Infosec Practitioner’s Guide to Philanthropy

I came from a small town in western Kentucky where there wasn’t a lot of opportunity. As the son of a trucker and a sewing machine operator we struggled to get by and there were a lot of things stacked up against me as a kid who wanted to be successful in an industry that was not represented at all in my area. Despite those odds, I was fortunate to live in a place where community mattered, and several teachers and others in my life gave of themselves to ensure that I had a fighting chance. Since then, I vowed that no matter where I went or what I did that I would always remember where I came from and give of myself to others. It’s for that reason that I’m passionate about giving back to communities like the one I grew up in, and that’s also why I started the Rural Technology Fund seven years ago. As the phrase goes, “If you’re lucky enough to do well, it’s your responsibility to send the elevator back down.”

Before I get too nostalgic, let me give you my word that the purpose of this post isn’t to make you feel lazy or send you on a guilt trip. While charity is important to me, I recognize that it isn’t to everyone and some people simply aren’t in a position to give their time or money. I write a lot about the importance of giving back, and people frequently ask me what they can do to contribute in a way that is relevant to the profession of information security. The purpose of this post is to discuss a few different ways you can contribute.

What Do You Care About?

Once you’ve decided you want to give back in some way, the first thing you should consider is what you really care about. If you work in infosec then you probably care about technology, but in what way? There are a lot of great technology-focused causes:

Beyond technology and security your interests might lie in other areas. When you watch the news, what stories draw out the emotion in you? What circumstances of the human condition make you angry? These are questions that can help you discover areas you care about. For example:

*Note: I don’t necessarily support all of these organizations, these are just examples. 

Even if you want to support non-technical charities there are ways you can use your technical skills to do so, which I’ll talk about later. Don’t donate your time or money to an organization just because you don’t know what else to do. Everybody cares about something and if you can think of an issue you care about then there is a good chance there is a philanthropic organization out there trying to address that issue.

What Kind of Commitment Can You Make?

Once you’ve thought about what you care about, the next step is to figure out what level commitment you can make. Do you want to donate money, time, or both? This section is organized with that in mind. While reading through this section you should try to be realistic about your commitment. If you are living paycheck to paycheck you probably don’t want to commit to donating hundreds of dollars to a charity. On the flip side, if you work eighty hours a week you probably don’t want to commit to another twenty hours of volunteer work. The last thing you want is to over commit yourself and burn out on something that should be an enjoyable experience.

I have extra cash, but limited time…

Donating to Traditional Charity

The most common method of giving back is to donate money directly to an existing charity. When you do this you are supporting the broader mission of a non-profit, or when possible a specific initiative of the organization. Some popular options include the Rural Technology Fund (shameless plug) and Hackers for Charity.

Pros:

  • Very low time commitment
  • Very easy and can often be done online in a matter of minutes
  • You rely on experts to turn your donation into impact
  • A lot of people donating small amounts can enable a charity to do great things
  • Donations are tax deductible for 501(c)(3) non-profits

Cons:

  • You don’t always get to see the direct benefits of your donation
  • Administrative costs can eat up some of your donation
  • You have little or no say regarding the exact use or allocation of the money
  • An organization that shares your interests may not exist
  • There aren’t a lot of information security related non-profits

Tips for Success:

  • Read as much as you can about the non-profit. Be sure you understand their mission statement, leadership, and how your money will be used.
  • Look for a statistic on what percentage of every dollar is spent on administrative costs. The less the better.
  • If you believe in an organization enough to donate, consider buying some of their swag to help spread awareness.
  • Make sure you are donating to a 501(c)(3) and track your donations for tax season.

