MissionDefend Blog

Home Articles Get your free assessmentComing soon

Category: How-To Guides

Step-by-step instructions for the settings and routines that matter, written for the person who became their church’s IT department by accident.

  • How to Set Up a Guest Wi-Fi Network (and Secure Your Router) at Your Church

    Picture the Wi-Fi at your church the way it probably works right now. There is one network. The guest checking Facebook in the lobby is on it. The tablet the kids’ ministry uses for check-in is on it. And the office computer that holds your membership roster, your giving records, and everyone’s contact information is on it too. They are all sitting in the same room, so to speak, with the same door open between them.

    Most churches never planned it that way. Somebody set up the internet years ago, the password got written on a sticky note or printed in the bulletin, and it has quietly worked ever since. Nobody meant to put the visitors and the donor records on the same network. It just happened, the way most things at a church happen, because someone kind volunteered to handle it and then life moved on.

    Here is the good news before we go any further. Fixing this is almost certainly not a hardware problem, and it is not a full day of technical misery. For most churches it is a settings change you can make in one afternoon, using the router you already own. You do not need to buy anything. You do not need to be technical. You need about the same patience it takes to set up a new phone.

    Why one flat network is a quiet risk

    Think of your Wi-Fi network like your church building. A guest network is the difference between welcoming a visitor into the lobby and handing them a master key to every room, including the office where the filing cabinets live. You want people to feel welcome. You just do not want the welcome to include your treasurer’s computer.

    When everyone shares a single network, a device that gets compromised, say a visitor’s phone that picked up something nasty from an app, is now sitting on the same network as the machine with your member data. It does not mean disaster is coming. It means there is an open hallway where there should be a wall, and building the wall is easy.

    The fix: a separate network for guests

    The wall is called a guest network, and the surprising part is that your router very likely already has one built in. Most modern routers, the box your internet comes through, include a simple guest network toggle. When you turn it on, it creates a second Wi-Fi network with its own name and its own password. Visitors who join it get exactly what they came for, which is internet, and nothing else. They cannot see or reach your office devices. The guest network gives them the lobby and keeps the office door shut.

    You reach these settings by opening the router’s admin page, usually by typing an address like 192.168.1.1 into a web browser, or through the app that came with the router. Somewhere in the settings you will find a section for the guest network. Give it a friendly name, something like “Grace Church Guest,” set a password you are comfortable sharing, and save. That is genuinely most of the work.

    The one step almost everyone skips

    While you are in there, do the single most important thing on this whole list, the one that gets overlooked more than any other. Change your router’s admin password.

    This is not your Wi-Fi password, the one people type to get online. It is the separate password that lets someone into the router’s own control panel, where all these settings live. Routers ship from the factory with a default admin login, often something like “admin” and “password,” and here is the uncomfortable truth: those defaults are public knowledge. They are printed in manuals and listed on websites anyone can find. Leaving the default in place is like installing a good lock and taping the key to the door. The Federal Trade Commission specifically advises changing the router’s default name and password as a first step in securing a network. Take five minutes and set something long and unique. Write it down somewhere safe, like your other important church passwords, so the next volunteer is not locked out.

    A few more settings worth turning on

    With the big two done, a handful of smaller settings round things out. Set a strong password on your main Wi-Fi, the one your staff and office devices use, and keep it separate from the guest password. Make sure your encryption is turned on and set to WPA2 or, if your router offers it, WPA3. These are just the settings that scramble your Wi-Fi so outsiders cannot eavesdrop, and on most routers you simply pick the option from a menu. The FTC recommends using the strongest encryption your router supports.

    Check that your router’s firmware is up to date. Firmware is the software running inside the router itself, and manufacturers release updates that fix security holes. Many routers can update themselves automatically if you switch that setting on, which is the easiest thing to do. The Cybersecurity and Infrastructure Security Agency lists keeping router firmware updated among its basic guidance for securing a home or small-office network.

    And if you want, rename your main office network to something plain that does not announce itself. There is no need to name it “Church Office Finance.” Something forgettable draws less attention.

    What if the router is old, or the internet company owns it

    Two honest exceptions. If your router is genuinely ancient, it may not have a guest network option, and that is a fair reason to consider a newer one, though it is still not urgent for most churches. And if your internet came bundled with equipment from your provider, the settings sometimes live in their app or require a quick call to them. If any of this feels like a wall rather than a hallway, you have easy help available. Call your internet provider and ask them to enable a guest network for you, or hand this article to the most patient volunteer you know and let them spend the afternoon. Neither path requires you to become a network engineer.

    You built a place where people feel welcome. A guest network just lets you keep that welcome warm at the front door while the office stays quietly, safely locked in the back. One afternoon, and it is done.

    If you would like a plain-English starting point for the rest of your church’s security posture, get on the list to be first in line when our free assessment opens.

    Sources

    • Federal Trade Commission, “Securing Your Home Network / Wi-Fi Router,” consumer.ftc.gov
    • Federal Trade Commission, “Cybersecurity for Small Business,” ftc.gov
    • Cybersecurity and Infrastructure Security Agency, “Home Network Security” and Secure Our World guidance, cisa.gov
    • Federal Communications Commission, “Small Biz Cyber Planner,” fcc.gov

  • Think an Account’s Been Hacked? Here’s How to Tell — and What to Do First

    Take a breath. If you’re reading this because something feels off with one of your ministry’s accounts, the most useful thing you can do right now is stay calm and move in order. Most of the damage from a compromised account is done — or prevented — in the first hour, and you have more control than it feels like you do. Let’s walk through it together.

    How to tell something’s actually wrong

    Sometimes it’s obvious: you go to sign in and your password no longer works, or you get a message that your account has been locked. Other times it’s quieter, and quieter is often more dangerous. A volunteer mentions they got a strange email or text “from you” asking for gift cards or a quick favor. People on your contact list start replying to messages you never sent. You notice password-reset emails arriving that you didn’t request, or sign-in alerts from a city or device you don’t recognize.

    Watch especially for the sneaky signs inside the account itself. An attacker who gets into email will often set up a quiet forwarding rule or a filter so that copies of your incoming mail get sent to them — or so that certain messages skip your inbox entirely and land in the trash where you’ll never see them. You might also notice that money has moved, that your giving platform’s payout or bank details have changed, or that a login you use for donations suddenly behaves differently. Any one of these is worth taking seriously.

    The first moves, in order

    If you can still get into the account, act quickly and in sequence. First, change the password — and make it a strong, unique one you’ve never used anywhere else. Don’t recycle an old favorite. Once the new password is set, look for the option to sign out of all other sessions and devices. Most email and account providers offer this, and it’s the step that actually kicks the intruder out; changing the password alone doesn’t always end a session they already have open.

    Next, turn on the second sign-in step — often called multi-factor authentication, or MFA — if it wasn’t already on. This is the single most effective thing you can do to keep them from walking back in, because even if they somehow learn your new password, they can’t get past that second check without your phone. The Cybersecurity and Infrastructure Security Agency (CISA) has been blunt about this: turning on multi-factor authentication makes you significantly less likely to get hacked. It’s worth the two minutes.

    Once that’s done, go hunting for what the attacker may have left behind. Open your email settings and check the forwarding and filter rules. If you find a rule you didn’t create — anything quietly copying your mail elsewhere or auto-deleting messages — remove it. This is the step people miss most often, and it’s the one that lets an attacker keep reading your mail long after you’ve changed the password. While you’re in the settings, review the list of connected apps that have access to your account and revoke anything unfamiliar, and check your recovery information — the backup email address and phone number — to make sure they still point to you and not to a stranger.

    If money or personal data is involved

    If this is an account that touches your ministry’s money or holds people’s personal information — your email, your giving platform, your accounting login — pause and tell your designated person right away. That might be your treasurer, your bookkeeper, or whoever you’ve agreed handles this. Two calm heads are better than one anxious one. Then check the accounts that matter: log in to your bank and your giving or payment platform directly (type the address yourself rather than clicking a link in any email), and look for changes to payout details, new payees, or transactions you don’t recognize. If something’s wrong, call the bank or platform’s support line and tell them the account may be compromised.

