much personal data.

Steve Sharer
Yeah.

Tony Martignetti
Yeah. All right. All right. So, but that didn't happen in your case?

Danielle Eliser
Yeah,

Steve Sharer
it was just before the explosion of large language models and ChatGPT. A little ahead of that.

Tony Martignetti
Yeah. Okay. Yeah. Okay. Oh, you said last year. It was sometime last year. Okay, uh, so Steve, uh, all right, so hopefully, uh, folks have, uh, RipRap Security or another, uh, exemplary— it's hard to imagine, uh, any other firm being as good as RipRap Security. Thank you. But, uh, you have— you found one of the few that are, or you're using RipRap. What do you want to know, uh, first call?

Steve Sharer
Yeah, yeah. So I mean, I, I think the, the first call, we, we try to understand What are the timelines? Who's involved? Like, what are the broad sketches of the story? What's happened to date? And what systems are affected? What things are— do we suspect that the attacker might have access to? And that sort of starts to help us orient who in the organization that we're working with we should talk to, what systems we should start focusing our forensics and technical experts on, and really start trying to work the problem and understand. I mean, a lot of the times our Our customers, when they have an incident, they're— they have limited information. They know that they had a weird email on a Tuesday, and— but they're looking to fill in the gaps, right? This is as much of those kind of classic mysteries, you know, as— it's no longer— it's not just a, you know, 22-minute murder mystery on TV. It's usually many days. But we try to sketch out and do that kind of investigative work to understand the timeline. Right. I

Tony Martignetti
just thought of another reason why you'd want to have an agency lined up ahead of time, for access.

Steve Sharer
For sure.

Tony Martignetti
Access. You obviously need remote access immediately.

Steve Sharer
Exactly.

Tony Martignetti
Now we've got to, you know, maybe we have to go through a hurdle to get that done. Yeah. If it's not lined up in advance.

Steve Sharer
Exactly.

Tony Martignetti
Time is of the essence, as you said, Danielle.

Steve Sharer
Mm-hmm. Yeah, and I think trust is a big area too, right? By the time the Chef Ann staff had their incident, we had already spent much, a lot of time with Danielle. Yeah, 6 months, right? with the executive staff and other members that are, you know, doing the more hands-on work. So they knew me, they knew our team, they were comfortable with us. We didn't have to build that rapport, you know, in a relatively short time. It's just, it's just a lot better.

Tony Martignetti
And in the midst of a crisis. And in the midst of a crisis, right. I don't know if I can trust these people. Yeah, yeah. He said something weird, but I don't have time to worry about it. Right. So I have a flag, but I can't wave it.

Danielle Eliser
Right.

Tony Martignetti
All that is resolved if you have— all right, I've already— Hopefully encouraged folks to have a relationship in advance. You know who you're going to call. Okay. Okay. All right. Next step. I don't know, Steve, you want to lead us through? All right. So you've gotten your preliminary information. Do you need the client to do something or what's next? Yeah.

Steve Sharer
Yeah. So something we covered in the talk is how, how can you, how can you best use the organization's existing capabilities, tools, and talents to help you So we often talk a lot about engaging the communications and the marketing staff because they know, they already have a way that they communicate with their donors, with their stakeholders, with the beneficiaries of the organization. And by using their expertise, you can craft really, really clear, transparent, timely communications to the people that might be affected with the incident. We see— Oh, that's interesting.

Tony Martignetti
Interesting. So you're the security guy, you're the tech guy, but you're concerned about the outward communication?

Steve Sharer
Absolutely. Because, I mean, what's a nonprofit without a lot of trust, right? And we see a lot of examples in the tech industry, in broader business world, in nonprofits, that organizations that have incidents that aren't transparent about it, that aren't sharing the whole story, they're not being timely about sharing the information, the trust in their reputation is severely damaged. And so they get less interest. They have less, you know, if they're a company, they lose a lot of customers. And the incident response process is about trying to maintain that trust and that reputation and reduce the impact of the incident.

Tony Martignetti
Danielle, so what's going on at the Chef Ann Foundation now in the 24 hours since you called Steve? Yeah. What's happening internally?

Danielle Eliser
Steve is doing— Steve and his team are doing all of the investigative work of like, okay, what has truly gone wrong? Like, what do we need to find? What's out there? What's the scope of this? Because often it feels just like the tip of an iceberg.

Tony Martignetti
Are there more threats?

Danielle Eliser
Right. Are they in the system? You know, and so he's handling a lot of that, also communicating to my team. My role at the time was to communicate to our internal team because I know Steve. I've been on a call with Steve every week for 3 months. But they may not know Steve as well. And now my board wants answers. So my role turned into very much that internal communication network of like, okay, C-suite, here's what's going on.

Tony Martignetti
I'm on the edge of the cliff with this story. I know the ending was— I already know the ending, but I'm still intrigued by the timeline, by the unfolding.

Danielle Eliser
Yeah, because everyone's concerned. Everyone's just here to do their job to make the world a better place. That's what we're here for. We're not here to build like a Fort Knox system. So we something goes wrong, it's like, oh no, have we been too focused on the healthy meals for kids?

Tony Martignetti
Yeah, it's Chef Ann for pizza.

