Archive for the ‘hacker’ tag
When Your Brand’s Profile is Hijacked.
Brands have been establishing outposts on social sites such as Facebook, Twitter and LinkedIn now for a number of years. The last two years have reached fever pitch. Here are some basic realities of these profiles as we have found in our very unscientific survey.
- Many brands that have started experimenting on these sites update their content by logging in directly.
- There are organizations that use third-party services such as Co-Tweet and Hootsuite to update their content.
- Some organizations have been outsourcing the management of their outposts to agencies.
- Many profiles managed by agencies and/or brands with social media teams are updated by more than one person.
Here’s my take. The weakest link in the chain is the username and password. The efforts that have been made by criminal cyberspace gangs over the past decade to harvest identity data should worry administrators some. The Mariposa bot was a big wake-up call for us.
What does this mean for brands with a presence on the social web? Simple. Your website used to be a primary target for hackers. Now it’s going to be your social web profiles. Here’s a scenario.
- Brand A is a gourmet restaurant franchise.
- Brand A’s employee 227 manages the Twitter and Facebook profiles. He loses his laptop computer to a thief and the said computer ends up in the hands of Gang Y who find information valuable. Information such as usernames and passwords.
- Gang Y log in and sends messages to followers/fans inviting them to download x-rated videos at a special discount rate because they are fans of Brand A.
- Brand A discovers the breach when followers/fans begin to complain. As far as they are concerned, the messages came from a valid account they have a history with. They probably won’t believe it when Brand A claims to have lost control of their profiles for a period.
That, I think, is a veritable disaster. Does your business have a disaster plan for this sort of thing? Do you have policies or a strategy designed to ensure login credentials are secure or determine what to do when they are compromised?
Here a five things that can help you get a handle on things.
- Have a strategy that ensures passwords across the organization are strong and that explicitly directs what is to be done in the event of a breach.
- Lock things down. When you discover you’ve been hacked, revoke all access to the profiles other than direct login via the social site’s login page. Change all passwords immediately.
- Report the attack. It’s important to show some proactivity to reassure the both the fans/followers as well as the site that you are back in control.
- Tell the story loudly. Let your fans know you were hacked, which messages were not from you and that you’re back in control.
- Plug the leaks. Sometimes weak passwords are not the problem. It could very well be poor enforcement of security such as leaving logged in laptops unattended in public spaces.
Help me grow and improve this list. What’s your take?