    If you’re already locked out

    If your password no longer works and you can’t get in at all, don’t keep guessing — go to the provider’s official account-recovery process. Every major provider, Google and Microsoft included, has a “forgot password” or “I can’t sign in” path built for exactly this moment. It will walk you through verifying that you’re the real owner. If the attacker changed your recovery phone or email, the recovery flow usually has a way to prove ownership anyway, so be patient and follow the prompts. Resist the urge to create a brand-new account and abandon the old one; recovering the original is almost always the cleaner path.

    Be honest, and be prompt

    If there’s any chance someone else’s information was exposed — donors, staff, the people in your directory — tell them plainly and soon. A short, honest note saying “our email was compromised, please ignore any odd messages from us, and never send money or gift cards based on a message you weren’t expecting” does enormous good. People understand that these things happen. What they remember is whether you were straight with them. The Federal Trade Commission’s guidance on hacked accounts makes the same point: alerting your contacts quickly helps stop the scam from spreading through the people who trust you.

    The reassuring part

    Here’s what to hold on to. Acting fast in that first hour contains most of the damage, and none of the steps above require you to be technical — they require you to be calm and to go in order. The best gift you can give your future self is to decide, today, before anything goes wrong, who you’d call and what you’d check first. Write it down. Tape it inside a drawer if you have to. A plan you made on a quiet afternoon is worth ten frantic guesses at midnight.

    If you’d like a simple, plain-English baseline of where your ministry stands — before there’s ever an emergency — join our launch list and you’ll be first in line when our free assessment opens.

    Sources

    • Federal Trade Commission, “Hacked Email” — consumer.ftc.gov
    • Cybersecurity and Infrastructure Security Agency (CISA), “More than a Password” / multi-factor authentication guidance — cisa.gov
    • Google Account Help, “Recover your Google Account or Gmail” — support.google.com
    • Microsoft Support, “Recover a hacked or compromised account” — support.microsoft.com

  • Set Up a Password Manager for Your Ministry Team (Without the Overwhelm)

    If your team is still keeping passwords in a shared spreadsheet, on sticky notes around the office, or in one person’s memory, you are not alone. Almost every church and small nonprofit starts there. It works right up until the day it doesn’t — when a volunteer leaves, an account gets locked, or someone reuses the same password in one too many places. The good news is that fixing this is one of the most doable things on your whole security to-do list, and it starts with understanding why passwords fail in the first place.

    The real problem isn’t weak passwords — it’s reused ones

    Here’s the part that surprises most people. The biggest danger usually isn’t that your password is too short or too simple. It’s that the same password is being used in more than one place. When a big company somewhere has a data breach — and these happen constantly, to organizations far larger than yours — the stolen passwords get collected and tried against other accounts, automatically, by the thousands. So the password your treasurer uses for the church bank login is only as safe as the least careful website where they also used it. One forgotten account on some hobby forum from years ago, and suddenly the key to something that actually matters is floating around.

    You can’t out-clever this by making one really good password and using it everywhere. The only real fix is a different, strong password for every single account. And no human being can remember dozens of those. That’s exactly the problem a password manager was built to solve.

    What a password manager actually is

    Think of it as a locked safe that lives on your devices and remembers all your passwords for you. When you sign up for something, it creates a long, random, impossible-to-guess password and stores it. When you go back to that site, it fills the password in for you automatically. You never have to type it, remember it, or even know what it is.

    The beautiful trade at the heart of this is simple: you remember one password — the one that opens the safe — and it remembers all the rest. That’s it. Instead of juggling twenty passwords badly, you protect one password well.

    You have real choices here, too. There are several reputable password managers on the market, a number of them with capable free tiers that are perfectly good for a small team, and many vendors offer nonprofit discounts on their paid plans. It’s worth a quick search for the current nonprofit pricing before you decide. This is not a place where you have to spend a lot of money to be much safer.

    The master password: your one key, guarded well

    Because that one master password unlocks everything, it deserves real care. Make it long — a short phrase of a few unrelated words strung together is both strong and much easier to remember than a jumble of symbols. NIST, the federal agency that sets these standards, has found that length matters more than forced complexity, which is genuinely freeing news. And do not reuse your master password anywhere else. It should be the one password in your life that exists in only one place.

    Then back it up somewhere physical and safe. Write it down and put it in a locked drawer, a safe, or a sealed envelope with your important documents. This feels backwards to a lot of people — aren’t we told never to write passwords down? But a slip of paper in a locked drawer at home is not the thing attackers can reach from the other side of the world. Losing access to your entire vault because you forgot the one key is a far more likely disaster, and this simple step prevents it.

    Sharing logins the safer way

    Every church has a few accounts that genuinely need to be shared — the main email, the social media pages, maybe the giving platform. Good password managers have a feature built exactly for this: a shared vault. You put those shared logins in one place, and the specific people who need them get access, without anyone ever having to text a password around or read it aloud in a meeting. When a volunteer moves on, you remove their access in a moment, and nobody has to scramble to change passwords everywhere.

    Where you can, though, individual logins still beat sharing. When each person has their own account on a platform, you can see who did what, and you can remove one person without disrupting everyone else. Save the shared vault for the accounts that truly only come in one flavor.

    Rolling it out without overwhelming anyone

    The mistake that sinks most of these efforts is trying to move everything at once. Don’t. Start small. Pick the handful of accounts that would hurt the most if they were lost — your email, your banking, your donor or giving platform — and move just those in. Let everyone get comfortable with the fill-it-in-for-you rhythm on the accounts they touch daily. Once it feels normal, add a few more. Over a few weeks, without any single overwhelming afternoon, your team ends up fully covered. Slow and steady genuinely wins here.

    “But what if I forget the master password?”

    This is the fear that keeps people from ever starting, so let’s answer it honestly. Yes, forgetting the master password is a real risk, and most password managers are designed so that even the company itself cannot see or reset it — that’s precisely what keeps your vault private. But you are not without a net. Many services offer recovery options you can set up in advance, like a printed recovery key or a trusted emergency contact. Set those up on day one, before you need them. And keep that written copy in a safe physical place, as we talked about. Do both, and the thing you’re afraid of quietly stops being possible.

    None of this has to happen today, and none of it has to happen all at once. Pick one account, set up one vault, remember one password. That single step puts you ahead of most organizations your size — and your people, your donors, and your mission are safer for it.

    Want a gentle, plain-English checkup of where your ministry stands? Get on the launch list and be first in line when our free assessment opens.

    Sources

    • NIST, Digital Identity Guidelines (SP 800-63B) — guidance on password length, memorized secrets, and why length beats forced complexity. nist.gov
    • CISA, “Use Strong Passwords” / Secure Our World — federal guidance recommending password managers and unique passwords for every account. cisa.gov
    • Federal Trade Commission, Cybersecurity for Small Business — plain-language security basics for small organizations. ftc.gov

  • Back It Up So Ransomware Can’t Win

    Ransomware is a shakedown with a very specific business model. Attackers get into your systems, scramble every file so you can’t open it, and then offer to sell you the key. Member records, financial files, years of documents — all still there, all suddenly unreadable, with a countdown clock and a ransom demand attached. It’s frightening precisely because it takes your own information hostage.

    But that whole model has one fatal weakness, and it’s not clever software. It’s a good backup. If you have a clean, recent copy of your files stored somewhere the attacker couldn’t reach, their leverage evaporates. You don’t negotiate and you don’t pay; you wipe the affected machines, restore from your copy, and get back to work. The ransom only works if the backup doesn’t exist. So the single most powerful thing a small organization can do against ransomware isn’t buying protection — it’s making sure a copy of everything important lives somewhere safe.

    The rule that’s easy to remember: 3-2-1

    Security professionals boil good backups down to three numbers, and the reason it’s endured is that it’s genuinely easy to hold in your head. Keep three copies of your important data, on two different kinds of storage, with one of them kept somewhere else entirely.

    Three copies means the original you work with plus two backups, so that no single failure wipes you out. Two kinds of storage means you don’t put all your trust in one basket — for example, the working copy on your computer and a backup in a cloud service, rather than two folders on the same hard drive that dies together. And one copy kept off-site, away from your building, protects you against the physical disasters that a purely local backup can’t survive: a fire, a flood, a stolen laptop, or a burst pipe over the church office. For most small organizations today, that off-site copy is a reputable cloud backup, which quietly handles the “somewhere else” part for you.

    You don’t need expensive equipment to follow this. A church that keeps its files in Microsoft 365 or Google Workspace, plus a separate backup service or an external drive stored off-site, is already living the rule.

