Seven Deadly Sins of Social Networking Security

To users of LinkedIn, Facebook, Myspace, Twitter or other social networking sites: Are you guilty of one of these security mistakes?

By Bill Brenner, Senior Editor

June 30, 2009 — CSO —

Admit it: You are currently addicted to social networking. Your drug of choice might be Facebook or Twitter, or maybe Myspace or LinkedIn. Some of you are using all of the above, and using them hard, even IT security practitioners who know better.

While it's impossible to escape every social networking security threat out there, there are steps one can take to significantly reduce the risks. CSOonline recently checked in with dozens of IT security professionals (ironically, using more than one social networking platform to do so) to pinpoint seven typical mistakes people make, and how to avoid them.

Over-sharing company activities
This is a sin of pride, when someone gets excited about something their company is working on and simply must tell everyone about it. Maybe you work for a drug company that is on the verge of developing the cure for cancer. Maybe the company is developing a new car that runs on curbside trash -- in other words, something everyone will want. (Also see Intellectual Property Security: Don't Lose Your Head)

By sharing too much about your employer's intellectual property on social networks, you threaten to put it out of business by tipping off a competitor who could then find a way to duplicate the effort or find a way to spoil what they can't have by hiring a hacker to penetrate the network or by sneaking a spy into the building.

Then there are hackers controlling legions of botnets that could be programmed to scour a company's defenses and, upon finding a weakness, exploit it to access data on the intellectual property. With the data in hand, the hacker can then sell what they have to the highest bidder, which just might be your biggest competitor.

"Sharing this kind of information could lead to targeted attacks on specific technology-producing enterprises," says Souheil Mouhammad, a senior security expert at Altran Technologies.

This social networking security sin has sparked a debate in the industry about whether companies need to revise their employee computer use policies with more specific language on what is/isn't allowed in the social networking arena (see also: Debate: Does Social Networking Require User Policy Changes?).

To rein in the urge to share too much, it might be useful to repeat this saying, which has started to appear in the public domain: "Loose Tweets Sink Fleets."

Mixing personal with professional
This sin is closely related to the first, but extends beyond the mere disclosure of company data. This is the case where someone uses a social network for both business and pleasure, most commonly on Facebook, where one's friends include business associates, family members and friends.

Also see Slapped in the Facebook: Social Networking Dangers Exposed

The problem is that the language and images one shares with friends and family may be entirely inappropriate on the professional side. A prospective employer may choose to skip to the next candidate after seeing pictures of you drunk or showing off a little too much leg at someone's birthday party. In sharing such things, you also stand a good chance of making the company you represent look bad.

• Print

• Slapped in the Facebook: Social Networking Dangers Exposed
• Facebook, Twitter, LinkedIn: Security Pros Warm to Web 2.0 Access
• Debate: Does Social Networking Require User Policy Changes?
• LinkedIn, Facebook, Twitter Users Beware
• 3 Ways Twitter Security Falls Short