Social Media Security: Leveraging Social Networking While Mitigating Risk

1

What is Social Media?

This chapter provides an introduction to social media concepts, as well as presenting some concepts, risks, and benefits that are covered in more detail throughout the book. Through this chapter, the reader will gain a greater understanding of what social media is, how it’s developed over the years, its impact on organizations and individuals, and how it’s become a common tool in people’s lives and business practices.

Keywords

Social networking; social media; communications; privacy; security

Information in This Chapter:

• What is Social Media?

• Understanding Social Media

• Different Types and Classifications

• The Value of Social Media

• Cutting Edge Versus Bleeding Edge

• The Problems That Come With Social Media

• Is Security Really an Issue?

• Taking the Good With the Bad

What is social media?

Technology has become less about connecting computers and more about connecting people. A major reason for this evolution is that the use of social media has exploded in the last few years, making it easier for individuals and businesses to contact others and get their messages across to large audiences. According to a July 2012 study by the McKinsey Global Institute, there are 1.5 billion people using social networking throughout the world, with 80% of them interacting regularly with other social media users. Its popularity and the drive to reach to customers has led to 70% of companies using social media. Social technology has become a way of life in how we socialize and do business.

However, while social media is a powerful tool for interacting with others, many people and organizations have jumped into using it without considering the risks. The threats you face can affect your safety, job, and business. In this book, we’ll show you how to deal with the potential dangers, but before that, let’s start by understanding what social media is and how it’s evolved.

Understanding social media

When you think of social media, you probably think of sites like Facebook, Twitter, and LinkedIn. After all, it’s common to go to a company’s site and see graphic links that take you to the company’s presence on these other sites. In making this connection, you’re not wrong. The same way that you associate traditional media with newspapers, TV stations, and other methods of publishing professional content, you can understand social media by looking at how information is being communicated. Social media is defined by how it’s used and the technology that supports its features.

Social media takes traditional forms of media to a whole new level. It is different from a news article or billboard that has information professionally created, polished, vetted through people who check and sign off on the content, and sent out as a one-way message to an audience. With social media, the information is generated by a user or brand, generally isn’t intensely scrutinized before being sent out, and transmitted in a way that allows two-way communication with people. Also, while it is often costly to get a message out using traditional media, using social media is relatively inexpensive or free.

One of the major features of social media is of course its social aspect. Traditional media tells a person what the message is and doesn’t interact with the consumer. Features of social media provide the ability for users to comment on what’s being said. If a columnist posts an article on a blog, a person can respond to it immediately by adding his or her own remarks. The columnist could then reply to these comments, creating a conversation. Rather than telling people what they should think, social media changes the information into an informal exchange of views. Even better, anyone can join in on sites that are accessible to others with no real technical experience. The readers can even go and create their own blogs, allowing them to write about any topic they want or share a free flow of ideas. Unlike traditional mediums, boundaries are broken down; the reader can become the writer any time he or she wants.

By looking at these functions and features, we can see that social media is a term that describes various technologies being used to engage people in collaboration, the exchange of information, and interactivity with Web-based content. Because the Internet is always evolving, the technologies and features available to users are always changing. This makes social media more of a hypernym (or blanket term) than a specific reference to any particular use or design.

Different types and classifications

As soon as you begin looking at social media, you quickly realize there are significant differences in the purpose and functionality of different sites. Twitter may be great for sending out short messages to an audience but useless for cooperating with others on writing a long article. Similarly, if you were posting a video instead of text, you would probably use a site like YouTube. Because there are hundreds of social media sites and applications, it is important to differentiate between them. By narrowing them down into specific groups, it’s easier to understand the types of social media available to you and which you should use for a specific purpose.