Danielle Eliser
Right, right. It's not global food. We make lovely food.

Tony Martignetti
I'm not minimizing your work. It's not nuclear arms negotiations policy.

Danielle Eliser
Exactly, exactly. Does someone have a vendetta against whole grains? I don't know.

Tony Martignetti
Quinoa just did not agree with my stomach. I'm lashing out again. I'm taking it out on Chef Ann.

Danielle Eliser
On an organization.

Tony Martignetti
She had a recipe. She had a quinoa pudding recipe on the website just last week and I'm very annoyed. So, let's go ahead and—

Danielle Eliser
yeah, exactly. So, it's a big sea change for the organization, especially the teams that you work regularly with, to shift and say, oh, no, this is actually now a current crisis and something we have to worry about. That presentation next week is no longer my priority. And so, it's often a lot of soothing the internal team and also trying to communicate in the easiest method possible to the internal team. Like, they don't care that it was a business email compromise with, uh, like an MFA concern. Like, they don't want to know all of that. They just want to know we're safe, we're okay, we're working on it, keep doing your job, we'll let you know when we need something from you. And same with the board. The board just wants to know we've got it covered. So it was a very easy thing to be able to call my CEO and say, hey, this is what's going on, I have this update, I'm I'm going to send this to the board. I just want you in the loop. You can send it to the board. I don't really care how this process works. I just need to communicate what I have. Um, and so it really became more of a, like, a switchboard operator of trying to keep the organization calm and steady and on the right path while RipRap was able to, like, resolve and actually investigate a lot of these technical pieces.

Tony Martignetti
And how about with your, uh, your marketing communications team that Steve mentioned? Were you talking to them, or did Steve talk to them directly, or what?

Danielle Eliser
Absolutely. We looped them in per Steve's recommendation. We were very fortunate that we didn't have a public kind of incident. It was very internal. That's true, right. So we looped them in just in case there was a larger impact that we needed to involve them on, but they were ready. They were right on board. I mean, marketing teams can spin on a dime, so they were prepped. They were ready. They had some language already written up by the end of the first day, just in case. So it was really a coordination effort between all of the parties.

Tony Martignetti
OK. Right. Because in the first 24 hours, you're not sure what Steve's team is going to uncover.

Danielle Eliser
Exactly. All I know is that all of my meetings had been canceled, and my COO was trying to buy me pizza, and my husband was bringing me coffee. And I was like, all right, we're in it now. You know, you're still in the eye of the storm.

Tony Martignetti
Yeah. All right. Steve, lead us through the timeline. We're outside the 24 hours now. You know more. What did you— what were you able to uncover in the first 24 hours?

Steve Sharer
Yeah, so it's a lot of timeline information, right? When is the email sent? When is it opened? How many people receive it? How many people looked at it in the organization? What can we learn about the information that you don't get to see in the body of the email, but that's attached to it? So information about the email itself, when it was sent, Who sent it, doing that kind of deep forensics work to understand, can we track down who was responsible for it? Um, and can we, can we report them, right? And, and try to shut down the fraud.

Tony Martignetti
That's good. All right, let's keep that open. There's a mystery that I don't know the answer to. Um, but there is, there's a ton of email data. Sometimes you see it when, uh, an email is undeliverable, and then you see all this string of, I don't know if it's called metadata or what, but accompanying, like, Emails fly all over the world instantaneously. And, and sometimes you see this, this is just, to me, it's just meaningless characters, but you can decipher a lot of information. Yeah. About an individual message.

Steve Sharer
Exactly. Yeah. So we get a lot of information about how the email traveled across the internet from where it was sent, the computer that it was sent to, where it was received. We can understand if the person sending the email is trying to hide their, the true email address of the, um, the person that sent it. Um, and we, we can use it to uncover all of these indicators that, yes, it is a malicious email, because a normal person isn't sending an email with all these weird kind of factors in this metadata that you see. And so it is, um, it is a lot— Yeah. It is possible to, um, understand a lot more by looking at this metadata, and then to use that to Mm-hmm. The investigation to say, have we ever seen the same person try to attempt the same thing against the organization or other organizations that might be in the Chef Ann network, right? Partner organizations, um, you know, beneficiary organizations, to say, let's just make sure that, um, the attacker, if they really do hate quinoa, that they're not going into the Quinoa Association and trying the same attack on them. And so we, we look for these opportunities to say, hey, How can we help other people in the network, or how can we make sure that other people in the network aren't affected? Because we know nonprofits are so highly connected.

Tony Martignetti
Oh, wow. I'm impressed by your holistic thinking. The marketing communications team, get them involved. I wouldn't have expected the IT forensics expert to suggest get marketing involved. And same thing with other agencies that we don't even work with, but can we support them network, or at least, you know, inform the network about potential. Should we?

Steve Sharer
Yeah.

Tony Martignetti
I'm impressed by your holistic approach.

Steve Sharer
Yeah, we try, because I think so much of the risk is from third parties, right? It's not always your organization that's going to get attacked. It's maybe your vendor that gets attacked, and that there the attacker is able to gain access to that vendor's email system, and then the attacker is sending invoices from a legitimate vendor's email address to you to try to get you to send money to a new bank account, right? That's a very common thing we see. So it's not even, you know, the Chef Ann Foundation can do everything right 100% of the time with security, but if their partner organizations aren't doing the same thing, they're, they're still potentially at risk for getting these, these kind of attacks.

