Keeping your company image safe on social media

CSO - The umbrella of security responsibilities now includes brand protection at many companies (See Brand protection: The expanding CSO portfolio for an in-depth look) and it seems like a constantly moving target. When the internet took off, organizations had to contend with scammers registering web site domains using company names for fraudulent purposes. Now similar activity is happening on the hottest forum for brand abuse--social networks.

Terry Gudaitis, Director Cyber Intelligence for brand protection services firm Cyveillance, lays out some common fraud scenarios and gives advice on how to protect your organization's good name.

CSOonline: Cybersquatting, or fraudulently registering a web site using an organization's name has been a big concern in brand abuse in recent years. Is this still the case?

Terry Gudaiti, Cyveillance: Where we have seen the increase in abuse is in social media sites. That includes, depending on how you define social media, the big ones like Facebook,LinkedIn, Twitter, MySpace, and that variety. But some even include the blogsphere in there where people can comment on other articles. Unlike a domain name where you have to go and register a name, you can jump on one of these social networks and as long as you have an email that appears to be legitimate, you can register basically any name.

What kinds of brand abuse occur on social networks?

We are seeing a trend where on Facebook and Twitter, people are registering the names of a company, as well as the executives, like the CEO or director of marketing. It's sort of like domain-name squatting but you are squatting on a social media site with a person's identity. And a number of things can occur for both brand abuse but also for security reasons. And we pay particular attention to that.

Read up on basic social media risks

Why the increase? Is it simply the huge growth in social networking? Or is there more to it?

I believe it's the prevalence of it but also the ease of access. And I mean that in two ways. Everyone has access at home now to a computer or smartphone, so it's easy for anyone to sign up for these services.

I also think it is proliferating because in traditional network protection models you lock down your firewalls and you get egress protection where people from your corporate network are not allowed to go out to these sites, but people don't need to operate through the corporate network anymore. I can walk outdoors with my smartphone and bypass the corporate network altogether.

And there are a lot of different people to consider now. You have rogue individuals who want to do the company harm, but also people in your company who maybe just because they love their company want to have the company associated with their Twitter page or Facebook page. There is also the authorized member of the team who is allowed to go out and message out to the public. So you have a lot of different entities now playing in a space that was typically designated for the authorized user. And even for authorized users, if the company doesn't have policies on how to use these social media sites; in terms of how to use these sites, how to be consistent on setting them up so the public knows this is the legitimate site for the corporation, it can create problems.