The Semacraft Blog

Brands have been establishing outposts on social sites such as Facebook, Twitter and LinkedIn now for a number of years. The last two years have reached fever pitch. Here are some basic realities of these profiles as we have found in our very unscientific survey.

• Many brands that have started experimenting on these sites update their content by logging in directly.
• There are organizations that use third-party services such as Co-Tweet and Hootsuite to update their content.
• Some organizations have been outsourcing the management of their outposts to agencies.
• Many profiles managed by agencies and/or brands with social media teams are updated by more than one person.

Here’s my take. The weakest link in the chain is the username and password. The efforts that have been made by criminal cyberspace gangs over the past decade to harvest identity data should worry administrators some. The Mariposa bot was a big wake-up call for us.

What does this mean for brands with a presence on the social web? Simple. Your website used to be a primary target for hackers. Now it’s going to be your social web profiles. Here’s a scenario.

• Brand A is a gourmet restaurant franchise.
• Brand A’s employee 227 manages the Twitter and Facebook profiles. He loses his laptop computer to a thief and the said computer ends up in the hands of Gang Y who find information valuable. Information such as usernames and passwords.
• Gang Y log in and sends messages to followers/fans inviting them to download x-rated videos at a special discount rate because they are fans of Brand A.
• Brand A discovers the breach when followers/fans begin to complain. As far as they are concerned, the messages came from a valid account they have a history with. They probably won’t believe it when Brand A claims to have lost control of their profiles for a period.

That, I think, is a veritable disaster. Does your business have a disaster plan for this sort of thing? Do you have policies or a strategy designed to ensure login credentials are secure or determine what to do when they are compromised?

Here a five things that can help you get a handle on things.

1. Have a strategy that ensures passwords across the organization are strong and that explicitly directs what is to be done in the event of a breach.
2. Lock things down. When you discover you’ve been hacked, revoke all access to the profiles other than direct login via the social site’s login page. Change all passwords immediately.
3. Report the attack. It’s important to show some proactivity to reassure the both the fans/followers as well as the site that you are back in control.
4. Tell the story loudly. Let your fans know you were hacked, which messages were not from you and that you’re back in control.
5. Plug the leaks. Sometimes weak passwords are not the problem. It could very well be poor enforcement of security such as leaving logged in laptops unattended in public spaces.

Help me grow and improve this list. What’s your take?

‘…and we can get you on Facebook because social media is big right now!’

That’s some scary advise.  But many organisations hear it all the time from their agencies when talking about marketing or website design.  No strategy, no governance, just multiple channels where the staff can put out great information about the company and its products. Yippee!

Balderdash! I wouldn’t be surprised if that’s what happened at Nestlé, although I choose to believe they went about it a bit more deliberately (being a multi-national and all).  The signs are there to show they have issues with their web governance structures. When their Facebook admin took on some fans in what became a very public and embarrassing spat, a very distressing sign became evident.

Read the rest of this entry »