You’ve done your due diligence, practice good security hygiene and have the best security tools available. Now, your security posture is strong. But, your plan is only as good as your employees, and they may be letting you down when it comes to being ready for social engineering.  

While employees clicking on phishing links still presents a risk for the enterprise, the use of social media introduces its own set of issues, too.  

Social engineering has always been one of the easiest methods with which bad actors can infiltrate your network. In 2019, for example, about half of the attacks reported by Trustwave analysts were caused by phishing or other social engineering methods, up from 33% of attacks in 2018.

Enter Social Media Phishing

What is a common method used in social engineering? Social media phishing. The use of social media only makes problems worse. Whether they’re at work or at home, your employees may be revealing private company data on social media and not even know they’re doing anything wrong.  

Every social media post and photo may contain important data threat actors could use for social engineering. For example, that team selfie you took after the strategic boardroom meeting could divulge intellectual property or confidential business data.

Other social media phishing examples aren’t so obvious. What about a public LinkedIn message praising a coworker for a new role? On its own, that information isn’t significant. But the more personal information threat actors obtain about you and your coworkers, something seemingly harmless like a LinkedIn post can be used against you. 

Cybercriminals are efficient and thrive on gathering data on their targets. By combing through public employee social media profiles, they collect valuable data on a person’s interests, job, activities and other history. Much like how marketers create personas for their customers, phishers establish rich profiles of their future victims.

What is Social Engineering and How It Works Against You

Armed with a deeper knowledge of their target, the cybercriminal contacts the would-be victim and offers specific details about their job or interests.

In some cases, threat actors may go as far as impersonating a co-worker by creating a fake social media profile. This strategy, known as profile cloning, is an offshoot of identity theft. 

Profile cloning attempts to create identical profiles to existing accounts so information can be extracted from a friend or co-worker of the cloned profile. Although profile cloning results in two almost identical user profiles, most of us wouldn’t check to confirm that more than one profile exists.

What does this have to do with your network’s security? Let’s say your employee gets a message from a cybercriminal posing as a co-worker. Because trust has been established, they’ll be much less careful about clicking a malicious link masquerading as a real video, photo or software. This social media phishing method is much more effective than your typical email phish — after all, the employee thinks they’re conversing with a trusted friend. 

Social Media Security Tips

While keeping your employees off social media is next to impossible, taking proactive measures pays dividends. A few tips:

• Think twice before posting anything. Even if you delete it, posts can live forever in screen captures and may lose context.
• When away from home for extended periods, don’t reveal your location. Watch out for the information you share in photos.
• Customize your privacy settings to be as restrictive as possible regarding who can read and see posts. Consider an account for people you trust and another for public use.
• Use multifactor authentication.
• Don’t click on links, files, games or applications within the confines of social media. While it’s difficult to mitigate the risk of being victimized by profile cloning, ensuring your company’s antimalware tools are up to date is a step in the right direction. Try to foster a culture of not clicking on links, even from people employees know.

Balancing user-friendliness with security is an ongoing dilemma for IT and security departments. When employees are involved and invested in the security process, and they don’t feel restricted, your chances of success get a serious upgrade.