    The trap: the copy ransomware can also reach

    Here’s the detail that trips up organizations that thought they were covered. Ransomware doesn’t only scramble the computer it lands on. It reaches out to everything that computer is connected to — the shared network drive, the always-connected external disk, sometimes the synced cloud folder — and scrambles those too. A backup that’s plugged in and reachable all the time can get encrypted right alongside the original, which is a devastating thing to discover on the worst day.

    The protection is to keep at least one backup that isn’t constantly connected — what the pros call an offline or “air-gapped” copy, and what you can think of as a backup the ransomware simply can’t touch because there’s nothing linking the two. In practice that means an external drive you plug in for the backup and then unplug and put away, or a cloud backup service that keeps older versions the attacker can’t reach in and delete. The principle is the same either way: your safety copy should not be sitting there, always online, waiting to be scrambled with everything else.

    Cloud services help here in a way worth understanding. Many keep version history, meaning they hold earlier copies of your files even after the current ones change. If ransomware encrypts your synced documents, that version history can often let you roll back to the clean versions from before the attack. It’s not automatic and it’s not infinite, so it’s worth confirming your service offers it and knowing how to use it — but it’s a real advantage that a plain external drive doesn’t give you.

    The step almost everyone skips: test the restore

    This is the part that separates organizations that survive from ones that only thought they were protected. A backup you have never restored from is not a backup — it’s a hope. The time to discover that your backup was silently failing for six months, or that nobody knows the password to the backup account, or that the files won’t actually open, is not the morning after an attack.

    So test it, and test it before you need it. Once, pick a few real files, delete them from your working copy (or better, restore them to a separate folder so you don’t disturb anything), and bring them back from your backup. Confirm they open and they’re current. Do this when you first set up your backups and then on a simple schedule — a quarterly reminder on the calendar is plenty for most small organizations. The whole exercise takes fifteen minutes and converts a hope into a certainty.

    What to make sure is actually covered

    As you set this up, walk through where your important information actually lives, because it’s easy to back up the obvious things and miss the ones that would hurt most. Your email and shared documents are the big ones. But also think about your member and donor records, which often live inside a church management or database platform — check whether that platform backs itself up or whether that’s on you. The same goes for your bookkeeping and giving data. You don’t have to solve all of it in a day; you just want an honest inventory of what would be catastrophic to lose, and a copy of each of those things somewhere safe.

    Ransomware is designed to make you feel powerless, and against an organization with no backups, it is. Against one with three copies, one of them offline, and a restore they’ve actually tested, it’s an expensive nuisance that ends with you shrugging and restoring your files. That difference is entirely within your control, and it costs far less than most people assume.

    A good backup is your safety net for when something slips through. Turning on multi-factor authentication is how you stop most attacks from slipping through in the first place — the two work best as a pair, one preventing trouble and the other making sure it can’t become a disaster.

    If you’d like a clear read on whether your current backups would actually survive an attack, that’s one of the things our free assessment checks. Get on the launch list and you’ll be first in line when it opens.

    Sources

    • Cybersecurity and Infrastructure Security Agency (CISA), #StopRansomware Guide and Protecting Against Ransomware — on offline backups and the 3-2-1 approach, cisa.gov.
    • National Institute of Standards and Technology (NIST), Data Integrity: Recovering from Ransomware and Other Destructive Events — nist.gov.
    • Cybersecurity and Infrastructure Security Agency (CISA), guidance on testing backups and maintaining offline copies, cisa.gov.
  • Give Everyone a “This Looks Wrong” Button

    Give Everyone a “This Looks Wrong” Button

    The nursery coordinator gets an email on a Sunday evening.

    Your mailbox has exceeded its storage limit. 3 messages are being held for delivery. Sign in within 24 hours to release them, or they will be deleted.

    Something about it feels off. The wording is slightly stiff. She’s never had a quota problem before. She looks at it for a few seconds, decides it’s probably nothing, and deletes it.

    That’s the end of it, as far as anyone in the church ever knows.

    What she doesn’t know is that the same message went to eleven other people that evening, and that one of them — the volunteer bookkeeper, checking email between services — clicked it and typed in her password.

    Nobody in this story behaved badly. The coordinator’s instinct was excellent. She just had nowhere to put it. There was no address to send it to, no button to press, and a small, entirely reasonable fear of being the person who bothered the pastor about an email that turned out to be fine.

    The gap between someone noticed and anyone acted is where most of these attacks live. Closing that gap is one of the highest-value things a small organization can do, and it costs nothing.

    Your people are already the detection system

    Small churches and nonprofits do not have a security team watching the mail flow. What they have is eight or twelve people who know how things normally sound around here.

    That knowledge is genuinely good. The office administrator knows the pastor doesn’t send one-line emails asking for a favor while he’s “in a meeting.” The treasurer knows the roofing contractor has never changed bank details mid-project.

    Filters catch a great deal, and you should certainly have them turned on. But phishing is designed to survive filters — a well-crafted message from a newly registered domain, with no attachment and no malicious link on any list yet, sails through into the inbox looking ordinary. The last line of detection is a human being noticing that something feels wrong.

    Right now, in most small organizations, that noticing produces nothing at all. Not because people don’t care — because there’s nowhere for it to go.

    The mechanics: build somewhere to send it

    This is the easy half, and it takes about twenty minutes.

    Option one: an address everyone knows. Create a shared mailbox or a group address — security@, checkthis@, isthisreal@, whatever your people will actually remember. Point it at two or three people: whoever handles IT things, the office administrator, and one other person so it’s never one person’s holiday that stalls it. Both Microsoft 365 and Google Workspace let you create a shared mailbox or group at no extra cost.

    The name matters more than it should. Security sounds formal, and formality makes people hesitate. Checkthis@ sounds like asking a colleague, which is exactly the behavior you want.

    Option two: the button that’s already there. Microsoft 365 and Google Workspace both include a report function in the mail app itself.

    In Microsoft 365, there’s a built-in Report button in Outlook that lets people flag a message as phishing or junk. An administrator can configure where those reports go — to Microsoft for analysis, to a mailbox you nominate inside the organization, or to both. Choosing “both” is the right answer for most churches: Microsoft’s systems learn from it, and a person in your building sees it too.

    In Gmail, opening a message and choosing the report-phishing option under the message’s more menu sends a copy to Google and moves the message out of the inbox.

    Use both. The button is one click and gets used; the address is where the awkward cases go — a text message someone got, a phone call, a letter, a QR code on a poster in the lobby. The button only handles email. Real life doesn’t.

    Say the same thing on every path. Put the address in the email signature block for staff, on the sheet taped by the office phone, and on the volunteer welcome page. The failure mode isn’t people refusing to report. It’s people not remembering how.

    Forward it the right way. One small technical detail makes a real difference to whoever reviews the report. When you forward an email normally, the mail app makes a new message and pastes the old text inside it. What gets lost is the hidden header information — the record of which servers actually handled the message and where it really came from. That’s often the fastest way to tell a genuine message from a convincing forgery, and an ordinary forward destroys it.

    Forwarding as an attachment preserves the original message intact, headers and all. Both Gmail and Outlook can do it; in Gmail it’s an option in the message’s menu, and in Outlook you can drag a message into a new one or choose the attachment-forwarding option. The built-in report buttons do this automatically, which is another argument for using them.

    Two rules to say out loud alongside it: don’t click anything in the message before you report it, and don’t delete it after — leave it in a folder for a week in case someone needs to look.

    The half that actually decides whether this works

    Here’s the uncomfortable part. The technical setup is twenty minutes. Whether anyone uses it depends entirely on how the first few reports are received.

    People do not report because they are afraid of looking foolish. That’s the whole thing. Not laziness, not indifference — a completely ordinary human reluctance to raise a hand and be wrong in front of colleagues. If a report is met with a delay, a sigh, or a technical explanation of why it was obviously fine, that person will not report again, and neither will anyone they mention it to.

    Three commitments, and they need to be said publicly, not just believed privately.

    Thank people for every report, including the false alarms — especially the false alarms. The reply to a report about a perfectly legitimate email should be warm and short: “Checked it — this one’s genuine, it’s from the insurance broker. Thanks for flagging it, that was exactly the right call.” Never “that was fine.” The thing you’re reinforcing is not accuracy; it’s the act of asking.

