The Cybersecurity and Infrastructure Security Agency (CISA) and its partners recently issued helpful guidance for entities that have limited resources to address cyber threats. The guidance, entitled “Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society,” is targeted to assist civil society—“nonprofit, advocacy, cultural, faith-based, academic, think tanks, journalist, dissident, and diaspora organizations, communities, and individuals involved in defending human rights and advancing democracy,” which are considered “high risk communities” because they “are targeted by state-sponsored threat actors who seek to undermine democratic values and interests” with addressing cybersecurity risks with limited resources.

According to the guidance, state-sponsored attacks against civil society are primarily launched by “the governments of Russia, China, Iran, and North Korea.” The threat actors are conducting “extensive pre-operational research to learn about potential victims, gather information to support social engineering, or obtain login credentials,” and are using spyware applications to collect data from victims.

The guidance is designed to provide “mitigation measures for civil society organizations to reduce their risk based on common cyber threats” and civil society organizations and affiliated individuals are “strongly encourage[d]…to apply the mitigations provided in this joint guide.”

If you fall into the civil society organization category, you may wish to consider delving into the guidance with your IT professionals to learn more about the threat and how to mitigate the risk of a cyber-attack from state-sponsored actors and other threat actors.