As our conference takes an in-depth look at cyber security, we questioned our camp operation and the vulnerability, most importantly, of our camp software program which is stored in the cloud. What would we do if faced with a ransom attack on our private information? The West Ohio Conference camps use CampBrain, but the questions we developed could be used anywhere with any system. See if you might be able to answer these questions and, if not, take this opportunity to do some investigation and risk management.

1. How and where is data stored? If your camp software is cloud-based, who is the hosting provider, and where are the servers located?
2. How is our data protected "at rest” and during “transition”? Since camp software contains sensitive & confidential information, verify that data is fully encrypted to reduce the likelihood of it being accessed by unauthorized parties. This might be access "at rest" (stored on a server's hard drive) or when “transmitted” (accessed remotely or anywhere in between). This is a question that may have a lengthy answer — let your software provider speak to their procedures, safeguards, and strategies.
3. How are camp software users authenticated? Are strong passwords enforced?  Is two-party identification available for administrative or front-line staff with access to sensitive information?
4. How are camp software users and data managed/audited? Make sure there is a record of who has access to what. How are you tracking who has added or deleted data?  Who has exported which data? How and how often is that monitored? 
5. Do any third parties have access to my data? Review any agreements in place. Ensure that all relevant details are provided to you and that third parties won't present any additional risk. What level of access will these organizations have, and what methods does the vendor have in place to select and manage them to ensure security?
6. When data is deleted, is it permanently erased? When we delete confidential & privacy data, we must be confident that it's really gone. In some systems, deleting is more of an “archive” function — it is removed from sight but is still accessible, like a document in the Trash on your desktop. Depending on the situation, this could be a good or a bad thing, so make sure you understand how the system functions.
7. How is data recovered in the case of loss?  What protections are there against malware, specifically ransomware, or hardware failure? What are you actively doing to prevent breaches?
8. Has your camp software had any breaches or security issues in the past 2 years?  Can you provide the results of your most recent external security audit?
9. How are incidents reported to customers, your Conference or board?  How will your software company support you if there is a breach as a result of your camp software? How do you inform customers about security issues?
10. Do you have cybersecurity or liability insurance that also protects the Conference or your board?
11. What happens if our partnership ends with our camp software company?  Who owns the data? Some vendors may become the owner of your data when you transfer it into their system, while others allow you to maintain ownership. Understanding this is good to know when we have sensitive and financial information within our camp software.

Thanks to Ken Overholser for sharing what he has learned by walking through this process in West Ohio. We appreciate the expert counsel of the Conference IT team. Ken wisely recognized that these are questions we should all be asking.

Ken is the Director of Camping and Retreat Ministries for the West Ohio Conference for just a few more weeks before he retires! Ken has been an active member of the UMCRM Association for the last 8 years and we are so grateful for his friendship and engagement in our community life.