The risks of social media

1 November 2018 Information Security

Even for companies that have robust IT security solutions in place, protecting networks and data is growing increasingly complex as security gaps emerge where they are least expected. With the emphasis on technology to protect data assets from threats from the outside, internal threats – such as a company’s employees – are often overlooked.

“Employees, their social media profiles and the devices they use to access a company’s network and resources provide a plethora of gateways into the infrastructure for cyber criminals. Organisations should take care to not focus purely on traditional defences. Attackers will quickly change their strategy from trying to bypass a strong perimeter defence to attacking the human element,” says Charl Ueckermann, CEO at AVeS Cyber Security.

AVeS recently conducted a vulnerability assessment as well as internal and external penetration tests for a large mining company. The company has 5500 users on its system, with 1281 of them using company-associated LinkedIn profiles. This equates to 23% of employees on LinkedIn. The company’s IT security status appeared to be excellent, with a few vulnerabilities detected, until AVeS Cyber Security suggested a simulated social engineering attack.

Open information on social media

With just a week of researching employees’ LinkedIn profiles and gathering information about them using publicly available resources on the Internet, AVeS Cyber Security’s team was able to identify employees that would be suitable targets for the social engineering project. Social engineering is the process of deceiving people into giving away access to protected systems and confidential information. Attackers use a variety of means to con their targets into giving away sensitive data or personal details, with phishing emails and social media monitoring being amongst the most commonly used. It is a formidable threat to even the most secure networks.

“We were able to get their contact details, designations and other relevant business information. This allowed us to contact them under the guise of being from internal IT support and request that they conduct an update on their computer. This way, we were easily able to convince a number of employees to install unauthorised and dubious software on their systems. None of them questioned the legitimacy of the request to install software from an Internet site that did not form part of the organisation’s approved IT landscape.

“This gave us full access to the computers, including private and sensitive data, without the user knowing that their system had been compromised. We were also able to crack into a machine that was part of a local admin group, and through this account, we were able to get access to almost all of the computers in the company’s network.”

In a real-life attack scenario, this is a breach of data – where information that is sensitive, protected, valuable or confidential is copied, transferred, viewed or taken by a person who is not authorised to do so. Data breaches can include financial data where your credit card details, personal information, trade secrets, customer information, and intellectual property is used by someone else. The loss of sensitive or confidential data can result in financial losses, penalties and reputational damage. Data breaches that results in identity theft or a violation of government or industry compliance regulations can cause a business to face fines or other civil or criminal prosecutions.

“The defence against social engineering should have multiple layers of protection so that if an attacker is able to penetrate one level, such as an individual user’s computer, they would be stopped at the next level. Remember that a social engineering predator will keep searching for a weak spot until they find one. That is why it is so important for the network to have several layers of protection to fight back, and at the very least be able to recognise when it is under attack.”

The importance of education

He stresses that employee education should be part of every organisation’s IT security strategy given that social engineering is not a technology shortfall but rather a human one. When people are properly educated about the dangers of giving away personal details, clicking on unsafe links, responding to strange requests for information, downloading unsafe applications or posting too much information on social media, they are less inclined to do so.

“Importantly, employees must understand the risks of social engineering. Good training and procedures can help reduce the risk of accidental data loss. They also need to understand the value of data to the business. A loss of critical data or intellectual property can have severe consequences,” says Ueckermann.

Ueckermann concludes with some advice for companies and their employees to take heed of:

• Don’t publish confidential company information on social media.

• Don’t take pictures of your desk and post it online. A picture tells a thousand words (i.e. an attacker can see what type of computer you are using and where you are based with geo-tagging, even if no confidential company information is visible in the picture).

• Do not accept social media requests from people that you do not know. Your social media contacts/connections have access to your connections. This means that they can view your detailed profile and career history, among other information.

• Never action requests to conduct updates on your system, even if the caller or emailer seems legit. If they claim to be from IT support, tell them you will call them back on their extension.

• Never install or update programmes from public facing websites, even if someone posing as IT support asks you to do so. Only download updates from your computer when prompted by the specific application’s update centre (i.e. Adobe, Microsoft, etc.).

• Never switch off vulnerability scanning on your computer. These scans, which run through endpoint security software, are crucial.

• Do weekly vulnerability scans on your computer at work and home.

• Never click on links in emails if you don’t trust the sender or the link’s destination. These could be phishing emails that put your device and information at risk. Scroll over the link to see if it is the correct URL.

• Do not save your passwords in an unencrypted format. Use a password manager to create and save passwords on your behalf – then you can easily change your passwords every three months.



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.