Social Media Risk
What is Social Media?
Many people mistakenly 'define' social media as Facebook, Twitter, Instagram and LinkedIn, but social media is not limited to just these well-known platforms; it is anywhere that users can communicate with each other through an application. Additionally, socially connected applications leverage existing social network accounts and features, integrating them into websites, games, and mobile apps. Many of these socially connected applications spawn their own communities of users, furthering the integration and extension of social media. All of these interaction-driven applications fall within the true context of social media, and new social vehicles are created every day.
Social media is a collective intelligence; the network becomes more vibrant and interesting at a rate that is commensurate with the more people who connect. Businesses leverage this collective intelligence to connect, market, and sell more effectively. In fact, most businesses' strategic plans rely on leveraging the data available through social media to boost revenue. Social media can also be used for various business purposes like marketing, recruiting, and even communicating with investors.
What Is a Social Media Security Risk?
Social media has quickly become the favored platform to harm organizations and introduces significant information security risks due to its widespread adoption and open, often free, access. Malicious actors use social media to target end-users as a means to invade an organization virtually. They are sophisticated, leveraging psychological manipulation of identity and trust, masking them from even advanced users.
This "social media attack surface" introduces threats like phishing, malware, social engineering, fraud, and impersonations into an organization's network through end users of social media. Most solutions do not address social media-based threats due to a lack of visibility and insight into the unmanaged and unregulated social realm. This presents a significant challenge for organizations worldwide.
3 Types of Social Media Security Risks
#1: Spoofed Accounts and Impersonations
Instead of a specific post, a fake social media account impersonating an organization is often the unit of currency for these types of attacks. The cyber criminal references official company accounts, analyzes images and descriptions used, and then copies the information with slight variations to create a new account. They gain followers' trust and then dupe them into sharing information that allows them to access their bank accounts or credit cards. Some threat actors even leverage paid social promotion to reach more people.
#2: Social Spear Phishing
In contrast to random phishing attacks, social spear phishing is highly targeted. For example, ZeroFOX discovered a cyber criminal who had observed a customer of a bank asking for help with their account over Instagram and subsequently targeted them with a spoofed post offering assistance. Believing they were still interacting with their bank, the customer shared their credentials which the criminal used to drain their accounts.
While the level of effort involved with spear phishing is very high, the success rate is as well. Other drivers of social media spear phishing, in addition to a high accuracy rate, include:
- an abundance of personal data being exposed,
- a prevalence of shortened links that provide another layer of obfuscation for attackers,
- the culture of trust that permeates social media, and
- the use of automation and bots to simplify and accelerate the execution of these campaigns.
#3: Social Media Data Leakage and The Insider Threat
Data leakage by insiders can be inadvertent or intentional. In the case of inadvertent leaks, social media can entice users to expose sensitive information. Driven by the desire for retweets and more followers, individuals will expose PII like credit card and bank account data, as well as information such as travel plans and where they shop, bank and work. Software developers may use GitHub to version control their code but, in the process, can share passwords and other valuable corporate data or systems details.
In the case of intentional leaks, malicious insiders with access to login credentials or other valuable data use social media to deliver that information to competitors or nation-state actors. They can disguise the information using various tools such as encryption or steganography, where they embed text within an image. Those few lines of text may be the data itself, or they may be instructions that point the recipient to a website or forum to retrieve the information.
Conclusion
Social media has fundamentally changed the way people live their lives, personally and professionally. It has changed the way they interact with friends, family, colleagues, and clients. It has redefined how businesses operate, how ideas can be shared, and how money can be made. Social media also introduces significant risk to organizations by positioning employees, executives, partners and customers as targets. Traditional risk and threat management tools do not provide the needed visibility and insight to detect social media-based threats.
The ZeroFOX Platform represents an evolution in cybersecurity, through a combination of cutting-edge technology and expert threat intelligence analysts, to provide solutions for the full spectrum of social media risk. ZeroFOX has developed security technology that enables organizations to monitor and prevent social media cyber attacks, conduct proactive attack reconnaissance and safeguard their social assets.
Protect Today. Predict Tomorrow. Get started with ZeroFOX and secure your digital-first world with protection, intelligence and disruption.