The correct answer is: To prevent unauthorized access to your accounts and data

A strong password is your first line of defense against data breaches. For an NGO, a compromised password can mean leaked donor information, confidential project data, or even risks to staff working in vulnerable areas. Invest the extra seconds in creating a unique, complex password — it can save you from a costly and embarrassing data breach that could damage both your reputation and your donors’ trust.

The correct answer is: Phishing — an attempt to steal personal information

Phishing attacks pose a particular threat to NGOs, as you often handle both donor funds and sensitive information about vulnerable groups. Cybercriminals know that NGOs frequently have less IT support and training than commercial businesses. Be especially cautious with emails pretending to be from banks, donors, or partners. Always verify through another channel (phone or a separate email) before sharing login details or transferring funds.

The correct answer is: Using the newest and strongest encryption protocol (e.g., WPA3)

An unsecured Wi-Fi network is like leaving your office door wide open. For NGOs that often handle sensitive data about vulnerable groups or confidential projects, WPA3 encryption is essential. It ensures that even if someone parks outside your office with a laptop, they can’t intercept your communications. Also consider option c) as an additional security layer — a guest network keeps visitors away from your internal systems.

The correct answer is: A security process where you use two different verification methods (e.g., a password and a code from your phone)

For NGOs, 2FA is critical protection for both financial accounts and communication channels. Even if a hacker steals a password (through phishing or a data breach), they still can’t get in without the second factor. Microsoft and Google offer free 2FA for nonprofits. Yes, it takes an extra 30 seconds to log in, but it can prevent project funds from being stolen or confidential information about partners in high-risk areas from being leaked.

The correct answer is: Others may be able to intercept your data and passwords

When employees check email from a café or airport, hackers can ‘listen in’ on the traffic. For NGOs, this means the risk of exposing donor correspondence, confidential evaluation reports, or even login details for your bank account. The solution? Always use a VPN connection on public networks, or wait to work with sensitive information until you’re back on a secure network. A VPN typically costs 50–100 DKK per user per month — a small price to protect your mission.

The correct answer is: A type of malware that encrypts your files and demands ransom to unlock them

Ransomware is a nightmare for NGOs: all your project documents, donor databases, and annual reports suddenly become inaccessible, and criminals often demand thousands of dollars to unlock them again. NGOs are especially vulnerable because they often have older computers and limited resources for professional IT security. Prevention is everything: daily backups, updated antivirus, and employee training. Remember: even if you pay, there is no guarantee you’ll get your data back.

The correct answer is: Tailgating — following someone closely through a secured entry

For NGOs working with sensitive topics or in conflict areas, physical security is just as important as digital security. Tailgating may seem harmless — “I’m just helping a colleague with heavy boxes” — but it can allow unauthorized individuals to access your office. This can result in stolen computers containing donor data, installed listening devices, or worse. Create a culture where everyone uses their own access card, and where it’s acceptable to ask unfamiliar individuals for identification.

The correct answer is: To close known security vulnerabilities that hackers can exploit

Every month, new security vulnerabilities are discovered in popular software. Hackers automatically scan the internet for computers that lack the latest updates — it’s like leaving a window open with a sign saying “Come in here.” For NGOs with limited IT resources: enable automatic updates on all critical software. Yes, restarts during the workday can be annoying, but it’s still better than explaining to donors why their credit card information has been stolen.

The correct answer is: Using a cross-cut (confetti-cut) paper shredder

NGOs often handle extremely sensitive documents: applications containing personal stories, lists of local partners in authoritarian countries, or internal evaluations. “Dumpster diving” — searching through trash — is a real threat. A good cross-cut shredder costs 1,000–2,000 DKK and makes documents virtually impossible to reconstruct. For highly sensitive documents, mix the shredded pieces with water before disposal. It may sound paranoid, but for some NGOs, it can protect lives.

The correct answer is: Smishing — fraud via SMS

Smishing attacks are increasing rapidly because people are less cautious with SMS than with email. For NGO staff who are often on the move and checking messages quickly between meetings, the risk is high. Scammers pose as delivery services, banks, or even colleagues in distress. Rule of thumb: legitimate organizations rarely send links via SMS. If you receive a message about account issues or deliveries, go directly to the official website or app — never through the link in the SMS.

The correct answer is: Malicious software disguised as a legitimate program

Just like the original Trojan horse, this type of malware disguises itself as something harmless — perhaps a free accounting tool for NGOs or a document from a “donor.” Once installed, it can steal passwords, monitor keystrokes, or give hackers remote access. NGOs are particularly vulnerable because you often download free software to save money. Be extremely cautious with software that doesn’t come from official sources, and always scan downloads with antivirus first.

The correct answer is: Transforming data into unreadable code to protect it from unauthorized access

For NGOs, encryption is often the difference between a minor incident and a disaster. If an employee’s laptop containing field reports is stolen, encryption ensures that the thief cannot read the contents — which can protect sources, partners, and aid recipients. Modern computers often have built-in encryption (BitLocker on Windows, FileVault on Mac) — make sure it’s enabled. For particularly sensitive files, use additional encryption. It’s like having both a lock on the door and a safe inside.

The correct answer is: Someone looking over your shoulder to steal passwords or sensitive information

In open office environments, cafés, or on planes, shoulder surfing is a real threat. For NGO staff working with confidential donor information or sensitive project data, a curious glance can lead to leaked information. Solutions: use privacy screen filters on laptops (200–300 DKK), sit with your back to a wall in public places, and wait to open sensitive documents until you are in a secure location. Also learn to recognize the signs — repeated “accidental” interruptions can be deliberate attempts.