Tony Martignetti
All right. Take us through the timeline now. We're beyond 24 hours. What's unfolding?

Steve Sharer
Sure. So we think we We, we really understood after that 24-hour period that the incident was really limited, that there was— there was— the funds were stopped. That's, you know, of course, the main thing. There was no access from the attacker into the organization.

Tony Martignetti
How much did they want, Danielle? What was the invoice for?

Danielle Eliser
I think they timed it perfectly. It was like $49,000. It was just under the cusp of that $50,000 where a lot of organizations want to review.

Tony Martignetti
Okay. Maybe require more signatures or additional review. Exactly. $49,000. $49,999? No.

Danielle Eliser
Yeah.

Tony Martignetti
Car dealership. Okay, I'm sorry. Go ahead.

Steve Sharer
No, no, that's okay. Yeah, so I think knowing, being able to communicate that there, that while there was the email that got sent, there wasn't a true incident in that no money exchanged hands. There was no, um, breaching of Chef Ann accounts or computer systems. And then being able to communicate that, it just sort of brings down the stress level of everyone and says, okay, like, This is— it was, it was an event, right? It's not an incident because there's no real impact, because there's no money that changed hands.

Tony Martignetti
It's a very limited scope.

Steve Sharer
Very limited scope.

Tony Martignetti
Purely internal. You can reassure the board, your CEO.

Steve Sharer
Exactly.

Danielle Eliser
Yeah, my accountant can stop hyperventilating, uh, you know, like, so everybody can just kind of calm a little bit.

Steve Sharer
Yeah. And, and we start, we start turning, we start moving towards closing out the incident, but, and it, but it's, it's, and And this is where we say, we like to use the phrase, like, never waste an incident, right? Never waste the opportunity to learn from what happened in the incident and make changes based on it. We see a lot of organizations, they have these lessons learned sessions afterwards. Oh, we did this well, we didn't do this well. But what we see the gap is nobody's assigned specific action items with due dates of things like, hey, we want you to go and turn on this technology. For any invoice over $5,000, it needs to have a second set of eyes on it. And so, taking these learnings and applying them to the organization and working it into the workflows, not just the IT and the technology side, but the finance side and the, and the communications side, just so that you're more prepared next time, and you're, you're, you're, you're building some muscle memory for the organization.

Tony Martignetti
Danielle, so in the session, uh, what did you see some— what shortcomings did you What did you see that folks in their tabletop exercises were not getting, not meeting the mark?

Danielle Eliser
Yeah, it was really interesting. So the way we structured the session was the first 20 minutes were like a quick slideshow presentation of here's what you need to know, here's kind of the stuff that's going to come at you, and then the incident, the exercise began. And it was really interesting because they wanted more information oftentimes. They were like, Okay, so somebody sent a bad invoice. Now what? And I was like, yeah, now what? You get to figure that out. And they're like, no, but the page is only— I was like, yeah, that's part of it. You only get 3 touchpoints of information to lead your way into this process. And it was really interesting to see how that clicked on, and they were like, oh, this is just like it would be. And they started asking the questions of, well, could we do this? Could we do that? How— How did you handle this, Danielle? And I was like—

Tony Martignetti
That's cheating.

Danielle Eliser
Yeah.

Tony Martignetti
You can't have Danielle's expertise, Danielle's wisdom born of experience when you have your crisis.

Danielle Eliser
Right, right. I mean, we do want to give them a little nudge here and there, but there are no wrong answers, just trying to learn the process. And I think the other thing was a lot of them saw how stressful it can be. Even in a purely hypothetical, you're at a table with 5 strangers at a conference rolling a dice. It's still stressful.

Tony Martignetti
There's no stakes.

Danielle Eliser
Right. This is purely hypothetical, but still imagining your organization going through something like that or making it real of like, well, who would I call? What would I say to the CEO? Who's the marketing head? Was a really good way for them to kind of envision and realize, oh, this is This is at the lowest possible stake level, which means when this happens, if this happens, this is going to be so much more stressful, and we really need a plan.

Tony Martignetti
All right. So I don't know who I should ask to— we opened with you, Danielle, so I'll give Steve the opportunity to bring closure to our incident. Who was it from? What were you able to find out? Were there any— were you able to point the finger at a person or an agency or a company or a country? And what was the— and what happened after, aftermath?

Steve Sharer
Yeah, yeah, yeah. So as oftentimes these things are, the sort of— the end of the story, sort of the final solving of the mystery is kind of anticlimactic. Oh. I know. I wish I could point to, oh yeah, that guy Paul in St. Louis, like he was the guy that —you often can't get that level of information. Um, but we were able to understand, hey, these are the computers that send these emails. We're able to disclose them to entities like the FBI to make it part of their larger cybercrime tracking.

Tony Martignetti
Did it come from domestic? It was from inside the U.S.?

