Cyber security is a major and ever evolving risk for organisations. While the nature of the threats has evolved over time, the risks have arguably never been greater for trade unions.

Download the free Cyber security for unions report.

As data storage has moved online, this has seen an increase in the range and types of digital threats. This has resulted in a new phase in the ‘arms race’ between cyber security and malicious actors, with innovation in both the types of threats and the responding security technologies and protocols.

For unions, who maintain a large collection of highly sensitive personal data in their membership records, the risks have never been higher. Personal data caches have become increasingly valuable to hackers, while data protection laws have become more demanding over time. Social and online media means that any breach would result in not just a hefty fine, but also a damaging blow to both reputation of the union and the trust of the membership.

I’ve been working with the TUC’s Digital Lab to create a new guide to cyber security for unions. In this guide, I examine the unique issues faces by unions and look at the most dominant current threats.

The challenges of cyber security for unions come against a backdrop of the fast pace of technological change. There has been a generational and fundamental shift in IT infrastructure. Many unions are still going through this change.

The rise of cloud services has seen a move away from internally managed IT services and an adoption of cloud services for email, file management and other core tools. This has meant that cyber criminals have had to change their tactics, and phishing (contacting targets, often by email, to lure them into providing sensitive data such as passwords) has seen a huge increase. This has been compounded by an increase in working from home, brought about by the pandemic.

There has been a major shift to cloud-based Software as a Service (SaaS) for many types of software services. While this has brought benefits it has also resulted in the ability for anyone with technical abilities and a business credit card to quickly and easily set-up accounts and start using them for business activities. This has created a problem called ‘Shadow IT’, where unapproved systems may be storing important data.

In the report, we look at practical measures unions can take to address these and other risks. We also examine how getting Cyber Essentials accreditation, a security scheme backed by the National Cyber Security Centre, can help address these risks. The report can be downloaded from the TUC’s Digital Lab site.