Lower Risk and Exposure to Cyber Crime; Consider a Social Media Policy for Your Employees

Have you ever thought about how the information on social media can harm your company? Well, it can in the form of phishing attacks and to be precise, spear-phishing as well as be used as a tool for spreading malware and for business email compromise (BEC). Cyber criminals do their research more often these days. They find out about potential victims by looking them up on the web to get to know them better. Social media sites such as LinkedIn are their “go to” places. What your employees put there and to whom they connect is important.

Intel Security did some research and found that people do very little of their own due diligence before connecting with someone. In fact, a report they released from a study of 2,000 UK-based respondents found that 69% of them connected to a stranger on LinkedIn. More troubling was from research by OnePlus which found that only 53% of those surveyed checked for the “verified” badge on a retail brand’s profile. Even fewer checked on past Tweets and posts, or for a number of followers or likes.

This is quite worrisome in many ways. It’s is surprisingly simple to create fake social media accounts; and email scams are still the number one way malware gets into networks allowing data breaches to occur and BEC attacks to succeed. That is because the information on sites such as LinkedIn tells a lot about the individuals working for any given company. So much that a phisher can often times find out who is likely to have authorization to perform wire transfers. The FBI reported not long ago that BEC attacks have increased 270% throughout 2015 and shows no signs of slowing in 2016. This is when a fake request for a wire transfer is sent via email from a scammer posing as an executive. They are successful, which is why training those who have this authorization on identifying them is crucial.

Does your organization have a policy or guidelines for what employees can put on social media or how it can be used? If not, it’s worth consideration. Intel Security found that 87% of the respondents in their survey said their employers never made them aware of any such policies or guidelines around using LinkedIn. Taking some time to create one or add it to your annually reviewed security policy is worth it.

It should include best practices and guidelines about what information should or more importantly, should not be shared. There should be a training plan implemented for employees and incoming employees to make sure that everyone is made aware of them and it should be reviewed regularly. Consider more specific policies on executives, as they are the ones often impersonated in BEC attacks. Remember to always have penalties defined and enforce your policy.

Regardless of what you decide to put into your policy, it’s important to let everyone in your organization know of the risks to them personally, as well as to the organization. Don’t think of it as yet another task that needs to be done. Take it seriously and include this policy in your security policy. It can help you avoid a costly data breach and lower your risk of paying any part of the billions of dollars the FBI says was lost due to BEC.