How to Handle Social Networking Security Risks
Social networking -- whether it be Facebook, MySpace, LinkedIn, YouTube, Twitter or something else -- is fast becoming a way of life for millions of people to share information about themselves for personal or business reasons. But it comes with huge risks that range from identity theft to malware infections to the potential for letting reckless remarks damage corporate and personal reputations.
That means the "digital version of that person could easily be impersonated or exploited" and Hoglund doesn't see a simple way out of this dilemma. "In a nutshell, don't trust a digital identity like you trust a human relationship."
"People are revealing far more information than they should," says Gary Gordon, executive director of the Washington, D.C.-based Center for Applied Identity Management Research, a non-profit group formed last October by universities, public agencies and industry to research key problems related to identity management. The potential for identity theft and social engineering through exploiting social networking is real, he says. But he doesn't see blocking social networking as an answer.
Eddie Schwartz, CSO at security vendor NetWitness, spoke about the risks of social-networking during the recent Infosec Conference. He mentioned identity theft, espionage and malware as potential threats.
"A typical Facebook or MySpace user session ranges for a few minutes to tens of minutes so you could write an application that farms personally identifiable information," Schwartz said.
In addition, he said he's seen evidence of government employees using social-networking sites suddenly "befriended" by people in other countries asking for information, raising the prospect of espionage attempts.
The openness of many of the social-networking sites makes them "an ideal exploitation platform," he points out.
When it comes to online social networking such as Facebook, "try to educate people who have secrets to be careful," advises Michael Rochford, director of the global initiatives directorate in the Office of Intelligence and Counter-intelligence at the Department of Energy's Oak Ridge National Laboratory. "They're putting themselves on a platform to be exploited."
Many companies, including Lockheed Martin, which is creating its own home-grown social-networking site for use internally, do block public social-networking sites for security reasons. But many firms these days would regard cutting off social-networking sites as bad business.
Receive the latest security news as it breaks.