    Nobody is ever in trouble for reporting — including reporting their own mistake. This one has to be stated in words, at a staff meeting, by whoever is in charge. “If you click something and then think ‘oh no,’ tell me immediately. You will not be in trouble. The only thing that turns a bad click into a bad month is waiting.” Without that sentence spoken aloud, a scared volunteer will spend four hours hoping it was nothing, and four hours is the difference between a password reset and a wire transfer.

    Answer fast. Not necessarily with an answer — with an acknowledgment. “Got it, looking now” within the hour. A report that vanishes into a mailbox teaches everyone that reporting is pointless, and that lesson sticks harder than any training.

    What to do when one arrives

    You need a short routine, not a procedure manual. Five steps:

    1. Acknowledge it. One line, straight away.

    2. Look at the sender’s actual address, not the display name. The display name is the friendly label your mail app shows — it’s free text and anyone can set it to anything, including your pastor’s name. The real address is what matters, and on a phone it’s usually hidden until you tap it.

    3. Ask whether it wants a credential or wants money. Almost every phishing message wants one of two things: for you to sign in somewhere (a fake login page harvesting your password), or for you to move money, buy gift cards, or change payment details. Naming which one tells you what to do next.

    4. If it’s real, contain it. Ask your mail administrator to search for the same message across all mailboxes and remove it. Whether they can depends on your subscription: in Microsoft 365 it’s done through eDiscovery or Defender for Office 365, and in Google Workspace only the higher editions include the security investigation tool that deletes mail from other people’s inboxes. If your plan can’t, the fallback is telling everyone to delete it — which is step five anyway. If anyone entered a password, that account’s password changes immediately from a different device, active sessions are signed out, multi-factor authentication is checked, and mail rules are reviewed — attackers routinely add a rule to hide their tracks.

    5. Tell everyone. This is the step people skip, and it’s the most valuable one. If a message reached one mailbox, it almost certainly reached several. A two-line note to all staff — “A fake DocuSign email is going around this morning; it’s not from us; delete it” — protects the people who hadn’t opened their email yet.

    That last step is also what makes the next report more likely. People who see that their report produced a visible, useful outcome will report again.

    Speed is the whole game with money

    If a report involves money that has already moved, the clock is the only thing that matters.

    The FBI’s Recovery Asset Team exists to freeze fraudulent transfers, and in 2025 it ran 3,574 domestic incidents and froze $507,042,623. That process works dramatically better inside the first 24 to 72 hours. After that, the money has usually been moved onward and the odds fall off a cliff.

    Which means the value of a reporting culture is not really about email hygiene. It’s that when the bookkeeper realizes at 4:40 on a Friday that the payment she sent this morning went to the wrong account, she picks up the phone immediately instead of sitting with it over the weekend. Everything you do to make reporting comfortable is, in the end, buying hours on that clock.

    For context on scale: business email compromise generated 24,768 complaints in 2025 with reported losses of $3,046,598,558 — an average of about $123,005 per report. Phishing and spoofing, with 191,561 complaints, was the most-reported crime type of the year.

    Attempted or successful fraud goes to the FBI at ic3.gov, and identity theft to identitytheft.gov.

    Measure it gently, or not at all

    If you want a number, use this one: reports per month.

    Not accuracy. Not how many were real. Just how many times somebody raised a hand. A church that goes from zero reports a month to six has built a detection capability it did not have before, and the fact that five of the six were harmless is not a problem — it’s the cost of the sixth.

    Report the number to the board once or twice a year as a positive indicator. “Staff flagged eleven suspicious messages this year; two were real, one of them was an attempted payment change.” That sentence tells a board more about the organization’s actual security posture than any policy document.

    And resist the urge to run a punitive phishing test on your volunteers. If you do simulate one, tell people in advance that it’s coming sometime this quarter, and never publish who clicked. A church is a volunteer organization held together by goodwill; embarrassing a faithful person to make a training point costs more than it teaches.

    What to do this week

    Create the address. Fifteen minutes: a shared mailbox called checkthis@ (or whatever fits your church), pointed at two people, and — if you’re on Microsoft 365 or Google Workspace — confirm the built-in report button is available and that reports land somewhere a human will see them.

    Then, at the next staff meeting, spend two minutes saying the sentence out loud: if anything looks wrong, send it to checkthis@ — you will never be in trouble for asking, and you will never be in trouble for telling me you clicked something.

    CISA’s advice to organizations comes down to the same thing: make sure people know how, and to whom, to report a suspicious message.

    MissionDefend’s free assessment covers exactly this kind of ground — how your organization handles email, donations, member data, and accounts — in plain English, and gives you a baseline score with a ranked list of what to fix first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Configure user reported message settings in Microsoft Defender for Office 365; Google, Avoid and report phishing emails; Cybersecurity and Infrastructure Security Agency, Teach Employees to Avoid Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • One Login, Five People, Fifteen Years: The Church Office Computer

    One Login, Five People, Fifteen Years: The Church Office Computer

    There’s a computer in the church office. It sits on the desk near the window, and it has been there long enough that nobody remembers who bought it.

    Everyone uses it. The office administrator, obviously. The treasurer on Thursday mornings. The youth director when the church laptop is somewhere else. Two volunteers who take turns doing the bulletin. The pastor, when he needs to print something.

    They all sign in the same way, because there is only one way to sign in. The account is called Office, and the password is on an index card under the keyboard:

    Office / FirstChurch2019! (giving site + email — same one)

    Nobody did anything wrong here. This is what happens when five people share one machine, none of them work full time, and the alternative — remembering who has which password — sounds like more administration than anybody has room for. The card under the keyboard is a reasonable solution to a real problem.

    It’s also the single point where a small organization’s whole digital life is exposed, and the fix costs nothing but an afternoon.

    What “one login” actually costs you

    Four specific things, and it’s worth being concrete about each, because “shared accounts are bad practice” is abstract enough to ignore.

    You can never tell who did what. A file is deleted, a giving record is edited, a check register doesn’t balance. The computer’s own records say Office did it, which is true and useless. There’s no way to reconstruct a mistake, no way to clear someone who’s been quietly suspected, and no way to answer an auditor or an insurer who asks a reasonable question. The absence of an answer is worse for the innocent than the guilty — in a small church, the not-knowing lands on everyone.

    One bad moment exposes everything anyone has ever opened. If a volunteer downloads the wrong attachment, whatever runs next is running as Office, and Office can reach every file, every saved password, and every signed-in website that anyone has ever used on that machine. There are no walls inside a shared account, because a shared account is one room.

    A person who left in 2021 still has the keys. The volunteer who did the bulletin for two years and moved to another state knows the password. So does her husband, probably, and anyone she wrote it down for. Nobody has changed it, because changing it means telling five people, and one of them is always on vacation. Every departure since the card was written is still a person who can get in.

    And the browser hands over the money. The biggest one, the least understood, and it needs its own section.

    A signed-in browser is a signed-in everything

    When you use Chrome, Edge, Safari, or Firefox, everything about “you” — your saved passwords, your bookmarks, your history, and the small files that keep you logged in — lives in something called a browser profile. It’s the browser’s version of a user account. On a shared computer with one login, there is one profile, and everybody is inside it.

    Two things in that profile matter enormously.

    Saved passwords. Every time someone clicked Save password — for the giving platform, the bank, the church management system, the email account, the domain registrar — the browser filed it away. Anyone sitting at that desk can open the browser’s password screen and read them in plain text, or simply visit the site and let it fill itself in.

    Session cookies. When you sign in to a website, the site gives your browser a small token that says this browser is already logged in, don’t ask again. That’s why you don’t retype your bank password every morning. It’s also why a machine that nobody is currently sitting at is still, from the website’s point of view, signed in.

    Put those together and the practical situation is this: anyone who can get to that keyboard, or anything that runs on that computer, can reach your giving platform and your bank without ever knowing a password. Not by guessing. By clicking the bookmark.

    That is the actual risk on a shared office computer. Not that someone will crack a code — that no code is being asked for.

    Separate accounts on the same machine, at no cost

    You do not need a new computer, new software, or a budget line. Both Windows and macOS have supported multiple user accounts on one machine for decades, and it’s free.

    Give each regular person their own account. Not a personal computer — a personal account on the shared computer. Their own desktop, their own files, and critically, their own browser profile with their own saved passwords. When the treasurer signs out, her session ends. When the bulletin volunteer signs in, she sees her own world and not the church’s bank account.