Steve Sharer
It was from inside the U.S. OK. Um, and then what we really spent a lot of time on is, hey, is the plan that we've made for cybersecurity and the roadmap we've worked on with Danielle and her team, what changes do we need to make to that plan of how we're going to improve, how we're going to work together to improve cybersecurity based on what we learned from the incident? There are certain projects that we pulled up, made happen sooner, some we delayed, and it really, it really led to a situation where we were just constantly able to update the strategy for the Chef Ann Foundation to say, hey, we had this thing, we learned a lot from it, and here's how we're gonna apply that in all the work that we do going forward.

Tony Martignetti
Danielle, I guess kind of epilogue, what made you contract with RipRap 3 months in advance? Obviously not knowing what was coming. Well, what was the impetus for putting a relationship in place?

Danielle Eliser
Yeah, actually a little bit of a full circle moment. I had intended Uh, Nonprofit Tech Conference in Denver, and that's where I met RipRap, um, at their presentation.

Tony Martignetti
That was 2 years ago.

Danielle Eliser
That was 2 years ago, yeah. And so, um, started working with them after that and really, really enjoyed our partnership. They'd completed a full roadmap assessment, and so it's, um, it's pretty fun that we met at an NTC and now we're presenting about this at an NTC.

Tony Martignetti
That's great. I got chills. My synesthesia's kicking in. I got, I got chills, literal. Um, all right. That's good. The epilogue is excellent. All right. Even if the outcome— so, just going, Steve, going back to what you were able to pinpoint, could you get to a county or a state?

Steve Sharer
We have rough, like, you're right, we get rough information. Rough geography. You get like, you know, rough geography. Here's the town or the city that they're kind of by. It was, you know, I think Washington State-based, somewhere in the Seattle area. But from there, it's a little hard to pinpoint beyond You have to really be law enforcement or, you know, some spy agency to really—

Tony Martignetti
Like proprietary information that you can't glean from email metadata.

Steve Sharer
Exactly.

Tony Martignetti
Okay.

Danielle Eliser
And from our side, while they're doing all this incredible investigative work, you know, I'm trying to keep my people calm. Having that final report to my board, to my C-suite, to say, hey, here's what we learned, here's what we're doing, here's how we've processed this, was really, really tremendously helpful. It gained a huge amount of trust from the board that our organization was taking this seriously and that we were prepared. And we've gotten so many kudos from them on that incident. So it was, it was truly a learning opportunity that we were able to grow into something more.

Tony Martignetti
Yeah, and I appreciate the trust-building too, that they know that you're on top of— well, you are the senior, senior director of technology— that they know technology is secure. It's something that, you know, maybe you'll report once a year or something, you know, but they don't have to be concerned about as a board or even the CEO, you know. All right, outstanding. It's a good story. Yeah, good story.

Steve Sharer
That's a good story with a good ending.

Tony Martignetti
Thank you for sharing. Yeah, yeah, I'm glad we got the epilogue out. That was very good. All right, uh, they are Steve Sharer, CEO and co-founder of RipRap Security, and Danielle Eliser, Senior Director of Technology at the Chef Ann Foundation. Steve and Danielle, thanks, thanks very much for sharing that story.

Steve Sharer
Thanks for having Thank

Danielle Eliser
you so much.

Tony Martignetti
Thank you. And thank you for being with Nonprofit Radio's coverage of 25NTC, the 2025 Nonprofit Technology Conference, where we are sponsored by Heller Consulting.

Kate Martignetti
It's time for Tony's Take 2.

Tony Martignetti
Thank you, Kate. Self-care. We just had the long holiday weekend, 4th of July. I hope you took care of yourself as well as family or friend obligations. I hope you're taking care of yourself this summer with time, with the sort of chaos that's emerged from the budget bill that passed and its bad impacts in a lot of areas, including our community. Absolutely. It's just so important for you to be thinking about yourself. It's not selfish to do self-care. That is not selfish. That's the best way for you to care for others. You have to take care of yourself first. On an airplane, you put your oxygen mask on first, then you help the— then you help the children who are with you, right? You put your mask on first. Yeah. You got to take care of yourself first, then you can be your best person, bringing your best self to taking care of others, helping others, even working, just working with others. So please, several weeks ago, I reminded you about your meds from Meico Marquette Whitlock, taking care of mindset, exercise, diet. Yeah. And sleep, their meds. And I would also refer you to an episode from March, March 31st. It was with Jennifer Walter, the social worker. That episode was Mental Wellness Among the Chaos, March 31st. Please take care of yourself this summer. It's essential. That's Tony's Take Two. Kate, thought I was gonna miss my cue, didn't you? Thought I was gonna miss my cue again.

Speaker F
You really stuttered there.

Tony Martignetti
I set you up.

Speaker F
People can't see, obviously, us when we, when we speak because it's a podcast, but Uncle Tony kind of— he leaned in and then like took it back and then he went for it.

Tony Martignetti
Yeah, set you up, led you in, led you in thinking, oh my God, 2 weeks in a row he's gonna miss his cue. Or missed the cue, missed my cue, I should say.

Speaker F
Well, at least you're not forgetting my

Kate Martignetti
name.

Tony Martignetti
Yes, right, we're improving. It's a— it's an upward slope. Things are getting better. I remembered your name this week.

Kate Martignetti
We've got beaucoup but loads more time. Now it's time for Smart Data Storage.

