You’ve done your due diligence, practice good security hygiene and have the best security tools available. Now, your security posture is strong. But, your plan is only as good as your employees, and they may be letting you down when it comes to being ready for social engineering.  

While employees clicking on phishing links still presents a risk for the enterprise, the use of social media introduces its own set of issues, too.  

Social engineering has always been one of the easiest methods with which bad actors can infiltrate your network. In 2019, for example, about half of the attacks reported by Trustwave analysts were caused by phishing or other social engineering methods, up from 33% of attacks in 2018.

Enter Social Media Phishing

What is a common method used in social engineering? Social media phishing. The use of social media only makes problems worse. Whether they’re at work or at home, your employees may be revealing private company data on social media and not even know they’re doing anything wrong.  

Every social media post and photo may contain important data threat actors could use for social engineering. For example, that team selfie you took after the strategic boardroom meeting could divulge intellectual property or confidential business data.

Other social media phishing examples aren’t so obvious. What about a public LinkedIn message praising a coworker for a new role? On its own, that information isn’t significant. But the more personal information threat actors obtain about you and your coworkers, something seemingly harmless like a LinkedIn post can be used against you. 

Cybercriminals are efficient and thrive on gathering data on their targets. By combing through public employee social media profiles, they collect valuable data on a person’s interests, job, activities and other history. Much like how marketers create personas for their customers, phishers establish rich profiles of their future victims.

What is Social Engineering and How It Works Against You

Armed with a deeper knowledge of their target, the cybercriminal contacts the would-be victim and offers specific details about their job or interests.

In some cases, threat actors may go as far as impersonating a co-worker by creating a fake social media profile. This strategy, known as profile cloning, is an offshoot of identity theft. 

Profile cloning attempts to create identical profiles to existing accounts so information can be extracted from a friend or co-worker of the cloned profile. Although profile cloning results in two almost identical user profiles, most of us wouldn’t check to confirm that more than one profile exists.

What does this have to do with your network’s security? Let’s say your employee gets a message from a cybercriminal posing as a co-worker. Because trust has been established, they’ll be much less careful about clicking a malicious link masquerading as a real video, photo or software. This social media phishing method is much more effective than your typical email phish — after all, the employee thinks they’re conversing with a trusted friend. 

Social Media Security Tips

While keeping your employees off social media is next to impossible, taking proactive measures pays dividends. A few tips:

  • Think twice before posting anything. Even if you delete it, posts can live forever in screen captures and may lose context.
  • When away from home for extended periods, don’t reveal your location. Watch out for the information you share in photos.
  • Customize your privacy settings to be as restrictive as possible regarding who can read and see posts. Consider an account for people you trust and another for public use.
  • Use multifactor authentication.
  • Don’t click on links, files, games or applications within the confines of social media. While it’s difficult to mitigate the risk of being victimized by profile cloning, ensuring your company’s antimalware tools are up to date is a step in the right direction. Try to foster a culture of not clicking on links, even from people employees know.

Balancing user-friendliness with security is an ongoing dilemma for IT and security departments. When employees are involved and invested in the security process, and they don’t feel restricted, your chances of success get a serious upgrade. 

More from Fraud Protection

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

How Security Teams Combat Disinformation and Misinformation

“A lie can travel halfway around the world while the truth is still putting on its shoes.” That popular quote is often attributed to Mark Twain. But since we're talking about misinformation and disinformation, you’ll be unsurprised to learn Twain never said that at all. In fact, no one knows who first strung those words together, but the idea that truth spreads slowly while lies spread quickly is at least several hundred years old. The “Twain” quote also serves to…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…