    Four or five accounts is normal for a church office, plus a Guest account for the occasional person who just needs to print, with nothing saved in it.

    Make the everyday accounts non-administrator. An administrator account is one that’s allowed to install software and change the machine’s settings. The everyday accounts don’t need that power, and taking it away means that when something malicious tries to install itself, it hits a wall and asks for a password that the person sitting there doesn’t have.

    Create one administrator account with a strong unique password, write it down, and put it where the pastor and the treasurer can both reach it — a sealed envelope in the safe is genuinely fine. Don’t use it for daily work; it exists for installing things and fixing things.

    That single change, more than any product you could buy, is what stops an ordinary bad click from becoming a bad week.

    Three settings and one habit

    With the accounts in place, four things remain. None takes long.

    Turn on the automatic screen lock. Both operating systems will lock the screen after a set idle period and ask for the password to come back. Ten or fifteen minutes is right for a church office. This is the control that handles the real-world scenario — not a break-in, but the office being empty for twenty minutes during a funeral while contractors and members of the congregation walk past an unlocked desk.

    Turn on full-disk encryption. Encryption scrambles everything stored on the machine so that it’s unreadable without the password. On Windows this is BitLocker; on Windows Home the same protection appears as device encryption, which switches BitLocker on for you. On Mac it’s FileVault. All are built in and free.

    Without it, a stolen computer is an open filing cabinet — someone can pull the drive out and read every file on it without knowing any of your passwords. With it, a stolen computer is a brick. Newer Macs encrypt storage automatically, but FileVault is what ties decryption to somebody actually knowing the login password, which is the part that matters. On Windows, look under privacy and security settings for device encryption or BitLocker and confirm it’s on — on a machine signed in with a local account rather than a Microsoft account, it often isn’t.

    One warning that Apple states bluntly and that applies to both systems: if you turn on encryption and then lose both the password and the recovery key, the files are gone permanently. Store the recovery key with the administrator password, in the safe.

    Keep the operating system and browser updated. Turn on automatic updates and let them run. And check what the machine is actually running. Microsoft ended support for Windows 10 on October 14, 2025, which means no more security fixes; consumers can enroll in Extended Security Updates, which deliver critical and important security fixes — nothing else, and no technical support — through October 12, 2027, and after that the machine is genuinely unsafe for handling donations. If your office computer is old enough that its operating system has been retired, that’s the budget conversation to have this year.

    Move the passwords out of the browser. Open the browser’s saved-password list, work through it, and move each one into a password manager — a separate encrypted app whose whole job is storing passwords, with a shared vault the office can use for the accounts several people genuinely need. Then delete them from the browser and turn off the offer to save.

    While you’re in there, sign out of the giving platform, the bank, and the church management system, and set them to require a sign-in each time. It’s ninety seconds of friction a day. It’s the ninety seconds that stands between a shared keyboard and your operating account.

    The objections are fair, and here’s the answer

    “Switching users is slow.” It is, a little. But nobody has to shut down — both systems let one person stay signed in while another switches over, and coming back takes a password. What makes it painless is doing the setup once: get each person signed in, let them set their own preferences, and the daily friction is a password.

    “The volunteers will grumble.” Some will. The framing that works is not security, it’s fairness: your account is yours, so nothing that happens on somebody else’s shift lands on you. People understand being protected from blame far faster than they understand threat models.

    “We’ll forget the passwords.” Yes, if you ask people to invent complicated ones. Don’t. Use a memorable passphrase of three or four unrelated words for the login itself, and let the password manager handle everything else. The administrator password in the safe turns a forgotten password into a five-minute fix.

    “It’s just the bulletin computer.” It’s the computer with the browser that’s signed in to your giving platform. It stopped being the bulletin computer some time ago.

    When the machine finally goes

    Eventually the old tower gets replaced, and someone offers to take it home, or it goes to a member starting a small business, or a recycler collects it.

    Deleting files does not remove them. Deleting marks the space as available for reuse; the contents sit there until something happens to overwrite them, and free recovery tools will pull them back. The FTC’s guidance for businesses is direct about this: use software designed to securely erase data, because ordinary delete commands aren’t sufficient. NIST’s federal guidance on media sanitization makes the same distinction — there is a difference between removing the pointer to data and removing the data.

    The practical version for a church office:

    If the machine was encrypted the whole time, you’re mostly there already. Destroying the encryption key makes the contents unreadable — one more reason to turn encryption on early rather than at the end.

    Use the built-in full reset. Windows offers a reset that removes everything, with an option to clean the drive rather than just delete files — choose that one, and expect hours. Modern Macs offer an erase-all-content-and-settings option that wipes the machine back to factory state. Sign out of the Microsoft or Apple account first, so your account isn’t tied to a machine you no longer control.

    If the drive held donor or member records and you can’t verify the wipe, destroy the drive. Remove it and have it physically destroyed. A drive is worth less than the trust of the people whose data was on it.

    Then clean up what the machine could reach. Change the passwords that lived in that browser, and sign out of active sessions on the giving platform and email. The computer leaving the building doesn’t sign it out of anything.

    What to do this week

    Sit down at the office computer for forty-five minutes with whoever knows it best. Open the browser’s saved-password list and read it out loud — the giving platform, the bank, the email account, whatever’s there. That list is the argument; you won’t need to make another one.

    Then do two things: turn on the automatic screen lock, and confirm full-disk encryption is on (BitLocker or device encryption on Windows, FileVault on Mac), writing the recovery key into the safe. Separate user accounts can be next week’s job, and they’ll go faster once the list has been seen.

    The office computer is one item on a longer list. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts — including shared machines and saved passwords — and returns a baseline score with a ranked list of what to fix first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Device encryption in Windows; Microsoft, Windows 10 support has ended on October 14, 2025; Microsoft, Windows 10 Extended Security Updates; Apple, Protect data on your Mac with FileVault; Federal Trade Commission, Protecting Personal Information: A Guide for Business; National Institute of Standards and Technology, SP 800-88 Rev. 2, Guidelines for Media Sanitization.

  • Everyone Is an Admin: A Twenty-Minute Permissions Audit

    Everyone Is an Admin: A Twenty-Minute Permissions Audit

    A new small-group leader gets her login on a Wednesday. She’s a volunteer, she’s delightful, and she needs to see who’s in her group and email them about Thursday.

    She signs in, clicks around to find her group, and lands on a member profile. And there it is: a home address, a spouse’s phone number, the names and ages of two children, a note from three years ago about a hospital visit, and a giving history going back to 2019 with every amount.

    She didn’t go looking. It was simply on the screen, because when the church set the system up in a hurry, the fastest way to make sure nobody got stuck was to give everybody the top level of access.

    That’s how it happens in nearly every church. Not carelessness — expedience, under time pressure, years ago, by someone who has since moved on.

    This is not about trust. It’s about blast radius

    Say this out loud at your next staff meeting, because it disarms the whole conversation before it becomes awkward:

    We are not doing this because we don’t trust anyone. We’re doing it so that one stolen password doesn’t expose everything.

    Blast radius is a plain idea wearing a dramatic name. It means: when one account is compromised, how much does the attacker get? If every account is a full administrator, the answer is all of it — every address, every giving record, every note — no matter which of the twenty accounts they happened to catch.

    And accounts do get caught. Phishing — the fake email that leads to a convincing but counterfeit login page — was the most-reported crime type in the FBI’s 2025 figures, with 191,561 complaints. It doesn’t select for the senior pastor. It catches whoever clicks, and in a church that is statistically going to be a volunteer with an old password and no second step at login.

    The goal isn’t to make anyone prove they deserve access. It’s to make sure that the volunteer who runs the coffee rota, if phished on a Tuesday, costs you the coffee rota.

    The data that shouldn’t all travel together

    Your church management system holds the most sensitive information your organization has anywhere. Not the bank account — this. Four categories deserve to be separated from general access:

    Giving amounts. Who gave what, and when. In many congregations this is the single most closely-held fact about a person, and knowing it changes how people are treated. Very few staff need it, and the ones who do are usually the treasurer, the bookkeeper, and the senior pastor — and some churches deliberately exclude the pastor. Whatever your practice, it should be a decision, not an accident of software setup.

    Children’s records. Names, ages, guardians, pickup authorizations, allergies, sometimes photographs. This should be visible to children’s ministry leadership and to no one else. There are also legal dimensions here — background check records, retention obligations, and what you may keep about a minor — and those requirements vary by state. Ask a lawyer about your own; don’t take a blog’s word for it, including this one.

