First off, thank you ahead of time for your patience.

We are a small non-profit with a 100% volunteer staff. We deal with children and some adults that suffer from Mitochondrial disease.

So, I was put in charge of trying to find how we can (with our limited funds)keep as safe as possible.

I'm currently looking into VPN's. We use to use Peoples Internet Service but there software keeps kicking us off. We also use a TOR browser and we are looking into TORguard.net as a VPN.

Is this the best way to go, with the limited funds we have? We are using Protonmail for our email.

Also, it seems that ATT is starting to implement new pricing structures that make you pay higher prices if you want complete privacy and no tracking! ABSURD. We are hoping this will be a work around, since we are limited in providers.

I'm not an IT person, so excuse me if I sound ridiculous.

Your help is deeply appreciated. :) -Stephie

  • 5
    What are you trying to keep safe from? The first step in building a secure system is to determine what the threat model is. Only then can you know how to protect your system from those threats. At first glance, I'm not sure why you'd need a VPN or Tor at all. – Xander Mar 31 '15 at 19:29
  • @stephie I would mirror xander's questions. What is the objective? What data/information are you trying to keep safe and why? Is it to comply with HIPAA or for some other requirement? What policy are you trying to satisfy? Is it staff information? Customer information? – Goblinlord Apr 1 '15 at 1:56

Per xander and Goblinlord's comments, let's go over some of the technologies you mention.

VPN (virtual private network) solutions are used to create secure network connections over the public Internet. If you have more than one office location, or you have people working remotely from home or on the road, you use a VPN to enable secure communications between those users and your internal network. VPN technology presupposes that you have an internal network at some location, e.g. an intranet with email, file servers, etc. In this day and age of cloud-based services, it is entirely reasonable that a small non-profit might have no internal network resources except users' computers, in which case there might not be an especially good reason to have a VPN. If you have at least some resources on an internal network, a VPN is a must if you want to share those resources with remote users.

Tor, on the other hand, is all about anonymizing your Internet traffic, primarily to prevent people monitoring your Internet connection and seeing what places you go on the Internet, or learning your physical location using IP address geo-mapping.

Note that Tor alone is not enough to guarantee anonymity. You have to enforce very strict rules around application usage or your identity can still possibly be discovered. This is a very important rule because breaking it invalidates the entire purpose behind using Tor.

ISPs connect you to the Internet via dial-up, mobile, satellite, cable, DSL, etc. In most countries, any decent ISP should allow you to use Tor and/or a VPN without interference.

It sounds like you have an office. If so, I recommend a broadband connection from a cable or other provider in your area. Options vary widely by location so it pays to do your research. As a non-profit, you may be able to get discounted service from some providers, so that's worth checking into.

The torguard.net VPN service sounds like a secure proxy rather than a VPN, but I don't know enough about their services to give you an answer on it.

Lastly, per the comments, what are your goals? You say you want to stay safe, but what does that mean to you? None of these technologies will prevent someone on your staff from going to a malicious web site and possibly having their computers hacked. Staying secure means keeping up with operating system patches, browser and browser plugin (Flash) updates, using anti-virus software and most importantly training your staff not to fall victim to things like phishing attacks over email or the Web.

  • Thank you so very much for explaining the differences. We are basically worried about allowing hackers to take private information of our clients/patients that we are helping with our foundation. We are a very small foundation, so we're trying to find cost effective ways to do this. Right now, we are using a VPN (Private Internet Access) and a Tor browser in hopes that this will/might help. We are also using Wikr, between colleges and Chat secure. And also as mentioned PHOTONmail for email. Are their any more apps/programs that might help while we get our funds in place? THANKS Again!S. – Stephie Apr 1 '15 at 21:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.