Donating to an Interactive Charity

A modern trend in charitable organizations is the concept of allowing donors to connect directly with the people they are helping. These provide a higher level of interactivity compared to traditional non-profits so you can feel a bit more connected to the cause you are contributing to. Two popular interactive charities are Kiva and Donors Choose. Kiva allows donors to provide micro-loans to entrepreneurs in developing nations, and then reloan that money back out when it is paid back. Donors Choose provides a mechanism for teachers to request things they need for their classrooms so that donors can pick the classroom they want to support. I’m a big fan of interactive charities because it makes me feel a lot more connected to those I’m trying to help.

Pros:

  • Low time commitment other than spending time selecting how your donation is used
  • You rely on experts to vet potential recipients and deliver funding
  • Higher interaction than traditional charities
  • Helps you feel much more connected to those you are helping
  • Selecting donation recipients can be a fun family activity
  • Donations are tax deductible for 501(c)(3) non-profits

Cons:

  • You don’t always get to see the direct benefits of your donation
  • Administrative costs can eat up some of your donation
  • You have little or no say regarding the exact use or allocation of the money
  • An organization that shares your interests may not exist
  • There aren’t a lot of information security related non-profits

Tips for Success:

  • Consider giving a donation as a gift. Many of these organizations allow you to buy gift cards to give away so that others can try making a targeted donation. This is a great way to get others involved in an interactive charity so they can see how it works.
  • When you can try involving others. Make a night of looking through donation recipients with your spouse or kids. It’s a great way to instill a sense of charity in others and provides bonding opportunity.
  • These sites often serve a lot of causes, so try to make your donation mean something to you. On Kiva you can make microloans to individuals running Internet cafes or selling computer services. On Donors Choose you can donate computers and electronics to classrooms. On both sites you can also select the region of your donation recipient.
  • Make sure you are donating to a 501(c)(3) and track your donations for tax season.

I have a lot of free time, but not much extra cash…

While many think that the only way to give back is to donate money, the truth is that donating your time is often much more valuable. When you donate time, you have the opportunity to interact and network with other like-minded people and you often get to interact directly with those you are trying to help. There is no greater motivator than witnessing the change you’ve helped make.

Volunteer Your Skills

The thing that makes security so hard is that you have to be a programmer, sysadmin, network engineer, and auditor all in one. Guess what? Those are all skills that are very helpful for non-profit organizations that struggle to make a positive impact and manage administrative costs. Leveraging your skills gives you a great opportunity to serve a non-infosec related cause that you care about. For instance, if you are interested in housing for under privileged families, consider looking up your local Habitat for Humanity chapter and seeing if they need any help keeping their computers or network running, or working on their website. When you donate your time to help with technical tasks it means the organization doesn’t have to pay for those services, which allows more of their funding to go towards mission goals.

Pros:

  • Provides a direct impact to a charitable organization
  • Allows you to use technical skills to positively impact organizations that aren’t necessarily technology focused
  • Generates opportunities for networking with like minded people and others who share your skills
  • Provides an opportunity to keep up technical skills you might not use as much

Cons:

  • Can be time consuming
  • May require some level of freelance contract with the organization
  • Could require you to accept some level of responsibility for things you are helping with, like keeping a website running or getting calls when systems go down

Tips for Success:

  • Start local. There are probably a lot of organizations in your area that could use your help.
  • Think about what you are passionate about and look for organizations that support related causes.
  • Consider working with local industry professional associations like ISSA to arrange group volunteering.
  • When nothing is available locally, look for remote volunteer opportunities. Certain technical skills can be of help without having to be in the same city as the organization you’re supporting.

Share Your Knowledge

One of the things that makes the information security community great is that we have so many people who are willing to share knowledge. While giving presentations at local high schools or colleges isn’t as sexy as speaking at Defcon, it can be just as impactful. You can share your knowledge at many levels in all sorts of venues from high schools to universities to senior citizen communities. While not everybody is going to get something out of discussing exploits and detection systems, its highly likely your security experience can appeal to a much larger audience at a more fundamental level.