In a 2010 article published in Business Horizons, Andreas Kaplan and Michael Haenlein created a classification scheme for different types of social media. Through the use of existing theories in the fields of media research and social processes, they identified six categories:

1. Collaborative projects

2. Blogs

3. Content communities

4. Social networking sites

5. Virtual game worlds

6. Virtual social worlds

Collaboration

Collaboration sites allow multiple users to generate content and contribute to a final product, making the content produce a community or group effort. The most popular example of this would be wiki’s, which are Web sites that allow individual users to add and edit content. On a wiki, I write something, you add to it, and perhaps someone else edits what we wrote. Because peers with different experience and knowledge are reviewing the content, inaccuracies are eventually discovered and corrected. By everyone working together, the content builds.

The term wiki comes from the Hawaiian word for fast, which was used by Ward Cunningham in naming the first such site in 1995 called WikiWikiWeb (http://c2.com/cgi/wiki?FrontPage). Undeniably, the most popular wiki today would be Wikipedia (www.wikipedia.org), which has been edited over 1 billion times and has (at the time of this writing) over 4,179,670 articles. As you can see by this, the amount of information produced can be significant when people jointly create and work together.

In organizations, wikis and other collaboration tools can be extremely useful for communicating information and allowing members of a team to contribute to what’s being said. As with many types of social media, collaboration sites can be either on the Internet where they are accessible to the public or select groups of people, or on a company’s intranet where it is only accessible to those with secure network access. Organizations like Disney, Cingular Wireless, British Telecommunications, and CERN (the European Organization for Nuclear Research) have all used wikis for projects with great success. Users of the wiki require little to no assistance from the IT department, decreasing the need for administrative effort. Added to this, collaboration sites can serve as a repository of information on a project, centralizing information that was previously scattered in documents, presentations, and other files across the corporate network.

The collaboration project classification also includes social bookmarking sites, such as reddit (www.reddit.com) and Delicious (www.delicious.com). A bookmark is a shortcut to a location on the Internet. As seen in Figure 1.1, these sites are used to post links to content on other sites, such as Web pages, videos, and images, and associate keywords called tags that are used to categorize each link and make them easier to find. Other people search the site, view these links, and can add them to their own bookmarks with additional tags. Sites like reddit will even allow you to vote on them as part of a rating system. Similar to Facebook, users can request to be added as a friend, thereby creating a network of people with similar interests. Not only is this useful for organizing your favorite links to content on the Internet, but it allows you to view what others have shared as their favorite bookmarked pages.

Figure 1.1 Delicious is a social bookmarking site.

Blogs

Blogs allow a person or group to post content on a Web page as a series of submissions. What a person writes about on a blog is only limited by their imagination, but it works similar to a diary or log. Each entry is stamped with the date and time and is displayed in reverse chronological order. They are used for such purposes as personal diaries, to express commentaries and to communicate information as a series of entries. Blogs may also allow others to comment on the author’s initial entries, allowing interaction with the writer.

Originally called a weblog, the term was shortened when Peter Merholz posted on www.peterme.com For What It’s Worth … I’ve decided to pronounce the word weblog as wee’-blog. Or blog for short. As the shortened name gained popularity, this led to people writing blogs to be called bloggers.

While blogs are Web pages, a variant is a microblog, which allows people to post short messages that can be read by others. The most popular example of this is Twitter (https://twitter.com), which allows users to send and read text messages (called tweets) that are up to 140 characters in length.

While blogs and microblogs are traditionally text, most sites will also allow you to post other types of content such as links, images, music, and video. In addition to this, video blogging has become a popular method of exchanging information, in which a person records themselves and posts the video content on the blog as the message.

Blogging and microblogging can be extremely useful in companies. Blogs can be used as part of a communication strategy on intranet and public sites, sharing information that the company wants people to know about. An example of this is when Netflix experienced problems with streaming content on Christmas Eve 2012 due to an issue with Amazon Web Services. Netflix immediately responded to the issue on their technical blog and Twitter, providing status updates to customers (Figure 1.2). Not only was the technology used to keep in touch with customers but also using it in this way can decrease the number of upset customers calling their support number. After all, why would you need to call if they’re sharing information online?