    Pastoral notes. Counselling records, hospital visits, crisis notes, prayer requests that were shared in confidence. If your system lets staff write private notes on a person’s profile, find out right now who can read them. In a great many churches the answer is “anyone with a login,” and the people writing those notes have no idea.

    Contact details and addresses. Lower-sensitivity, but not zero — for someone in a domestic violence situation, an address in a widely-accessible directory is a genuine safety issue. Some systems support a confidential or restricted flag on individual records. Find out whether yours does.

    Systems differ in how finely they slice this, but the principle doesn’t: these four should be four separate decisions, not one.

    The question to ask about each person

    Not do we trust them? Everyone will say yes and the meeting will end.

    Not might they ever need this? That question always answers yes, and it’s how you got here.

    The question is: what does this person need to do their job this month?

    The month framing does the work. It converts a hypothetical into a concrete recollection. The office administrator needs to add new households and update phone numbers — this month. The children’s director needs check-in and guardian records — this month. The small-group leader needs the roster and email for her group — this month. The treasurer needs contribution records — this month.

    Nobody needs all four categories to do anything this month. When somebody does need something extra — pulling year-end statements, running a report for the board — grant it, do the task, and take it back. Temporary access is normal in every other part of church life. You give someone a key to the building for a season and then you ask for it back, and nobody takes offence.

    The twenty-minute routine

    Do this once now, then twice a year. Set a timer; the constraint is what makes it repeatable.

    Export the user list. Most platforms will let you export or print the list of people who have logins and what level each one holds; if yours won’t, a screenshot or a typed-up copy does the job. Get it onto one page where you can see all of it at once. This step alone is usually the shock — churches routinely find far more active accounts than anyone in the room expected.

    Group people by what they actually do. Not by their title. Sort the list into rough buckets: office and administration, finance, children and youth, pastoral, group leaders, and a bucket for anyone you can’t place. Four or five roles covers almost every church.

    Find the accounts nobody recognizes. There will be some. The consultant who did your setup. An email address at a domain the church no longer uses. A name three people vaguely remember. A generic login called “office” or “admin” whose password is known to an unknown number of people. Deal with these first — they’re the highest-risk items on the page and the easiest to close, because nobody will miss them.

    Downgrade before you delete. This is the step that keeps the whole exercise from going wrong. Deleting a user in a church database can orphan the records they created, break reports, or remove notes someone else relies on. So drop people to the lowest level that matches their bucket, and leave the account in place. Watch for a month. If someone genuinely can’t do their job, you’ll hear about it in a day and you can restore it in thirty seconds. Then delete what’s still unused. Downgrading is reversible and quiet; deleting is neither.

    Write down the roles and set the next review. One paragraph in a shared document: here are our five roles, here’s what each can see, here’s who decides. Then put a recurring appointment in the calendar — twice a year is plenty, and pairing it with something you already do, like the annual meeting or the start of the program year, means it actually happens.

    The doors nobody audits

    Two categories sit outside the user list entirely, which is exactly why they get missed.

    Integrations and API keys. An API key is a long string of characters that lets one piece of software log into another without a human being present. Your giving platform talks to your church database. Your website’s event form pushes registrations in. A texting service reads your contact list. A volunteer’s clever spreadsheet syncs attendance. Every one of those connections holds standing access, often at a high level, and it does not appear in the staff list you just reviewed.

    Find the integrations or connected-apps section of your system and read it with the same question: do we still use this, and does it still need that much? Pay particular attention to anything created by someone who has left, and to keys generated by a volunteer for a project that finished. Those keys don’t expire because a person moved away. Revoke and regenerate anything you can’t account for.

    Volunteers on personal phones. Most of your group leaders and children’s workers access the system on a phone that is also used by their spouse, their teenager, and occasionally the family iPad. That phone may have no lock code. It stays signed in indefinitely. If it’s lost at a football game, a member of your congregation’s home address is in a stranger’s hand.

    You cannot manage those devices, and you shouldn’t try. What you can do is ask three things of anyone with a login: use a lock screen, turn on the extra step at sign-in if your platform offers it, and tell the office immediately if the phone is lost so the account can be signed out. Then find out now — not on the day it matters — whether your system can sign a user out of every device at once or force a password reset, and where that control lives.

    The same shape, whatever platform you’re on

    Churches run on Planning Center, Breeze, Tithely, Church Community Builder (now branded Pushpay ChMS), Realm, and a dozen others. Each names things differently, and the names change; the underlying concepts don’t, which is why this article describes them rather than giving you a menu path that would be wrong by next spring.

    Look for: a list of users and their permission level; named roles or permission groups you can define once and reuse; separate toggles for financial and giving data; separate handling for children’s and check-in records; a restriction on who can read private or pastoral notes; a way to mark an individual record confidential; and a connected-apps or API section. Not every platform has all of these. If yours is missing one — particularly the ability to hide giving amounts from general users — that’s a legitimate question to put to their support team, and a legitimate factor when you next review the contract.

    What to do this week

    Export the user list. Just that, first — it takes five minutes and it will tell you more about your actual risk than an hour of reading.

    Then spend fifteen minutes on the two highest-value items: close the accounts nobody recognizes, and check who can see giving amounts. If the answer to that second one is “everybody,” fix it today. It’s usually a single setting, and it’s the one your congregation would most want fixed.

    Permissions are one of the fastest wins available to most churches. MissionDefend’s free assessment asks straightforward questions about how your organization handles member data, donations, email and accounts — no jargon, no product pitch — and returns a baseline score with a ranked list of what to address first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Nobody hired you for this.

    You were the office administrator, or the associate pastor, or the one person who was comfortable with computers when the church moved its email over four years ago. The consultant set it up, handed you a login, and left. Since then you’ve added staff accounts, reset a few passwords, and hoped.

    Somewhere in that system are a dozen switches that would meaningfully protect your organization, and nobody ever told you they existed. They’re not hidden. They’re just off, because that’s how they shipped.

    Here are ten of them, in the order I’d do them, with an honest note on each about what it might break. That last part is the bit usually left out — and it’s the reason people abandon this halfway through, when a change nobody warned them about breaks the newsletter on a Friday afternoon.

    A note on menus, and on the word “admin”

    Both platforms redesign their admin console regularly. So this article describes each setting by what it does, not by which menu it’s under. Search the admin console’s own help for the concept name and you’ll find it faster than any screenshot from last year would have taken you.

    And to be plain about the word: an administrator account is the login that can create and delete other people’s accounts, read their mail, and change any setting here. In most churches, one or two people have that power and don’t think of themselves as having it. If your everyday account is also the administrator account, every phishing email you receive is aimed at the keys to the whole building.

    Start here: the two that carry the whole afternoon

    1. Multi-factor authentication for every single person. Multi-factor authentication — MFA, or 2-Step Verification in Google’s language — is the extra step after your password: a prompt on your phone, a code, a tap. Microsoft’s own research puts it at blocking more than 99.2% of account compromise attacks. Everything else in this article is a rounding error next to it.

    Do the administrator account first, and carefully. Microsoft now requires MFA to sign in to its admin portals at all, having rolled that out through 2024 and 2025, so this may already be forced on you. Set it up while you are sitting at a computer you control, with the phone in your hand, and confirm you can sign out and back in again before you touch anyone else’s account.

    Time: fifteen minutes for the admin account, then a few minutes per person.
    What it might break: older mail apps and desk devices that only know how to send a password — a copier that scans to email, a legacy accounting tool, a spouse’s ancient phone mail app. Make a list of those before you enforce it organization-wide, because they will fail silently and you’ll spend an afternoon chasing why the scanner stopped working.

    2. A second administrator account, so one lost phone doesn’t lock everyone out. This is the step people skip, and it’s the one that produces the worst days. If exactly one person is the administrator and their phone goes in a lake, nobody can add a staff member, reset a password, or recover a mailbox until a support process that takes days is finished.

    Create a second administrator account. Give it to a second trusted person, or keep it as a rarely-used emergency account with its credentials sealed in the safe where the church keeps its other important documents. Note that Microsoft requires MFA on emergency accounts too and suggests a passkey or a certificate rather than a phone, precisely so the emergency account doesn’t depend on the same phone as everything else.