Tony Martignetti
Hello and welcome to Tony Martignetti Nonprofit Radio coverage of 25NTC, the 2025 Nonprofit Technology Conference, at the Baltimore Convention Center. We're sponsored here by Heller Consulting. Our topic right now is Data Disasters: Smart Storage for Nonprofits. Bringing that to us are Brian Cavanaugh, Director of Digital at the Vilcek Foundation, And Tiffany Nyklickova, the information specialist at Services in Action. Welcome, Brian. Welcome, Tiffany.

Danielle Eliser
Thank you for having us.

Brian Cavanaugh
Thank you.

Tony Martignetti
Pleasure, pleasure. Let's start with an overview. Why don't we start with you, Brian? We have plenty of time together, but if you could just give an overview of the— Amy is going to do an overview of his session. And what— why you all believe this is important for our nonprofit community?

Brian Cavanaugh
Well, we're using data disasters that nonprofits face, the hardware failures, natural disasters, staff turnover, funding cuts, etc., as ways to talk about data resilience and how data resilience can make organizations information more smart, secure, and accessible to deliver programs and mission-critical work.

Tony Martignetti
Okay. Now, you did not put data resilience in your session topic. Maybe that was going to turn people off, like, data resilience, oh my God. I can't imagine anything duller than data resilience. But data disaster, now we've got an alliteration, we've got disasters, we've got crisis, like There's tornadoes whirling around us. There's a sense of urgency. Yeah. All right. But you, Tiffany, please, why don't you define data resilience for us?

Tiffany Nyklickova
Data resilience is about taking care of your data in a way that protects the organization's integrity. It's— data resilience is about Building a structure where you can rely on it. We talked about how you can manage your information in a way that it's faster, it's quicker, you can respond to things a lot better when you manage your data and the resilience of it.

Tony Martignetti
So I imagine there are some things that we're not doing quite right about data management, and you specifically say data storage. I think we want to talk about cloud versus local. Why don't you keep going for the time being, Tiffany? Lead us into some of the pitfalls. What are some things we should be doing smarter?

Tiffany Nyklickova
So like you said, there are local storage solutions and there are cloud-based storage solutions, and they offer a lot of pros and cons, and it really depends on what you're looking for. So with the cloud, obviously you can work collaboratively with your colleagues, you can access your data from anywhere. It's a very robust system. It can grow with your organization. The fees are fairly low. But you do have the risk of unauthorized access. You know, there are cyber threats that are much more real. Also, you have authorized access. So one of the things that we were discussing is when you click I agree, what are you exactly agreeing to?

Tony Martignetti
Nobody reads all that. Nobody, right? I mean, there's 19 pages. You scroll to the bottom to say I agree.

Tiffany Nyklickova
Absolutely. Sometimes I think it's a game to see how fast—

Tony Martignetti
Do you read

Tiffany Nyklickova
it? Well, you know, no, I don't. Not every time. But for this session, I specifically do sometimes. But you know what? This is a great way to use chat— uh, use AI. ChatGPT can read it for you now, and you can ask ChatGPT questions. What do I care about? What stands out for me? How does this compare against other companies? Uh, and one of the things The other thing that I care a lot about is the authorized access. Right. So when I click I agree, I'm giving, let's say, Google Drive access to my data. They scan it for their own compliance with policies, but also they might use it in their marketing. How do I feel about that? Is my community vulnerable, or are they up against discrimination possibly? So what are my responsibilities with that? And when I expose my data, I'm exposing a lot of people. So your local solutions are, you know, external hard drive, or network-attached storage, or a solid-state drive, external hard drives. There's all sorts of ways that you can move your data from when you're working on it to storing it that doesn't involve the internet. So the pitfalls of that are you can't just access it from everywhere. You don't work collaboratively, so you might end up with tons of drafts of the same document. But you also have much more control because it remains within a physical location. Right. You are— it is vulnerable to attacks, to— sorry, to inadvertent loss or to, you know, damage. It can be, you know, fire damage we talked about, just going kind of extinct. Some, you know, like floppy disks, where are they? Nobody's using those anymore. Sure. You know, so that can happen in the future. So like I said, there's pros and cons to both.

Tony Martignetti
What else in terms of pitfalls? What else, Brian, could we be doing smarter besides storage?

Brian Cavanaugh
Well, we need to think about antiquated file types. So we're talking about the WordPerfects and the Quark files and the floppy disks and all the type of data that may not be as accessible as it once was. And so we need to think about future-proofing that data by using recommended and preferred file types, which is something that the Library of Congress does very well by researching and publishing those recommended file formats in a statement. And so you can, you know, think about your data as a long-term investment by using those recommended file types so that you can have access, you know, long into the future.

Tony Martignetti
Great. What are the preferred formats? Are you able to name the top 2 or 3?

Brian Cavanaugh
Sure. So for digital text-based formats, you're going to look at PDF, PDF/UA. For digital images, you're going to be looking at TIFFs primarily, JPEG 2000s. And for video, you're looking at IMF.

Tony Martignetti
What is PDF/UA? What does that mean?

Brian Cavanaugh
There are different types of coding in a PDF, and oftentimes if you're using a solution like Acrobat or some of the other free tools, you can save a PDF in multiple different formats, and they go back into the early 2000s. It's just different layers of options and features and functionality that are built in, and every year they advance. Yeah. So the most, you know, the most common has has, you know, a wider set of features than it once did.