Figure 1.2 Netflix tweet about service outage.

Content communities

Content communities are sites that allow users to share multimedia content. These communities include sites like YouTube (www.youtube.com), Daily Motion (www.dailymotion.com), Imagr (http://imgur.com), Tumblr (www.tumblr.com), and FlickR (www.flickr.com). People will upload images, video, music, or other content and provide a description, which other users can then search for and view. A common feature of these sites allows for comments to be added to a page displaying the content and to share links to the multimedia on other social media sites like Twitter and Facebook.

Businesses can benefit from content communities by sharing multimedia that promotes their products or brand, or to exchange information with customers or interested parties. For example, let’s say you worked for a hospital and had a great PowerPoint presentation on preventing diseases. By uploading the slides to a site like Slideshow (www.slideshow.net), you can use the site as a repository for your information, which people can then view when searching for this topic or through links on other sites. The same can be done by setting up a channel on YouTube to host videos that your company produces, such as new commercials or video of a corporate event.

Podcasts are audio or video that are streamed, and often episodes or series that share a common theme. The term comes from the words iPod (an Apple device on which podcasts are often viewed on) and broadcast. People may create podcasts to disseminate information as when an instructor might want to share a series of lectures, advertising, recorded interviews, and even as a form of video blogging. Sites like iTunes (www.apple.com/itunes/podcasts/) allow you to search through thousands of podcasts and subscribe to them, while other sites like filmmaker Kevin Smith’s Smodcast (www.smodcast.com) are specific to weekly episodes related to his projects, interests, and interviews with other people.

In addition to the communication benefits of content communities, organizations can find it useful and profitable in having online content stored on these sites. Content communities can be used as centralized storage for multimedia being used by your Web site and social media sites. Video files, presentations, and other multimedia take up space on a server’s hard drive. As Internet Service Providers (ISPs) hosting a Web site will charge for additional space, keeping multimedia on such sites can lower the costs of having an online presence. However, in doing this, you should remember that you don’t want to use this as the only storage location for your media, as you should always keep a copy of these files on a network server that’s regularly backed up. After all, if your social media content were ever deleted, corrupted, or vandalized, you would want to upload another copy to the site as soon as possible.

In using content communities, it’s always important to review the sites Terms of Service and identify who ultimately owns the content you upload. Some sites may state that by uploading the content to your site, you give up any rights you had to it. In doing so, the content may now be owned by the site to use as they wish, or considered public domain, where the content is no longer subject to copyright and available for public use.

Social networking sites

Social networking sites enable people to connect or network with one another through the use of profile pages. As seen in Figure 1.3, profile pages allow you to provide a summary of yourself or business, photos, contact information, interests, or other facts that define who you are. On these pages, you may post additional content such as video, audio files, or links to other content. Using this information, others with similar interests can search for you or your business’ page, request to add you as a friend or contact, and/or follow posts on your page.

Figure 1.3 Facebook profile page.

There are a number of different social networking sites on the Internet. The most popular social networking site is Facebook (www.facebook.com), which boasts 1.06 billion active users monthly, but it is by far not the only one. There are other general social networking sites like Google+(http://plus.google.com) and Myspace (www.myspace.com), as well as those focusing on more specific audiences like LinkedIn (www.linkedin.com) for businesses and professionals and Classmates.com (www.classmates.com) for people wanting to reconnect with school, work, and military friends.

Businesses can benefit from social networking in a number of ways. By having a presence on sites like Facebook, you have the potential to reach a large number of people. This allows you to promote your brand and share information with those who follow your posts. In addition to this, social networking sites that are more audience or topic specific can assist with business needs. For example, a site like LinkedIn can provide an alternate method of finding employees or finding a new employer.

