The risks of social media

November 2018 Cyber Security

Even for companies that have robust IT security solutions in place, protecting networks and data is growing increasingly complex as security gaps emerge where they are least expected. With the emphasis on technology to protect data assets from threats from the outside, internal threats – such as a company’s employees – are often overlooked.

“Employees, their social media profiles and the devices they use to access a company’s network and resources provide a plethora of gateways into the infrastructure for cyber criminals. Organisations should take care to not focus purely on traditional defences. Attackers will quickly change their strategy from trying to bypass a strong perimeter defence to attacking the human element,” says Charl Ueckermann, CEO at AVeS Cyber Security.

AVeS recently conducted a vulnerability assessment as well as internal and external penetration tests for a large mining company. The company has 5500 users on its system, with 1281 of them using company-associated LinkedIn profiles. This equates to 23% of employees on LinkedIn. The company’s IT security status appeared to be excellent, with a few vulnerabilities detected, until AVeS Cyber Security suggested a simulated social engineering attack.

Open information on social media

With just a week of researching employees’ LinkedIn profiles and gathering information about them using publicly available resources on the Internet, AVeS Cyber Security’s team was able to identify employees that would be suitable targets for the social engineering project. Social engineering is the process of deceiving people into giving away access to protected systems and confidential information. Attackers use a variety of means to con their targets into giving away sensitive data or personal details, with phishing emails and social media monitoring being amongst the most commonly used. It is a formidable threat to even the most secure networks.

“We were able to get their contact details, designations and other relevant business information. This allowed us to contact them under the guise of being from internal IT support and request that they conduct an update on their computer. This way, we were easily able to convince a number of employees to install unauthorised and dubious software on their systems. None of them questioned the legitimacy of the request to install software from an Internet site that did not form part of the organisation’s approved IT landscape.

“This gave us full access to the computers, including private and sensitive data, without the user knowing that their system had been compromised. We were also able to crack into a machine that was part of a local admin group, and through this account, we were able to get access to almost all of the computers in the company’s network.”

In a real-life attack scenario, this is a breach of data – where information that is sensitive, protected, valuable or confidential is copied, transferred, viewed or taken by a person who is not authorised to do so. Data breaches can include financial data where your credit card details, personal information, trade secrets, customer information, and intellectual property is used by someone else. The loss of sensitive or confidential data can result in financial losses, penalties and reputational damage. Data breaches that results in identity theft or a violation of government or industry compliance regulations can cause a business to face fines or other civil or criminal prosecutions.

“The defence against social engineering should have multiple layers of protection so that if an attacker is able to penetrate one level, such as an individual user’s computer, they would be stopped at the next level. Remember that a social engineering predator will keep searching for a weak spot until they find one. That is why it is so important for the network to have several layers of protection to fight back, and at the very least be able to recognise when it is under attack.”

The importance of education

He stresses that employee education should be part of every organisation’s IT security strategy given that social engineering is not a technology shortfall but rather a human one. When people are properly educated about the dangers of giving away personal details, clicking on unsafe links, responding to strange requests for information, downloading unsafe applications or posting too much information on social media, they are less inclined to do so.

“Importantly, employees must understand the risks of social engineering. Good training and procedures can help reduce the risk of accidental data loss. They also need to understand the value of data to the business. A loss of critical data or intellectual property can have severe consequences,” says Ueckermann.

Ueckermann concludes with some advice for companies and their employees to take heed of:

• Don’t publish confidential company information on social media.

• Don’t take pictures of your desk and post it online. A picture tells a thousand words (i.e. an attacker can see what type of computer you are using and where you are based with geo-tagging, even if no confidential company information is visible in the picture).

• Do not accept social media requests from people that you do not know. Your social media contacts/connections have access to your connections. This means that they can view your detailed profile and career history, among other information.

• Never action requests to conduct updates on your system, even if the caller or emailer seems legit. If they claim to be from IT support, tell them you will call them back on their extension.

• Never install or update programmes from public facing websites, even if someone posing as IT support asks you to do so. Only download updates from your computer when prompted by the specific application’s update centre (i.e. Adobe, Microsoft, etc.).

• Never switch off vulnerability scanning on your computer. These scans, which run through endpoint security software, are crucial.

• Do weekly vulnerability scans on your computer at work and home.

• Never click on links in emails if you don’t trust the sender or the link’s destination. These could be phishing emails that put your device and information at risk. Scroll over the link to see if it is the correct URL.

• Do not save your passwords in an unencrypted format. Use a password manager to create and save passwords on your behalf – then you can easily change your passwords every three months.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The enemy within – insider ­security threats
May 2019, Wolfpack Information Risk , Editor's Choice, Cyber Security, Financial (Industry)
Insider threats in today’s financial world are insidious and destructive and your defence against insiders should start long before the person assumes his/her position.

LoJax: Be very careful
May 2019 , Cyber Security
Even replacing drives won’t kill this malware, which is still active more than nine months after researchers from Arbor Networks detailed it.

Assessing impacts: The meteors of security and AI
May 2019 , Cyber Security
As security threats evolve and artificial intelligence pervades, what impact are they set to have on business over the next year?

Visibility is key, and lacking
May 2019 , Editor's Choice, Cyber Security
Cybercriminals are most likely to be caught on servers and networks, but detecting their time and point of entry remains a mystery.

The benefits of machine learning and UEBA
May 2019 , Cyber Security
Combining accurate and essential user behavioural data with machine learning allows you to more accurately monitor your users on an endpoint-by-endpoint basis.

Insiders: who are they?
May 2019 , Security Services & Risk Management, Cyber Security
The 2018 Insider Threat Report by Cybersecurity Insiders reports that more than 51% of companies are concerned about unintentional insider attacks.

Securing the Industrial Internet of Things
May 2019, Axiz , Cyber Security, IT infrastructure, Industrial (Industry)
The very benefits that makes the IIoT so compelling, makes it equally capable of damaging infrastructure operations and processes through bad actors.

Hybrid cloud and hyper-converged data protection
May 2019 , IT infrastructure, Cyber Security
Arcserve Unified Data Protection extends disaster recovery and backup technologies to prevent downtime and data loss for hyper-converged and SaaS-based workloads.

Vivotek strengthens cybersecurity
May 2019 , CCTV, Surveillance & Remote Monitoring, Cyber Security
Vivotek has announced the availability of comprehensive protection in its Cybersecurity Management Solution under the strategy of its 'Security within Security' campaign.

Scammers target job seekers
May 2019 , Cyber Security
Kaspersky Lab experts detected a blast of sophisticated spam emails in the first quarter of 2019, featuring fake job-offers that seemed to come from HR recruiters in large corporations.