    Time: ten minutes.
    What it might break: nothing — but a forgotten emergency account with a stale password is worse than none, because you’ll rely on it. Sign into it once a quarter.

    Mail: make impersonation and quiet theft harder

    3. Warning banners on mail from outside the organization. Both platforms can mark messages that came from outside your own domain, so a note claiming to be from your senior pastor visibly isn’t. Microsoft calls this external sender identification; it’s an organization-wide setting an administrator controls, and in most tenants it has to be switched on rather than being on already — check yours rather than assuming either way. Google has equivalent external-sender warnings.

    This is the cheapest defence there is against display-name impersonation — the trick where an attacker sets the friendly name on their account to “Pastor Dave” and your phone shows only that name.

    Time: ten minutes, though on Microsoft the tag can take a day or two to start appearing.
    What it might break: very little, but expect confusion in week one. Tell staff in advance, and tell them what the banner means: not this is dangerous, but this did not come from inside our organization. Some legitimate senders — your denominational office, a mailing service you use — will be tagged, and that’s correct behaviour.

    4. Block or alert on automatic forwarding to outside addresses. This is how theft goes unnoticed. An attacker who gets into a mailbox often sets a rule that quietly copies every message to an address they control, then leaves. They may never send anything from your account at all; they simply read your mail for months, learn your vendors and your payment cycle, and strike once.

    On Microsoft, automatic external forwarding is now blocked by default under the outbound spam policy — but confirm it, because a previous administrator or consultant may have switched it on. Google has an administrator setting that removes the automatic forwarding option from users entirely.

    Time: ten minutes.
    What it might break: real forwards people rely on. The retiring treasurer forwarding church mail to a personal address. A shared role account feeding someone’s personal inbox. Under Microsoft’s block, those messages bounce back to the sender with a message about external forwarding not being allowed — which is confusing if you weren’t expecting it. Find the legitimate forwards first, replace them with a proper shared mailbox or a group, then turn the block on.

    5. Audit the mail rules that already exist. Blocking new forwarding doesn’t remove what’s already there. In each staff mailbox — especially anyone who touches money — look at the rules and filters. You’re looking for anything the person doesn’t remember creating, and in particular for rules that file messages containing words like invoice, payroll, deposit, or bank into an unread folder or straight into deleted items. That’s a rule an attacker writes so the victim never sees the confirmation of what’s being done in their name.

    Time: five minutes per mailbox, and worth doing for everyone once.
    What it might break: nothing, if you ask before you delete. Some people have genuinely elaborate filing rules. Ask, don’t assume.

    Apps and evidence

    6. Review which third-party apps have been granted access. Over the years, staff have clicked “Allow” on things — a scheduling tool, a PDF signer, a survey app, something that promised to make Sunday easier. Each grant can carry standing permission to read mail or files, and it survives a password change. It also survives the departure of the person who granted it, and the closure of the company that built it.

    Both platforms list these. Microsoft shows the applications with permissions in your tenant; Google’s app access control lets you see connected apps and mark them trusted, limited, or blocked. Look for anything you don’t recognize or no longer use, and remove it.

    Time: twenty minutes, and genuinely interesting the first time.
    What it might break: a tool someone actively uses. Revoke, then tell people to speak up if something stops working — that’s a faster route to an accurate inventory than trying to research each one.

    7. Turn on audit logging before you need it. Audit logs record who signed in, from where, what they changed, what they downloaded. You will not care about this until the morning you need to answer “what exactly did they get into?” — and at that point, if logging was off, the answer is permanently unavailable. There is no way to go back and collect it.

    Here’s a detail worth knowing: Microsoft turns auditing on by default for most organizations, but not for the small-business licenses most churches actually hold — Business Basic, Business Standard, and Business Premium. On those, an administrator has to enable it. Once on, activity is retained for 180 days by default. Google Workspace keeps admin and login audit logs available in the admin console.

    Time: ten minutes.
    What it might break: nothing at all. This is the purest cost-free item on the list.

    Files and accounts

    8. Fix the sharing defaults on the shared drive. Both platforms let you choose what happens by default when someone shares a file: a link anyone on the internet can open, a link anyone inside the organization can open, or access granted to named people only. Many organizations are still on a permissive default, which means well-meaning staff have been generating public links for years without realizing it — for budgets, board minutes, and membership lists.

    Change the default so sharing requires naming a person. Then spend ten minutes looking at what is currently shared broadly.

    Time: thirty minutes including the review.
    What it might break: this is the item most likely to cause friction. Volunteers who open a bulletin template through a link may lose access. Anything you publish deliberately — a public calendar, a sermon archive — needs to be re-shared correctly. Do this one on a Monday, not a Saturday.

    9. Remove dormant accounts. The youth intern from two summers ago. The bookkeeper who left in 2021. The volunteer who set up your website and hasn’t been seen since. Each is a live door with a password that has never been changed and no MFA on it.

    Don’t delete immediately — on both platforms, deleting a user can take their files and mail with them. Suspend or block sign-in first, keep the account for a defined period, tell anyone who might need something from it, then remove it.

    Time: twenty minutes.
    What it might break: access to files owned by that person that other people still use. That’s exactly why you suspend before you delete.

    10. Know where “sign out everywhere” is — before the emergency. Changing a password does not always eject someone who is already signed in; active sessions can persist. Both platforms have a control that terminates every session for a user and forces a fresh sign-in — Microsoft describes it as revoking sessions, Google as signing the user out and resetting sign-in cookies.

    You are not turning anything on here. You are finding the button now, while it’s calm, and writing down where it is. The day you need it, you’ll need it in the next ninety seconds.

    Time: five minutes.
    What it might break: when used, it signs that person out of everything and they’ll have to log back in. That’s the point.

    What to do this week

    Block out ninety minutes and do items one and two: multi-factor authentication on the administrator account, done carefully, and a second administrator account created and written down where the church keeps its important papers.

    Then turn on audit logging, because it takes ten minutes, costs nothing, breaks nothing, and can only be done in advance.

    That’s the honest scope of this article: it’s an afternoon, not a project. And the first item alone is most of the benefit — if you only ever get one thing done, get MFA on every account and treat the rest as a bonus.

    MissionDefend’s free assessment covers exactly this ground in plain English — how your email, donations, member data and accounts are actually set up — and hands back a ranked list, so you know which of these ten to spend your one available afternoon on.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, mandatory multifactor authentication guidance; Microsoft, Set-ExternalInOutlook (external sender identification); Microsoft, manage emergency access admin accounts; Microsoft, configure external email forwarding controls; Microsoft, turn auditing on or off; Microsoft, revoke user access in an emergency; Microsoft, manage sharing settings for SharePoint and OneDrive; Google, protect your organization with 2-Step Verification; Google, let users automatically forward their own Gmail; Google, control which apps access Google Workspace data; Google, manage external sharing for your organization; Google, administrator privilege definitions.

  • Protecting the Livestream, the Funeral, and the Small Group Call

    Protecting the Livestream, the Funeral, and the Small Group Call

    The funeral is on a Saturday morning. Forty people in the sanctuary and sixty more watching from Ohio, Arizona, and a hospital room in Nashville, because that’s who the livestream is for — the family who couldn’t travel.

    Eight minutes in, during the eulogy, someone joins the call and shares their screen. What appears is pornographic. Then a second person joins, and there’s shouting over the audio and slurs in the chat, and the volunteer at the laptop at the back is clicking frantically through a settings menu he has never opened while a woman in the front row watches her mother’s funeral come apart.

    It lasts ninety seconds. People will remember it for thirty years.

    This is the article about making sure that doesn’t happen at your church, written so the person running the laptop can follow it. But start with the right frame: this is a pastoral emergency that happens to have a technical cause. The technical part is genuinely easy. The part where you sit with the family afterward is not, and it’s the part most guidance leaves out.

    The root cause is the permanent public room

    Nearly every incident traces back to one habit: a meeting room that is always the same address, always open, and posted where anyone can find it.

    It’s a reasonable habit. You want people to join without friction, and grandparents shouldn’t need a new link every week. So the link goes on the website, in the bulletin PDF, on the Facebook page, and into an email list that gets forwarded — and stays there, unchanged, for years.

    Which means it can be found. There are people who do nothing but collect these links from public pages and forwarded emails and pass them around, in order to disrupt whatever’s on the other end. Schools, council meetings, recovery groups, and churches are the usual targets, because all of them publish.