Tony Martignetti
Okay. So there are preferred formats for files, and why is this? Oh, just so they don't get outdated, for one.

Brian Cavanaugh
Exactly.

Tony Martignetti
Okay.

Brian Cavanaugh
Yeah, exactly. Yeah. Otherwise, you're stuck, you know, using an emulator or a very old machine that may not be secure in the first place to try to open up, you know, some type of file that you haven't needed or Or wanted access to for 15 years.

Tony Martignetti
Right, but now you need it and you can't open it.

Brian Cavanaugh
Yeah.

Tony Martignetti
Okay, or you've got some legacy machine to do it and it has its own vulnerabilities.

Brian Cavanaugh
Right.

Tony Martignetti
Okay. I could be a data storage scientist, aren't you? That's not true at all. Searchable too. We need to be able to get our data, right? Tiffany, let's talk about accessing the data. I mean, yeah, let's talk about that. You've got to get the data out.

Tiffany Nyklickova
You've got to be able to find your data. So you have to be able to categorize it and label it in ways that make sense to you. I mean, we can get deep into a database structure system, but I'm going to talk a little bit more about just the files that people use every day. You know, how do you know that the file you're looking for is the most recent version? Or, you know, let's say you have an opportunity to write a grant application, but it's due at 5 o'clock, and you know you've written a document before. that would apply to this. Where is it? So that's when what you label your document is particularly important. I used to label documents, Tony, I used to label them by the mood of my day, and I never could find things again. And that is a terrible way to name documents. There's a lot of swear words in it, but— and so it's cathartic, but it's not very helpful when you're looking for things. So you need—

Tony Martignetti
The analogy to that is having everything on your desktop.

Tiffany Nyklickova
Oh my goodness, exactly.

Tony Martignetti
I see these sometimes. I go to clients and I see someone's desktop, I think my heart rate starts increasing.

Tiffany Nyklickova
Yeah, I feel—

Tony Martignetti
How can you— like, the desktop is just loaded with folders and files.

Tiffany Nyklickova
I feel that way when I see an inbox with like thousands of unread messages. Oh, oh. All

Tony Martignetti
right, so what's the preferred— you learned, you've come to the bright side now from your— yeah, from your archaic dark, dark days of file naming.

Tiffany Nyklickova
So there— now there's 2 ways of doing things. Now, you might you, but I'm a bit Type A. So I prefer a deep hierarchy where you have things, you know, general, and they get narrow and narrow and narrow. And it's really important when you label a document that it doesn't duplicate any of the naming structure that you've used in the folders before that. So you don't have to repeat the year again and again and again.

Tony Martignetti
Right.

Tiffany Nyklickova
Some people prefer to leave everything on like a flat surface on their desktop and then use their search. That's one way, not my preference. So what I'm going to say, when you're labeling things, you use descriptors that everybody agrees on. Is it a letter, or is it a document, or is it communication? You have to agree on the terms you're using as a group.

Tony Martignetti
It's got to go deeper than that. That's just— that sounds like a very basic policy. It is a place to start. By the way, I love the hierarchy. I mean, I'm very hierarchical thinking. You look, you look, I use Apple Laptops. And, you know, I don't repeat— I don't say that client name, you know, contract. I just say contract because it's in the file for legal for the— for that— for that client, which is in clients current.

Tiffany Nyklickova
Exactly.

Tony Martignetti
Not clients historical. That's a different— I move them from clients current to— I hardly ever have any clients leave, of course. So my client current file is loaded. Clients historical is infinitesimally small. Nothing there. There's like 2. Now there are 2. I mean, I've been in business for 28 years, so I've lost, you know, a couple have just ended very amicably. But no, so anyway, the hierarchy, very— I just— but that's the way I think. But suppose somebody doesn't think that way. Suppose the organization thinks that way, but you don't personally. You got to be dragged along, right? You do.

Tiffany Nyklickova
So when you use descriptive words, people who prefer to search and leave everything flat now know the terms in which to search. Things have changed over the years because now we have AI embedded into our own databases. So for example, if you use Google Drive, Gemini's within there. Now the policies say, because I read them, uh, that it doesn't share your database with its own. It doesn't teach its own AI based on your data. But who's to say that's going to change? So you can search now within Gemini of your own database to find things. So your naming structures A little less particular, but I'm still going to say the more descriptive you can be, the more you can match both those Type A and Type B people.

Tony Martignetti
Okay. Okay. What else? So this has to be a written policy in terms of file naming. Now, what about folder naming? Is that different than file naming, or is it basically the same regimen?

Tiffany Nyklickova
Yeah, I would say the same thing, and same with what you just described. Legal contract. I would say it's the same thing.

Tony Martignetti
Yeah, okay. So hierarchical is preferred. We're not using the Dewey Decimal System. Okay.

Tiffany Nyklickova
Oh, I love the DDS.

Tony Martignetti
Oh, the DDS. I never heard it. I see you're even geekier than I thought.

Tiffany Nyklickova
You didn't go to library school.

Tony Martignetti
Dewey Decimal System. Did you go to library? Do you have a school in a degree in library science?