The correct answer is: A security barrier that monitors and controls network traffic

Think of a firewall as your digital gatekeeper. It monitors all traffic going in and out of your network and blocks suspicious activity. For NGOs, this is critical: it can stop hackers from accessing donor databases, prevent malware from sending out confidential information, and block phishing attempts. Most modern routers have a built-in firewall, but make sure it’s enabled and properly configured — otherwise it’s like having a security guard who’s asleep on the job.

The correct answer is: It is specifically targeted at high-profile individuals such as directors or board members

Whaling attacks target NGO leaders and board members with sophisticated, highly personalized messages. Scammers research your organization, know the names of projects and donors, and craft convincing scenarios — for example, “urgent wire transfer for emergency relief.” These attacks are especially dangerous for NGOs because they often result in major financial losses or leaked strategic information. Always establish verification procedures for money transfers and sensitive decisions — no genuine partner will be offended by a confirmation call.

The correct answer is: If one service is hacked, attackers can gain access to all your other accounts

Data breaches happen constantly — even large companies get hacked. If you use the same password for your email, bank, and donor database, a single breach can give criminals access to everything. For NGOs, this can mean stolen project funds, leaked donor information, or compromised social media accounts spreading misinformation. The solution: use a password manager (many offer NGO discounts). It may feel inconvenient at first, but it’s like having one secure keychain instead of the same key for every door.

The correct answer is: Using an automated cloud service or an external hard drive stored in a secure location

For NGOs, data is often irreplaceable: years of project reports, donor history, documentation of your impact. The best backup strategy follows the 3-2-1 rule: 3 copies of your data, on 2 different types of media, with 1 stored offsite. Cloud backup is ideal for NGOs — it’s automatic, secure, and often inexpensive (Microsoft and Google offer nonprofit discounts). Remember: a backup that hasn’t been tested isn’t a backup. Regularly try restoring files to ensure the system works.

The correct answer is: Psychological manipulation to trick people into revealing sensitive information

Social engineering exploits human helpfulness and trust — qualities that are especially strong in NGO cultures. A scammer may call and pretend to be IT support, a donor in trouble, or a partner organization. They often create artificial time pressure: “The server is about to crash, I need your password NOW!” For NGOs: establish clear procedures. Real IT support will never ask for passwords over the phone. If in doubt: hang up and call back using a known number. Better to seem paranoid than to be deceived.

The correct answer is: It can create security risks if the devices are not protected or get stolen

BYOD (Bring Your Own Device) is often necessary for NGOs with tight budgets, but without clear guidelines it’s a security disaster waiting to happen. Personal phones may not have a password, updated software, or encryption. If an employee’s phone with work email is stolen on the bus, the thief could potentially gain access to the entire organization. Minimum requirements: devices must have a password/biometrics, an automatic lock screen, and remote wipe capability. Consider MDM software (Mobile Device Management) to enforce these standards.

The correct answer is: Hand it over to the IT administrator without plugging it into any computer

A “lost” USB stick can be a targeted attack — hackers know that NGOs often operate on tight budgets and may be tempted by “free” hardware. Once plugged in, it can automatically install malware that steals passwords, encrypts files for ransom, or gives hackers remote access. This tactic has been used against human rights organizations around the world. Always treat found USB sticks as potential threats. Your IT administrator has the tools to examine it safely or dispose of it securely.

The correct answer is: Ensuring that data is only accessible to authorized individuals

For NGOs, confidentiality is often about protecting vulnerable people. Lists of local partners in authoritarian regimes, personal data of asylum seekers, or whistleblower information can put lives at risk if they fall into the wrong hands. Confidentiality is ensured through: access control (who can see what), encryption (data unreadable to outsiders), and the “need-to-know” principle (staff only access what is necessary). Remember: a data breach can destroy the trust you’ve spent years building.

The correct answer is: Via attachments or links in phishing emails

Over 90% of successful cyberattacks start with a phishing email. For NGOs, these often appear disguised as donor reports, project proposals, invoices, or urgent requests related to humanitarian aid. Malware can be hidden inside seemingly harmless Word documents or PDFs. Train staff to recognize suspicious emails: unexpected senders, grammar mistakes, urgent language, or requests to “enable macros.” When in doubt: verify through another channel before opening attachments.

The correct answer is: Preventing unauthorized access to sensitive information left out in the open

For NGOs with open offices, volunteers coming and going, and visitors from partner organizations, a clean desk policy is critical. Donor contracts, personnel files, or lists of aid recipients should not be left out where anyone can see them. It’s not just about external threats — it also protects confidentiality internally. Simple rules: lock away sensitive documents after working hours, turn papers over when leaving your desk, and use lockable drawers for ongoing cases.

The correct answer is: BlueHorse#Sunshine!7k (random words + symbols + numbers)

A strong password should be long, unique, and difficult to guess — even for someone who knows you. Avoid organization names, project titles, or years, as hackers can easily research these on your website. “BlueHorse#Sunshine!7k” works because it combines unrelated words with symbols and numbers in a way that’s easy to remember but hard to crack. For NGOs: consider using a password manager (many offer nonprofit discounts) so staff can have unique, strong passwords without needing to remember them all.

The correct answer is: Immediately change your password and notify your IT administrator

Time is critical when an account is compromised. For NGOs, any delay can mean: stolen donor funds, leaked information about vulnerable groups, or misuse of your communication channels for fraud. Take action: 1) Change your password immediately, 2) Notify IT/management, 3) Check for suspicious activity (sent emails, changed settings), 4) Enable two-factor authentication if not already enabled, 5) Change passwords on other accounts if the same one was reused. Remember: being hacked isn’t embarrassing — failing to react quickly is.