    The FBI has warned about exactly this since 2020, when it documented unidentified people disrupting video meetings with pornographic imagery, hate images, and threats. Its first two recommendations were plain: don’t make meetings public, and don’t post the link on unrestricted public social media.

    That’s the fix. The rest of this is how to do it without making it hard for an eighty-year-old to attend Bible study.

    You have three tools for controlling entry, and you don’t need all three at once.

    A waiting room. Everyone who clicks the link lands in a holding area and a host lets them through. This is the single most valuable setting in this article, and it’s on by default in most platforms now. For a group of twenty, admitting people takes fifteen seconds and you recognize every name.

    A passcode, required to join and separate from the link. Fine for a recurring small group; less useful for anything published widely, since it travels with the link.

    Registration. Attendees give a name and email in advance and receive their own personal join link. This is the right choice for a funeral. It takes the family two minutes to share a registration page with relatives, and it makes the guest list a known quantity on the hardest morning of their lives.

    Alongside that, three habits:

    Use a fresh link for anything sensitive — a funeral, a board meeting, a care group. Never the standing Sunday room. A one-off link is a one-off exposure.

    Don’t publish the link where it can be harvested. Put a button on your website behind a click-through or a short form, rather than pasting the raw meeting address into a public page, a printable bulletin, or a Facebook post. For a congregation, email and text is enough.

    Separate broadcasting from meeting. This is the biggest structural improvement most churches can make. A Sunday service doesn’t need to be a meeting — nobody in the congregation needs a microphone. Stream it to YouTube or Facebook instead, where viewers can only watch, and reserve the interactive platform for small groups where you actually want people talking. Half this problem disappears the moment the service stops being a room anyone can walk into.

    Take away the tools before anyone needs them

    Every disruption uses a capability the meeting handed out by default. Turn them off ahead of time, in your account settings — not in each individual meeting, where they’ll be forgotten. Menus change every few months, so here they’re described by what they do:

    Only the host can share their screen. The one that matters most. Screen sharing is how an image gets onto everyone’s display at once, and no participant needs it during a service. In a small group the leader can grant it for a moment when it’s needed.

    Turn off annotation — the tool that lets participants draw on whatever is being shared. It exists for classrooms. In these incidents it’s used to draw obscenities over a hymn slide.

    Turn off participant renaming. Renaming is how someone joins as “Pastor Dan,” or as something vile that then sits in everyone’s participant list.

    Then four smaller ones: mute participants on entry; in large gatherings, prevent them unmuting themselves; turn off private chat and file transfer; and don’t allow people to join before the host, because an unattended room is an empty stage.

    Name a second person whose only job is to watch

    This is the recommendation most likely to be skipped, and the one that actually saves a funeral. The person running the camera and audio cannot also moderate — their hands and attention are already committed, and in an incident the seconds spent hunting for the right menu are the seconds that do the damage.

    So name a second person, a volunteer sitting anywhere, even at home, signed in as a co-host — a role you assign that grants the ability to mute, remove, and lock. Their whole job is to watch the participant list and the chat.

    Give them three things: co-host permission, granted the moment the meeting opens rather than in the middle of an incident — Zoom, for one, only lets you promote a co-host once the meeting is running, so make it the first thing you do; a printed card with the four actions below; and explicit authority. Say that last one out loud: you don’t need to ask anyone. Remove first, explain later. Volunteers hesitate because they’re afraid of removing the wrong person. Removing a confused church member by mistake costs you an apology. Hesitating costs a family a funeral.

    Then practice once, for five minutes, in an empty meeting: have someone join and have the moderator remove them. Muscle memory is the point.

    The thirty-second response

    Print this and tape it to the sound desk.

    1. Mute everyone. There is a mute all control, and it’s the fastest way to stop audio. Do it first — sound reaches more people than an image does.

    2. Stop the screen share. A host or co-host revoking participants’ screen-share permission in the security controls ends a share in progress and clears the image from every screen at once. On Zoom, a single suspend participant activities control does that, mutes everyone, and locks the meeting together.

    3. Remove and report. Removing a participant takes two clicks from the participant list, and most platforms put a report option alongside it that ejects them and sends the account to the platform’s trust and safety team. Use report, not just remove — it gives the platform a record.

    4. Lock the meeting. Once the disruptors are out, locking keeps anyone new from entering. Latecomers are shut out for a few minutes; an acceptable trade.

    And for a stream, cut to a holding card. Keep a static image one keystroke away before every service — the church logo, or a slide reading We’re experiencing a technical difficulty and will return shortly. Switching to it is a calm, defensible act that buys you sixty seconds. Watching an operator scramble on camera is not.

    When it’s over, end the meeting entirely rather than continuing in it.

    Comments and chat on YouTube and Facebook

    Streaming instead of meeting solves the intrusion problem but introduces a smaller one: the comment stream running down the side of your service. Those controls are separate.

    On YouTube, live chat moderation lives in your channel’s community settings. Use three things: a blocked-words list, which blocks any live chat message containing terms you specify — putting the obvious slurs in it is a fifteen-minute job that runs forever; the filter that holds potentially inappropriate messages for review; and named moderators, channel roles letting trusted volunteers remove messages and hide users during a stream without having your password. On Facebook, page moderation works the same way: a profanity filter with adjustable strength, a custom blocked-words list, and a way to give trusted volunteers moderation access so they can hide comments and ban accounts without your password.

    On both, “hide” beats “delete” — a hidden comment stays visible to whoever wrote it, so they don’t immediately notice and repost.

    And the simplest control of all: turn live chat off for services where it adds nothing. Turn it on for the Wednesday study, where conversation is the point, and off on Sunday.

    Afterward: the part that isn’t technical

    If it happens, the technology stops mattering within two minutes and the pastoral work begins.

    Name it out loud, immediately. Don’t push through as if nothing occurred. When you come back on, say plainly: Someone deliberately disrupted our service. That was an attack on us, it was nobody’s fault here, and it’s over now. Silence lets people assume it was somehow the family’s doing, or the church’s negligence.

    Go to the family that day, in person. Not by email. Say clearly that this was done to them by strangers who target funerals precisely because they are tender, that it says nothing about their mother or their church, and that you are sorry. Ask what they want done about the recording — usually the answer is delete it, and be ready to say yes immediately. Take it down in the meantime; you can always restore it, and you can’t unshow it.

    Tell the volunteer it wasn’t their fault, and mean it. The person at the laptop will carry this longer than anyone but the family, and will consider quitting. They weren’t trained, weren’t equipped, and the settings were not their decision.

    Say something to the congregation in the next communication: what happened, what you’ve changed, who to talk to if they’re shaken. Recovering trust here depends far more on visible correction than on explanation.

    And report it, because this is not merely rude behavior. The Department of Justice has stated plainly that hijacking a teleconference can be charged as a state or federal crime, listing possible charges including disrupting a public meeting, computer intrusion, using a computer to commit a crime, hate crimes, fraud, and transmitting threatening communications, with penalties including fines and imprisonment.

    Report it three places: the platform, using the in-meeting report function while it’s happening if you can, since that preserves account data on their side; the FBI at ic3.gov, with the date, time, and display names used; and local police, particularly if there were threats, if the content involved children, or if the disruption was religiously or racially targeted. Ask whether it should be reported as a hate crime — in many places, targeting a religious service changes the classification.

    Before deleting anything public, save what you have offline: screenshots of the participant list, the chat log, and the recording.

    What to do this week

    Open your video platform’s account settings — not one meeting’s, the account’s — and set four things: waiting room on, screen sharing host-only, annotation off, renaming off. Ten minutes, once, for every meeting you will ever hold.

    Then name your moderator. Text one reliable volunteer, ask them to be co-host on Sunday, and send them the four-step card: mute all, stop the share, remove and report, lock the meeting. Tell them they have authority to act without asking.

    That’s twenty minutes, and it’s the difference between ninety seconds and thirty years.

    Wondering what else is sitting unlocked? MissionDefend’s free assessment asks plain questions about your accounts, your member data, your email, and your online giving, then returns a baseline score and a ranked list of what to close first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Federal Bureau of Investigation, Boston Division, FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic; U.S. Department of Justice, Eastern District of Michigan, Federal, State, and Local Law Enforcement Warn Against Teleconferencing Hacking During Coronavirus Pandemic.