Tiffany Nyklickova
Yeah, well, it's now like information science. So, but yes, I did library. Does

Tony Martignetti
anybody still use— do libraries still use Dewey Decimal? Or that— does anybody know?

Tiffany Nyklickova
The spine of the books suggests that, yeah.

Tony Martignetti
Do they still have card catalogs in libraries?

Tiffany Nyklickova
No, no.

Tony Martignetti
I haven't seen those in ages. Ages. Thank you very much, Tiffany. We should talk maybe about cost. Cost. Let's go to you, Brian. Cost. I mean, we spend a lot. I guess we can get the ultimate in security and storage and cutting edge, but we've got to spend a lot.

Brian Cavanaugh
Right.

Tony Martignetti
Where do we find our balance?

Brian Cavanaugh
Yeah, and the reality is that a lot of nonprofits don't have the budgets to spend a whole lot. The good thing is that, you know, a lot of the solutions that we're looking at in this session are low cost and free. You know, a lot of the solutions like Google Drive and Dropbox, Box, etc. They provide discounts to nonprofits, free and low-cost solutions. But to your point, the more features in security that you're looking for, data loss prevention, data classification tools, they may be at a higher tier. And so you may have to, you know, be paying for some additional things like that. That said, though, You know, you need to be considering your backup solutions and other types of costs as a holistic view of your organization's data practices and security. And so it may not just be enough to consider the cost for storage, but you also need to consider the cost of your backup and other policies and tools that your governance policy dictates.

Tony Martignetti
Let's talk about doing some sample retrievals. All right, so let's say we use the cloud. I think most Most nonprofits probably use the cloud now. I mean, is it not 100%? There are some people who have local storage, I guess, but let's go with a cloud-based example. Should you be testing your retrieval every once in a while, make sure this structure is working? Like, I'm trying to find this— maybe I know exactly what I'm looking for, but I'm going to try to find it without going right to it.

Brian Cavanaugh
Yes.

Tony Martignetti
Okay.

Brian Cavanaugh
Absolutely. Like any policy or protocol that the nonprofit has in place, you need to be testing it regularly. So that includes going into your storage platform solution, finding and retrieving things, downloading them. And, you know, some advanced tools will do data verification and checksums for you, but more often than not, just having that one-on-one experience of finding something, retrieving it, Understanding what your users will be going through, and simulating that action for them to understand, are there any pitfalls? Are there any difficulties in doing this? And also just making sure the data is valid, that the file is working, it's not corrupt, and that, you know, it will set your users up for success.

Tony Martignetti
We have Jargon Jail on Nonprofit Radio. You mentioned data verification and Checksums. You need to flesh that out to get yourself on probation. Parole. Parole.

Brian Cavanaugh
On the spot.

Tony Martignetti
You're already in jail. Yeah, you need to get it and get parole.

Brian Cavanaugh
Uh, so, uh, when, when you're valid— validating data, uh, you're looking at, you know, things like file size, um, all the different types of metadata that are embedded within that file, and some solutions will check Over time, if they have changed. And if there's something that goes awry, you know, a checksum verification or data validation can send up a red flag and alert someone.

Tony Martignetti
Okay. So it's a way of verifying data integrity, but it happens automatically?

Brian Cavanaugh
It can, yeah.

Tony Martignetti
Okay. Tiffany, you asked a rhetorical question earlier about making sure— how do you know whether you have the most recent version of a file. All right, we're in the cloud. I see, all right, somebody did not, or some, let's just, one person, one scofflaw, that's the word I was looking for, one scofflaw did not follow the policy, and now we've got, I see multiple versions, I see multiple files with the exact same file name. What do I do?

Tiffany Nyklickova
I used to work with this guy. Oh my goodness, he was such a treat. He was a scofflaw. He was. Oh, he was. But he was the boss.

Tony Martignetti
Maybe he was actually a felon, not just a scofflaw.

Tiffany Nyklickova
To

Tony Martignetti
me, a scofflaw is like turnstile jumping. Right. But this guy sounds like a felon.

Tiffany Nyklickova
Yeah, somewhere in there. He had master documents. I was looking for something. I was helping him organize his information management system, and I found what was called the The master file. And I thought, well, that's got to be it, right? That's got to be it. And then I found master file 2, and then master file 3, and then master file 4. And I don't know the end number, so I don't know how many master files I'm looking for. Yeah. So that was like, that was a whole day of like finding all the master files I could. When you, when you have that, you have to, well, ensure that the last one is the best one, and then delete. Just delete them, get rid of them, Move them off. Maybe you want to store them in a secret spot from the scufflaw so he doesn't keep— I'm referring to him because this guy's in my mind. But maybe move them to the side for a little while.

Tony Martignetti
Archive.

Tiffany Nyklickova
Yeah, in the archive, your secret one. So it's not lost forever, but it can't be part of your system because it's just going to clutter it. I'm a big fan, when you're working on a project, have the whole story complete. When you're done, put everything in one file and it's all complete and it's all there and you know where it is. You don't have those extra drafts because they're going to get confusing.

Tony Martignetti
Even if it's just copy and paste or cut and paste, put it all into one thing and then follow the naming convention.

