Social media security

Social Media Security By- Tapti Datta

Social media can enrich employeeperformance and create a vibrantcorporate community. The downsides?A business’s network and data couldbe compromised, and its reputationand brand could be put in seriousjeopardy.

Social Media + You – Brand andReputation Management = Disaster

There is no brand immune to a negative event …“I apologize to everyone who was offended by my insensitivetweet about the situation in Egypt….” – KC via Facebook

Regulatory and Business Considerations Devoting new resources and creating processes to address SM usage• Privacy Concerns – Need to keep customer information private• SM applications increase security threats – Spam – Malware – Viruses – Data loss – Cyber crime – Drains I.T support network and resources – I.T security for company-issued Smartphones

SM Risks for Companies• Viruses and malware — Data leakage/theft• Brand hijacking — Customer gets exposed to hijacked and fraudulent presence• Lack of control over corporate content — When employees post wrong or improper information on social media sites• Unrealistic expectations of customer service at Internet-speed• Mismanagement of electronic communications that may be impacted by retention regulations or e-discovery Web 2.0 platforms are increasingly powerful and open and enable more sharing of rich data

SM Risks for Employees• Using personal accounts to communicate work related information Prevention: Have HR establish policies and awareness training so employees do not share company info• Posting pictures or information that might damage a company’s brand Prevention: Again, work with HR to develop policies that explain what can and cannot be shared• Excessive employee use of social media in the workplace Prevention: Create content filtering or limit access to sites• Employee access to social media via mobile, which may result in data theft or leakage Prevention: More policies, more training, more controls

LinkedIn SSL Leaves Accounts Vulnerable to Hijacking• Man in the middle (MITM attack)• The first vulnerability as being the presence of an "SSL cookie without [a] secure flag set," leaving a users web browser cookies exposed and their account susceptible to hijacking• The second vulnerability relates to "cookie expiration and session handling," where the cookie for an authenticated session is available even after the session has been terminated or way beyond the date of expiry (instead compared to session logout, it is valid for 1 year)

Possible Strategies• Multilayered security at the gateway and end point• Content classification, Content filtering, and Data loss prevention (DLP)• Scanning to verify incoming content and traffic• Web security tool - configure the Internet gateway to block malicious inbound traffic such as cross-site scripting exploits and phishing• Inbound content filtering - spam blockers and anti-virus applications blocks or allows communication based on analysis of its content• Outgoing traffic - a DLP solution enables business to screen content before it leaves the corporate network

Possible Strategies (contd.)• Identity and access management (IAM) - use of strong IAM controls and multifactor authentication• At the end point, businesses should lock down users’ Web browsers to block JavaScript and plug- in capabilities (assuming that does not impact work applications)• Web 2.0 apps on mobile devices - security policy must protect the integrity of the device and the sensitive data stored on it

Common hoaxesURL Shortening Services(obfuscation)http://tinyurl.com/ or http://bit.ly/

OpportunityFacebook is today beginning a program that will allow them to compensate hackers that discover vulnerabilities in the site’s code, reports Computerworld. In order to be compensated, the hackers must sign up for the new whitehat hacking portal and report the issues directly to Facebook’s security team.Read more - http://thenextweb.com/facebook/2011/07/29/facebook- starting-to-pay-hackers-to-discover-vulnerabilities/Sophos Social Media Tool kit –• Your free social media security toolkit• Safety tips to learn, share and help others• Tools to secure your organization

Questions?

Social media security

by n|u - The Open Security Community on Nov 25, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 525

Statistics

Social media security — Presentation Transcript