- [Man] While many people view social networking
as a way to chat with friends or share cat videos,
organizations take social networking very seriously.
Facebook, Twitter, and LinkedIn are
valuable business tools that organizations
may use to connect with customers,
communicate with stake holders,
and recruit potential employees.
It's very important that these organizations
implement strong security practices
designed to keep their social network account secure.
One of the most common attacks against
corporate social media accounts is when
an attacker manages to hijack an account.
This commonly occurs when an account has a weak password,
or the attacker manages to use social engineering
to trick someone into granting him or her access.
For example, Tesla recently had
their Twitter account hacked.
And the perpetrator posted this tweet,
advertising that Tesla was giving away vehicles
to anyone who called a listed phone number.
The number belonged to a computer repair shop
in Illinois that was inundated with phone calls.
The easiest way to protect your organization
against these attacks is to use
multifactor authentication on your accounts.
All of the major social networks provide this function.
Let's take a look at how you can enable
multifactor authentication on Twitter as an example.
Here I am in the account settings of my Twitter account.
Let's go ahead and take a look at the
security and privacy settings.
Notice, the first security setting here, log in verification
allows you to verify log in requests.
I have this box checked.
And because this box is checked,
every time I try to log into my Twitter account,
after I enter my username and password,
as it says here Twitter will send an SMS message
with a code to my phone and then I have to
enter the code from my phone onto Twitter's log in page
in order to complete the log in sequence.
This is two-factor authentication
because it uses something I know, my password,
in conjunction with something I have, my phone,
to prove my identity to Twitter.
Many organizations use third-party tools
to assist in managing their social media accounts.
Tools like Buffer and Hootsuite
allow many different people to manage
multiple social media accounts across organizations
and include features like approval workflows for posts,
the scheduled release of posts,
the management of comments and replies,
and the tracking of social media statistics.
Organizations that use social media management tools
should ensure that they evaluate those tools
just as they would any other service.
Tools grant access to social media accounts
and should be carefully protected.
Finally, organizations should adopt
formal social media policies that help employees
understand their obligations while using social media
in either official or unofficial capacities.
Let's take a look at the contents
of one such policy from IBM.
IBM Social Computing Guidelines seen here
provide some very specific information
for IBM employees on their use of social media.
After a brief introduction stating some
principles for the use of social media,
IBM has 12 specific guidelines that they put in place
to ensure their employees' use
of social media is appropriate.
We won't go through all of these right now,
but they include the responsibility of employees
to follow the company's business conduct guidelines,
which states that employees are
personally responsible for whatever they publish online
and goes about explaining how employees should
and should not identify themselves
and their role at IBM if it's relevant to the conversation.
The use of social media can be a valuable business tool
but organizations must ensure that they consider
and address the associated security risks.