Tiffany Nyklickova
Exactly. And then you always know where it is. And then you have your cultural posterity.

Tony Martignetti
Your what posterity?

Tiffany Nyklickova
Like your cultural, your organization's culture.

Tony Martignetti
Oh, cultural posterity. Yes. Okay.

Tiffany Nyklickova
You've got your story.

Tony Martignetti
But can't, you know, do I need this file name structure? Can't I just use keyword searches? I know the word that's in there. At least I believe I do until my search is unsuccessful.

Tiffany Nyklickova
Or you have a new employee.

Tony Martignetti
Then I'm screwed. Oh, new employee. Right, new people. Yeah, we have to accommodate them, don't we?

Tiffany Nyklickova
We do. We do because we expect them to get up and running right away. And if, you know, if they come in and there's all these names that don't mean anything, they're not going to be able to They're not going to be able to find things, and they're going to start doing things from the very beginning, writing that grant proposal from the very beginning. Yeah. And they don't, you know, they're just redoing work, and it's just a waste of time and energy.

Tony Martignetti
It's like logarithmic file creation, right? I mean, I guess it does plateau eventually, but it could be, it could go crazy with a couple of new employees recreating everything, and now we've got duplicate files, and half of them aren't named right.

Tiffany Nyklickova
And you've lost your donors along the way, and you've lost your volunteers along the way.

Tony Martignetti
See, this is all motivation. Maybe we should have talked about this. Well, you have a lackluster host. Not scofflaw, but lackluster. You know, we should have talked about this at the beginning. But folks have been with us for 19 minutes, so hopefully they're seeing now why these things are important. You have to pay attention. Data integrity, data management. All right. What haven't we talked about? User friendliness. Or something else from your session description. User-friendliness. We've got these policies, but people don't, you know, they're not adhering because they're too technical or something. You know, again, balancing, right, Brian? Balancing Brian. What are we going to do? Now we've got trouble. People are not using them.

Brian Cavanaugh
Yeah. You need to be able to show Why there's value in doing things like file naming conventions, folder naming conventions. So to your point about, you know, using keyword searching, it works until it doesn't work. And so show people the value in, you know, adhering to the policies and working through a lot of the steps that may feel like extra work, to be honest. And then once you demonstrate that value, it begins to sink in that you can And then take it to the next step, provide more training and resources and education.

Tony Martignetti
Um, it might take a crisis to make the point.

Brian Cavanaugh
It might.

Tony Martignetti
Because we have the grant deadline that you hypothesized before, Tiffany, and we don't have it. We haven't found it. We blew the deadline. That's a disaster. That's the day of disasters. All right, now have we all learned a lesson? Right. Sorry, Brian.

Brian Cavanaugh
It's okay. Um, uh, or, you know, Let's say someone accidentally deleted a file or misplaced it or overwritten it. It's gone. And that keyword search no longer works because you're trying to recover something that's based on either a piece of metadata or a file name. And so, you know, in that instance, you may not be able to recover that data and, you know, it's lost and it impacts someone's job.

Tony Martignetti
Yeah. Yeah. All right. We can wrap up. Let's see, who opened? Tiffany, did you open? I think I did. Let's give Brian a chance to close. Leave us with some— not motivation, we just did motivation. We just spent 10 minutes on motivation. But some promising words.

Brian Cavanaugh
Yeah,

Tony Martignetti
beyond the why, some promise for our future. Let's look forward to a bright future with no data disasters. Bring us to this nirvana.

Brian Cavanaugh
Thank you. Let me recognize Mark Topher, the Vilcek Foundation's archivist, who's not joining us here today, but joined us for the session here at NTC. And to his point, and using his words, you know, consistency is key. And so making sure that everyone in your organization is on board, they're using the best practices, and they're making sure that they're taking Proactive steps to make sure the information that they are good stewards of is smart and secure. And in doing so, we're going to be protecting the people that matter most to our organizations, because at the end of the day, we're here to serve people. And all those people, whether they are in vulnerable populations or You know, just in tricky situations these days, that's what matters most. And we want to be good stewards of data and make sure that, you know, nothing bad happens to those communities.

Tony Martignetti
That's Brian Cavanaugh, Director of Digital at the Vilcek Foundation. With Brian is Tiffany Nyklickova, Information Specialist at Services in Action. All right, Brian. Tiffany, thank you very much for sharing.

Tiffany Nyklickova
Thanks for having us.

Brian Cavanaugh
Thank you.

Tony Martignetti
My pleasure. And thank you for being with Tony Martignetti Nonprofit Radio coverage of 25 NTC, where we are sponsored by Heller Consulting.

Kate Martignetti
Next week, our 25 NTC coverage continues with your intergenerational people pipeline. If you missed any part of this week's show,

Tony Martignetti
I beseech you, find it at tonymartignetti.com.

Kate Martignetti
Our creative producer is Claire Meyerhoff. I'm your associate producer, Kate Martignetti. The show's social media is by Susan Chavez. Marc Silverman is our web guy, and this music is by Scott Stein.

Tony Martignetti
Thank you for that affirmation, Scotty. Be with us next week for Nonprofit Radio. Nonprofit Radio, big nonprofit ideas for the other 95%. Go out and be great. Thank you.