Reputational Damage & The Human Factor In Social Media

Experts agree: The greatest cybersecurity risk modern businesses currently face comes from people, not from a lack of firewalls or security policies. 

In one survey, 77% of respondents indicate that despite training and corporate policy, mistakes by employees remain the most likely source of a cyber-security attack. Your employees need help recognising the warning signs and understanding how to protect themselves online.

This risk is especially apparent on social media, where brand reputation and personal relationships play a strong role in the level of trust users place in shared content.

Not All Forms of Engagement Are Equal
Inherently, social media is about engagement, and liking, sharing, and commenting are typically among the primary features offered by social networks. Actions like these are baked into the very fabric of the networks themselves through features designed to drive users to engage with media through notification, suggestion, and promotion of various kinds.
With a push toward engagement comes an inherent level of trust that content posted by colleagues or other trusted organisations and communities is truthful and safe to view or engage with. 

For years now, we've educated employees about the dangers of scams, phishing attempts, and malicious content delivered via email (e.g., "Don't click that link!"), but when it comes to social media, organizations struggle to effectively deliver the same message.For instance, your employees may assume at times that they are engaging with customers in need of assistance or prospects who are requesting information when in reality, bad actors often use fake accounts to target your staff on platforms such as Twitter, LinkedIn, and Facebook. 

Without proper training and tooling to secure social media accounts and identify these risks, users often fall prey to a host of issues that threaten not only themselves but their employers as well.

Whether via account takeover attempts, personal and corporate data leaks, cybercrime, or malware delivery, social media risks pose a material threat to organisations, and your employees need help recognizing the warning signs and understanding how to protect themselves online.

Your (Un)intentional Brand Ambassador
Although social media engagement is an explicit aspect of some employees' job responsibilities, most organisations will find that, whether intentional or not, a larger swath of employees represents their brands online. 
With no more than a quick Google or LinkedIn search, employees can be traced back to your organisation, and employees’ shared content and personal views have the potential to reflect poorly on your brand when in conflict with your organisation’s core values and principles.

In recent years, you may have even noticed an increase in proclamations and account descriptions containing phrases like "views are my own" or "retweets are not endorsements." While such statements may seem like a solution to the issue of separating corporate and personal personas, public perception will inevitably continue to associate your employees and their (potentially controversial) viewpoints with your brand. 

This is especially true for high-level executives; and, while we may like to think that corporate executives have the ability to understand that personal expression and corporate attribution are easily entangled, history has repeatedly proven otherwise.

Regardless, employees of all types should be cognisant of the impression they make on social media and its influence on corporate perception.

Beyond employee-driven risks lie additional dangers. Bad actors often target employees on social media as a first attempt to access your organization at large. Imposters have disguised themselves as customers, executives, prospects, and colleagues to encourage employees to click malicious links and share confidential information. 

This can be detrimental to your overarching brand, particularly if it leads to a breach or account takeover. In the past, we've seen this result in the termination of business contracts, levying of fines, and other immeasurable impacts to trust, opportunities, and revenue.

Protection vs. Privacy
A simple mistake on social media can leave a lasting impression; however, when it comes to protecting employees, employers often cite privacy concerns. Trading privacy for security is a classic tussle and undesirable compromise, and it’s relatively safe to assume that most employees are uncomfortable with the notion that their employer may be monitoring their personal social media activity. 

This "Big Brother" concern often leads to inaction on the part of an employer, causing an unnecessary level of risk on the books. To combat this issue, it's important to empower employees to take social media protection into their own hands — without compromising privacy.

Put Your Employees in the Driver's Seat
As participants in social media, your employees' actions online shape and contribute to the perception and messaging of your brands and organization. 
Despite the blurring of lines that exist between professional and personal accountability, you have the ability to empower your staff to make smart decisions on social media and help protect all parties involved. Here are a few tips for getting started:

● Assemble a Social Media Task Force: Loop in marketing and information security teams to assess and prioritise risks, establish a set of processes and policies, and decide on roles and responsibilities.
● Train Relevant Staff: A critical component of a social media protection program is training relevant staff on policies defined by the task force. When you train employees on internal policies, also include general education topics around social media protection, security, and privacy. 
At the very least, ensure employees are comfortable with two-factor authentication, identifying malicious posts, and recognising when credentials have been leaked.
● Watch for Trends and Update Policies & Processes Accordingly: Assign someone to stay abreast on social media topics, including emerging threats, evolving threat vectors, and changes in policies and regulations (these should be rapidly incorporated into existing policies and procedures).

By taking these steps, organisations can reduce risk and bolster corporate confidence while simultaneously keeping your employees safe and in control of their own social media. 

Dark Reading:      Image: Nick Youngson

You Might Also Read:

Cyber Know How For Management In The Digital Age: (£)

Social Media & Crisis Management:
 

« The Image Of Julian Assange Grows Darker
Organisations Are Identifying Cyber Threats More Effectively »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

RedTeam Security

RedTeam Security

RedTeam Security is a provider of Penetration Testing, Social Engineering, Red Teaming and Red Team Training services.

Quotium

Quotium

Quotium provides automated testing technologies to make business software applications secure and robust.

Maryman & Associates

Maryman & Associates

Maryman & Associates are specialists in computer forensic investigations, incident response and e-discovery services.

VNCERT

VNCERT

VNCERT is the national Computer Emergency Response Team for Vietnam.

ISC2

ISC2

ISC2 is an international, non-profit membership association for information security leaders. Our information security certifications are recognized as the global standard for excellence.

Salient CRGT

Salient CRGT

Salient CRGT is a leading provider of health, data analytics, cloud, agile software development, mobility, cyber security, and infrastructure solutions.

TruNarrative

TruNarrative

TruNarrative provides a unified solution for Identity Verification, Fraud Detection, eKYC, Risk Assessment, AML Compliance and Account Monitoring.

CMMI Institute

CMMI Institute

CMMI Institute enables organizations to elevate and benchmark performance across a range of critical business capabilities, including product development, data management and cybersecurity.

iFluids Engineering

iFluids Engineering

iFluids Engineering is a leading engineering consulting and risk management firm providing a full range of services including Cyber Security for Industrial Control Systems.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Keeper Security

Keeper Security

Keeper is a leading enterprise password manager and cybersecurity platform for preventing password-related data breaches and cyberthreats.

Soliton

Soliton

Soliton is a leading Japanese technology company and a pioneer in IT security solutions for protecting company resources and data from external IT security threats.

Secmation

Secmation

Secmation are an agile engineering services firm providing advanced DoD level security design and consultation services for both commercial and defense hardware and software applications.

Query.ai

Query.ai

At Query.AI, we are committed to helping companies unlock the power of their security data, so they are empowered to meet security investigation and response goals while simultaneously reducing costs.

Conseal Security

Conseal Security

Mobile app security testing done well. Conseal Security are specialists in mobile app penetration testing. Our expert-led security analysis quickly finds security vulnerabilities in your apps.

NinjaOne

NinjaOne

The NinjaOne Platform was built to help IT and MSP teams efficiently manage, patch, and support all endpoints.