Social Media Security Risk

1. Social Media Security:
How Social Media May Leave You Vulnerable
Timothy Youngblood
Dell, Compliance and Information Security Officer

2. Social media platforms have entered
the enterprise
24hrs of Video per
300 Million Users 75 Million Accts
Min
3% Growth Per 6 Million Unique
3 Million Auto
Week Visitors
Connects
30 Billion Page 65 Million Tweets
2 Billion Views Per
Views Per Day Per Day
Day
Public Sector / Private Sector
Business Partners/Customers/End Users
2

3. Security managers have to apply rules
to these open platforms
3

4. You have new risk that needs to be
managed
Malware Reputation Data
Leakage
4

5. Integrated Social Media security
strategy to address key risk
Social
Media
Remote
Access
Outsourcer
Compliance
5

6. Identify your risk, assess technology
and policy /control mitigations
Policy
Technology
Risk
6

7. Social Media exposes a new threat
vector in the enterprise
7

8. Every platform has a weakness
• Too Much Info (TMI)
• Phishing
• Password Sloth
• Account Hi-Jacking
8

9. Facebook/MySpace/ect..
9

10. Twitter
10

11. YouTube
11

12. Social Media in the headlines
Twitter virus among
shortest on record ….
Mark Zuckerberg's
Facebook Page Hacked ….
YouTube Hack Hits
Bieber Fans….
12

13. Femee Fatale
13

14. Credential Phishing
14

15. Taxonomy of Exposure
Service Disclosed Entrusted
Data Data Data
Incidental Behavioral Derived
Data Data Data
15

16. Service Data, Disclosed Data
16

17. Entrusted Data, Incidental Data
17

18. Behavioral Data, Derived Data
18

19. Technology counter measures exist to
address the threats
19

20. Responding to Social Media Threats
Policy People
Threats
Process Technology
20

21. Federal Guidelines
Guidelines for Secure Use of
Social Media by Federal
Departments and Agencies
 Training
 Network Controls
 Host Controls
 Policy Controls
www.cio.gov/library/
21

22. Secure Alternatives
22

23. Brand Protection Firm
23

24. Defense in Depth with Social Media in
mind
24

25. Network/Client Security
Hardened ACL’s Host Security Agent
IPS Lockdown Policy
Firewall Drive Encryption
Perimeter Perimeter
25

26. Threat & Vulnerability Mgt
Logging & Alerting
26

27. Securing the Mobile Workforce
27

28. Specialized Solutions
28

29. Social Mention
29

30. Websense
Advanced Classification Engine (ACE)
• Real-time security classification
• Real-time content classification
• Websense PreciseID™ technology data identification
• Reputation services
• URL filtering
30

31. Governance must be integrated into
your strategy
31

32. Policies Protect the Organization
Over Sharing
Information
(Intellectual Property)
Mixing Business with
Personal info
(Tweet/Facebook/MyS
pace/ect..) Rage
Connection indulgence
Click Happiness
Password Sloth
32

33. IAN Study
10% 34%
2008 2009
33

34. Guidelines
• Protect information
• Be transparent and disclose
• associations
• Follow the law, follow the Code
• Be responsible
• Be nice, have fun and connect
34

35. Controls ensure policies are followed
• Change Implementation
• Information Security
• Program Development
• Disaster Recovery
• Contracting
• Facilities
• IT Governance
• IT Operations
35

36. CoBIT
36

37. Risk IT
37

38. ISACA – Social Media Presence
Strategy and • Has a risk assessment been conducted to map risks to
the enterprise present by use of social media?
Governance
• Has effective training been conducted for all users, and
People do users receive regular awareness communications
regarding policies and risks?
• Have business processes that utilize social media been
Process reviewed to ensure that they are aligned with policies
and standards of the enterprise?
• Does IT have a strategy and the supporting capabilities
Technology to manage technical risks presented by social media?
38

39. Relationships with key stakeholders
39

40. Inclusive of a Team
Team Members
1. IT
2. Marketing/Sales
3. Legal
4. External / Internal Audit
5. Compliance
6. Privacy
7. Ethics

41. Key Topics
41

42. Social Media Security Strategy
Risk
Technology
Social Media
Platforms Defined? Policy
How do current
How are the solutions address Are employees
platforms utilized? the threats? trained on how to
Who is currently Are there supporting use Social Media?
utilizing them? technologies to Are there supporting
address risk? controls and
policies?
42