January 13, 2021 By Mark Stone 3 min read

You’ve done your due diligence, practice good security hygiene and have the best security tools available. Now, your security posture is strong. But, your plan is only as good as your employees, and they may be letting you down when it comes to being ready for social engineering.  

While employees clicking on phishing links still presents a risk for the enterprise, the use of social media introduces its own set of issues, too.  

Social engineering has always been one of the easiest methods with which bad actors can infiltrate your network. In 2019, for example, about half of the attacks reported by Trustwave analysts were caused by phishing or other social engineering methods, up from 33% of attacks in 2018.

Enter Social Media Phishing

What is a common method used in social engineering? Social media phishing. The use of social media only makes problems worse. Whether they’re at work or at home, your employees may be revealing private company data on social media and not even know they’re doing anything wrong.  

Every social media post and photo may contain important data threat actors could use for social engineering. For example, that team selfie you took after the strategic boardroom meeting could divulge intellectual property or confidential business data.

Other social media phishing examples aren’t so obvious. What about a public LinkedIn message praising a coworker for a new role? On its own, that information isn’t significant. But the more personal information threat actors obtain about you and your coworkers, something seemingly harmless like a LinkedIn post can be used against you. 

Cybercriminals are efficient and thrive on gathering data on their targets. By combing through public employee social media profiles, they collect valuable data on a person’s interests, job, activities and other history. Much like how marketers create personas for their customers, phishers establish rich profiles of their future victims.

What is Social Engineering and How It Works Against You

Armed with a deeper knowledge of their target, the cybercriminal contacts the would-be victim and offers specific details about their job or interests.

In some cases, threat actors may go as far as impersonating a co-worker by creating a fake social media profile. This strategy, known as profile cloning, is an offshoot of identity theft. 

Profile cloning attempts to create identical profiles to existing accounts so information can be extracted from a friend or co-worker of the cloned profile. Although profile cloning results in two almost identical user profiles, most of us wouldn’t check to confirm that more than one profile exists.

What does this have to do with your network’s security? Let’s say your employee gets a message from a cybercriminal posing as a co-worker. Because trust has been established, they’ll be much less careful about clicking a malicious link masquerading as a real video, photo or software. This social media phishing method is much more effective than your typical email phish — after all, the employee thinks they’re conversing with a trusted friend. 

Social Media Security Tips

While keeping your employees off social media is next to impossible, taking proactive measures pays dividends. A few tips:

  • Think twice before posting anything. Even if you delete it, posts can live forever in screen captures and may lose context.
  • When away from home for extended periods, don’t reveal your location. Watch out for the information you share in photos.
  • Customize your privacy settings to be as restrictive as possible regarding who can read and see posts. Consider an account for people you trust and another for public use.
  • Use multifactor authentication.
  • Don’t click on links, files, games or applications within the confines of social media. While it’s difficult to mitigate the risk of being victimized by profile cloning, ensuring your company’s antimalware tools are up to date is a step in the right direction. Try to foster a culture of not clicking on links, even from people employees know.

Balancing user-friendliness with security is an ongoing dilemma for IT and security departments. When employees are involved and invested in the security process, and they don’t feel restricted, your chances of success get a serious upgrade. 

More from Fraud Protection

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today