Pros:

  • Sharing knowledge with people who care enough to receive it is very gratifying
  • Exposing younger people to information security might spark their interest in pursuing it as a career
  • We all know how important end user security is, so sharing techniques for being safer on the Internet is in the best interest of our industry
  • Speaking events like this are a great way to get more connected with your community

Cons:

  • In smaller areas it may be hard to find and organize events at first until people know more about you
  • Planning and giving presentations can be very time consuming
  • Not everyone is comfortable teaching or speaking

Tips for Success:

  • Contact school administrators to gauge their interested in what you have to offer. Be professional and be prepared with a few ideas for topics and a basic outline of what you’d like to speak about and why it’s important.
  • Considering reaching out to your local city or county government to see if they could use your help. If you live in a small town then chances are that they don’t even have a security staff, so some basic user awareness training could go a long way.
  • Try organizing basic “How to Use the Internet” classes for the elderly in assisted living communities. Teach them how to get online and how to use e-mail so they can receive pictures from their family.
  • If your town has a college or university, see if they have an infosec or technology users group that might benefit from your experience. Consider giving a conference-style presentation or helping setup some hands-on labs. College students often yearn for hands on experience beyond the theory they get in the classroom.

I don’t have a lot of free time or any extra cash…

Get Your Employer Involved

Most organizations of any reasonable size have at least a few people who share common philanthropic interest. In many cases organizations are motivated to support these causes because it is tax incentivized and helps the overall company brand.

Pros:

  • It can provide a way for those who typically couldn’t afford to give back the opportunity to be able to do so
  • Supporting charities in this manner is good for the company brand, and is also tax incentivized
  • Employer sponsored giving can provide great team building opportunities
  • Harnessing the giving power of an entire company can have dramatic and tangible benefits to certain causes

Cons:

  • Your employer might not always be able to contribute to a cause specifically relevant to you
  • It may take a fair bit of convincing to get your employer on board initially

Tips for Success:

  • Ask your boss about providing matching contributions to charitable organizations. Many companies will provide a donation match up to a certain percent, and some will allow for those donations to come from pre-tax income.
  • Get your coworkers together and organize an after hours volunteering event. Something as simple as picking up trash on the side of the road or serving meals as a homeless shelter instills a sense of service and is great for team building.
  • Ask your employer about sponsoring a “Philanthropy Day.” This is an extra day off provided to every employee that they can use to serve the needs of an eligible philanthropic organization. This is low cost to the employer and it can be use to facilitate group volunteering events like I mentioned above. FireEye provides a philanthropy day every year and it was one of my absolute favorite parts of our benefits package.

Advocate

The first step for any non-profit organization is to advocate for their cause to raise awareness. If people don’t know that a problem exists they won’t be willing to help work towards a solution. Advocacy is very important and it is happening around us all the time. For example, years of advocacy is why many of us think about breast cancer awareness when we see someone wearing pink. Spreading the word about causes you care about isn’t time consuming, usually costs little or no money, and can inspire those with free time or disposable income to take action.

Pros:

  • Requires very little time investment
  • Requires little or no money
  • Inspires others to take care and take action

Cons:

  • Most of the impact of your work is indirect so you won’t always see immediate benefits

Tips for Success:

  • Use social media to highlight information relation to the problem you want to address or the work of organizations who are trying to help.
  • Consider buying clothes branded by the organizations you want to support. Something as simple as a t-shirt is cheap, the money supports the organization, and when people see you wearing it that raises awareness.
  • Think about purchasing items through Amazon Smile. It allows you to direct a small percentage of your purchase to eligible non-profits and gives you an opportunity to share your actions via social media.

Conclusion

While this guide certainly isn’t an all inclusive listing of every way you can give back, my hope is that it has provided some ideas for you to channel your desire to give into something useful. Not everyone is in a position to give back, but if you have a desire to do so then it is possible even with very little free time or money to part with. Are you doing something cool to give back that I don’t have listed here? Consider putting it in the comments below.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.