Effective Social Media Risk Management

Businesses need to have a social media strategy and engage in social networking as part of their branding. However, it's also necessary to protect your company from the data risks inherent in social media activities.

Social media risk management is not limited to your public relations team; it should also be an integral part of your IT security risk management process.

Managing Risks of a Social Media Presence

What are the primary social media risks?

Using social media in any capacity puts your company at risk for both reputational damage and cyber attacks. Modern hackers try constantly to access your data using social media accounts, and breaches that begin on social media can spread, threatening the personal data of your customers.

User Authorization

If you use Facebook as your primary login, then your data is at risk. User authentication tokens allow you to use your Facebook login as a single-sign-on option. Using a secondary site to login creates a new point of entry for potential hackers—one that may not be as secure as you think. Social media sites like Facebook, Google, or LinkedIn are constantly under threat from hackers. Therefore, you need to think about how you log into your social media accounts and how you use them to log in to other applications.

Phishing

Phishing scams continue to plague us, and attackers have begun targeting messenger applications. Hackers may take over automated applications and send out messages that look like yours, using fake links that appear real. To protect your branding, monitor your messenger applications regularly for these kinds of intrusions.

Poor Password Hygiene

Using a risky password for your corporate social media accounts puts them at unnecessary risk of being compromised. All the information you collect as part of your social media marketing strategy is linked to those accounts. Any customer or potential customer information is at risk if a hacker gains control of your social media account. Weak passwords put your information landscape and reputation on the line.

Why Managing Social Media Risk Matters

Handling employee social media use is often part of the social media policy embedded in your Bring Your Own Device (BYOD) policy. As a marketer, you also need to work with your IT department to manage your own social media activities.

Your social media accounts may not be third-party vendors, but your third-party social media tools are. Tools like Buffer, Hootsuite, and IFTTT all connect to your systems and networks. It's important to identify the risks that these tools pose.

For example, if you use a work browser connected to your work network from a company device and click on a phishing link while reviewing posts, malware could be downloaded to your browser, compromising your login information and your IT department’s security efforts.

What Strategies Mitigate Social Media Risk?

Three steps can help you mitigate the data risks inherent in social media marketing:

1) Social Media Policy

Create a policy specific to your social media marketing strategy. This includes clear expectations about:

• ​Password strength
• ​Content monitoring
• ​Access lists
• ​Interacting with the public
• ​Security breaches
• ​Crisis response

Coordinate with your CISO on how to report and handle the aftermath of a social media hacker getting into your accounts. Ensure collaboration between marketing and IT security teams.

2) Training

Stay updated on the most recent threats to your social media accounts. Educate yourself about how your activities could threaten the company, whether it’s a new vulnerability or a hack.

3) Monitoring

If multiple people work with your social media accounts, create a chain of command for reviewing activities. Monitor who has access, what devices are used, and consider additional security for personal devices accessing company accounts. Oversight is critical for posts and direct messages. Review posts before scheduling and have protocols for answering messages.

Performing a Social Media Risk Assessment

A security assessment tests your controls for vulnerabilities, while a risk assessment explores potential risks to prepare for future problems. Social media risk assessments follow the same five principles as other risk assessments:

• ​Identify: Examine your social media channels and note areas where risks may occur.
• ​Assess: Consider who or what might be harmed by these risks.
• ​Evaluate: Determine what you need to do to prevent risks from occurring.
• ​Decide: Are your current controls sufficient? If not, decide how to improve security.
• ​Record: Keep detailed documentation of your assessment for future review and revision.

Risks specific to social media include user authorization, accidental posts from staff, and fake accounts. Rather than managing social media risks separately, incorporate them into your overall risk management plan to avoid gaps and redundancies.

How ZenGRC Enables Social Media Risk Management Workflows

ZenGRC’s platform connects your social media cybersecurity activities to the overarching data security requirements set by your IT department. Your IT department can prioritize tasks for real-time tracking of vulnerabilities in your social media networks. Collaboration is facilitated through tagging and task management.

The centralized dashboard offers actionable key performance indicators (KPIs) for the IT department, supporting enterprise risk management strategies by connecting marketing data strategies to overall company policies.