Facebook needs to make some simple, yet crucial, changes to secure users more effectively, according to security firm Sophos Security firm Sophos has published an open letter to Facebook about its security and privacy measures on the popular social networking site, and the message is clear: It’s time for some changes in order to better protect users.In its Naked Security blog, Senior Technology Consultant Graham Cluley tells Facebook that protecting users is easily accomplished with three changes. They include:PRIVACY BY DEFAULT“No more sharing of information without your users’ express agreement,” states Cluley in the post. Users should be able to opt-in to sharing, not the other way around, he said. “Whenever you add a new feature to share additional information about your users, you should not assume that they want this feature turned on.”Also see: 10 security reasons to quit Facebook and Social media risks: The basicsVETTED APP DEVELOPERS “It is far too easy to become a developer on Facebook,” said Cluley. “With over one million app developers already registered on the Facebook platform, it is hardly surprising that your service is riddled with rogue applications and viral scams. Only vetted and approved third-party developers should be allowed to publish apps on your platform.”Cluley and other security and privacy advocates have long criticized Facebook over the lack on controls it has in place for application development. As a result, many applications are actually scams that lure users into traps by promising them a download of ‘the dislike button’ or by appealing to their vanity and promising them an application that will show them who is viewing their profile. Instead users end up with a survey scam or with a malware download on their computer.HTTPS FOR EVERYTHINGMore about Facebook security and privacy Social media risks: The basics 10 security reasons to quit Facebook 4 tips for Facebook from security and privacy experts 4 reasons why Facebook and vanity don’t mix Facebook recently introduced a HTTPS option, a move that was lauded by security professionals. But the feature is turned off by default, noted Cluley, which means many users are not even aware that it is possible to enable it. “Worse, you only commit to provide a secure connection ‘whenever possible,'” Cluley said.”Facebook should enforce a secure connection all the time, by default. Without this protection, your users are at risk of losing personal information to hackers. “ Related content news Multibillion-dollar cybersecurity training market fails to fix the supply-demand imbalance Despite money pouring into programs around the world, training organizations have not managed to ensure employment for professionals, while entry-level professionals are finding it hard to land a job By Samira Sarraf Oct 02, 2023 6 mins CSO and CISO Technology Industry IT Training news Royal family’s website suffers Russia-linked cyberattack Pro-Russian hacker group KillNet took responsibility for the attack days after King Charles condemned the invasion of Ukraine. By Michael Hill Oct 02, 2023 2 mins DDoS Cyberattacks news ShadowSyndicate Cybercrime gang has used 7 ransomware families over the past year Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations By Lucian Constantin Oct 02, 2023 4 mins Hacker Groups Ransomware Cybercrime feature 10 things you should know about navigating the dark web A lot can be found in the shadows of the internet from sensitive stolen data to attack tools for sale, the dark web is a trove of risks for enterprises. Here are a few things to know and navigate safely. By Rosalyn Page Oct 02, 2023 13 mins Cybercrime Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe