Social Media and Insider Threats

Protecting Your Business From Within

Many business owners don’t realize how often cybercriminals use social media to get closer to employees. In reality, it happens more than they’d think. What can they do to protect their company and their staff?

How Social Media Creates Insider Threats

Whether employees post through their company’s official account or their own, social media acts as an attack vector.

Unintentional Oversharing

Most social media apps require users to enter their name, email and phone number to create an account. Many have optional fields like birthdate, age and job title. Publicizing personally identifiable information (PII) lets hackers steal identities and improve phishing campaigns.

Fake Job Posts

Fake job listings on social media sites are common. The U.S. Federal Bureau of Investigation has warned about them, reporting over 16,000 people fell victim to them in 2020. Employees not only volunteer their PII in these cases, but also their current employer’s information.

Online Blackmailing

Bad actors can steal a target’s video drafts, dating website text exchanges or archived posts. They can then threaten to post any compromising, embarrassing or unflattering content on social media, forcing unwilling workers to engage in criminal activity.

Criminal Recruitment

Cybercriminals may use social media to find willing insiders. For example, Lapsus$, an international hacker group, actively used social media to recruit vendors, employees and partners in 2022. They bought legitimate credentials and used software to gain remote access.

Spear Phishing

Spear phishing consists of highly targeted campaigns to convince a target they need to click on a link, transfer funds or give up sensitive data. Since social media phishing messages have a click-through rate of 66%, it creates many accidental insider threats.

Hackers for Hire

Hackers for hire offer their services to anyone willing and able to pay. Their connection to insiders makes them particularly dangerous because they can gain an inside scoop on security systems, data storage and more.

How to Defend Against These Threats

Employers should factor social media reviews into their hiring and promotion processes to understand each staff member’s risk level. Their time spent online, post history, friends list size and account age can factor into how valuable they’ll be to cybercriminals. At the very least, this approach helps business leaders understand what they need to train their workforce.

Employee training helps people understand what they’re up against — and the consequences of ignoring the cybersecurity department’s advice. They should learn best practices, like how passwords should be at least 12 characters long and contain several symbols, numbers and uppercase letters. This information can protect them if they’re targeted.

Having robust social media policies can help deter bad actors on social media. While dictating what people post outside of work is a slippery slope legally and ethically speaking, employers generally have a lot of freedom to take disciplinary in these scenarios — especially if they’re posting from a company account or while on the clock.

Many modern technologies can give companies an edge. For example, artificial intelligence can use behavior analytics to tell if a user is who they say they are. It analyzes current and historical details on their typing speed, mouse movements and activity log. If it notices any discrepancies, it immediately flags someone on the cybersecurity team.

Monitoring technology does something similar. Identity access and management tools are a set of policies and systems that prevent workers from viewing, sending, editing or saving data they shouldn’t by restricting access and validating their identities. Unless they can prove they are who they say they are, they stay locked out.

Should You Trust Your Employees?

The purpose of social media is for users to share whatever they’re thinking or doing at any given time — which is the opposite of what any cybersecurity department advises staff to do. Hackers can do a lot with even the tiniest bit of information, which is what makes these sites so dangerous for working adults and their employers.

These platforms revolve around driving engagement and keeping people engaged to increase ad revenue. In other words, without even realizing it, employees can become insider threats. Their actions don’t have to be malicious, either — accidental and negligent insiders exist, too. Simply being active online can make them a target for cybercriminals.

Social media is quickly becoming a top attack vector for those looking to create or work with insider threats. A worker could receive dozens of direct messages, comments or likes daily from various bad actors. Bots were responsible for over 47% of internet traffic in 2022, underscoring the prevalence of these malicious networks.

According to one recent survey, 30% of chief information security officers agree insider threats of all types are the top cybersecurity threats. Unlike hackers, they’re difficult to trace — many aren’t caught for months or years. Since insiders use legitimate credentials, every one of their activity logs and access attempts seems normal.

Staff members may leak company data in posts, comments, direct messages or emails. Whether it’s because they believe they’re talking to an official customer support agent or are doing something illegal to get revenge, that information still gets out. In other words, businesses shouldn’t automatically trust any user or device.

Preventing Insider Threats Takes Time

Most insider threats cause cybersecurity incidents through accidents or carelessness. In other words, addressing this issue’s root cause is relatively simple. All business owners must do is raise awareness, train workers and establish actionable social media policies.

Devin Partida writes about investor technologies, big data and apps. She is also the Editor-in-Chief of ReHack.com.