Virtual worlds

A more media-rich form of social media are virtual worlds. In these worlds, a user can interact with others using an avatar, which is an animated character that he or she controls. In a virtual game world, a person performs specific missions, quests, or tasks but can also communicate and work with others to achieve goals. Virtual social worlds are somewhat different from the games, as they are more social in the purpose of allowing a person to connect with others through their avatars as if it were the real world.

Virtual game worlds that allow large numbers of people to interact with one another are referred to as Massively Multiplayer Online Role Playing Games. The most popular of these include World of Warcraft and Everquest. In these games, a person takes on the role of a character that they create and can do such things as fight, complete quests, or explore and interact with others.

While online game worlds have typically been accessed through a computer connected to the Internet, home video game systems like Playstation 3 and X-box have games that allow players to connect with one another through a network. If the system is connected to the Internet, a game may allow the player to talk or text with others, allowing multiple people to act together as a team. For example, a combat game might allow you to be part of a military unit with other players, whom you can speak with as you’re playing.

Social worlds also allow people to play in a virtual environment but are designed with social aspects as a primary focus. The most popular example of this is Second Life (www.secondlife.com). In a 3D environment, you use an avatar to function in a way similar to real life or perhaps how they wish your life was. After creating your character, you can meet and talk to others, attend events, and purchase items or services with virtual money.

For organizations, virtual worlds can be beneficial for marketing to large groups. As the environment mimics a landscape, such as the real world or a specific setting, a business could advertise in it through product placement. An avatar could have the opportunity to drive a new car your company is promoting, or your business could have a billboard advertising your services on the side of a building. Even though it isn’t in the real world, it is still reaching real potential customers. An example of how virtual money can translate to the real thing is Relay for Life of Second Life, in which proceeds raised go to the American Cancer Society. Fund-raising and events in Second Life raised $375,000 in 2012 and over $1.5 million to date.

Sites that fall under multiple classifications

While the categories we’ve discussed do well to separate different types of social media into recognizable groups, you’ll often find that a social media site or an application doesn’t easily fall into a single category. Many sites offer numerous features to users making a single classification difficult or impossible.

If you were to look at Twitter, the main function they’re known for is microblogging, where you create short messages for others to read. However, they also allow you to create profile pages, on which you can add a summary of yourself and photos. By looking at the profiles of others, you can then choose to follow what they have to say and they can follow you. These features also make it a social networking site. Even more difficult to classify are platforms like Microsoft SharePoint that provide a wide variety of features, allowing for collaboration, social networking, and the ability to store images, video, and other files in libraries. As you can see by this, the versatility of social media sites and applications can make them challenging to categorize.

However, classifying social media into groups doesn’t consist of hard and fast rules that pigeonhole a site or an application into a single group. This applies to any kind of classification. For example, you could be classified by race, gender, age group, and other factors. The categories help to understand the features and qualities of what’s being discussed.

The value of social media

Throughout this chapter, we’ve discussed some of the benefits that different types of social media can bring to you personally and as an organization. However, the value you find in using social media is dependent on how it’s used. The choices you make will effect whether you find social media beneficial or detrimental to your personal or corporate presence.

While it’s common for people and businesses to use social media, they aren’t necessarily using it the same way. There are many different sites to choose from, with the most popular ones embraced by small and large companies alike. As shown in Figure 1.4, a 2013 study of Fortune 500 companies by University of Massachusetts Dartmouth found increased usage of social media by big business. The study found that 73% of the 2012 Fortune 500 primary companies have corporate Twitter accounts, 66% (332) have corporate Facebook pages, and 62% (309) are using YouTube. The adoption of social media by large companies has surged over the years and become a common feature of major corporations.

Figure 1.4 Fortune 500 Business use of social media sites.

What’s surprising about business usage of social media is that large and small companies don’t necessarily find the same sites useful. While larger companies have found Twitter and Facebook to be the sites that are most useful to their organization, smaller businesses may not find the same results. In 2013, a survey by the Wall Street Journal and Vistage International found that 30% of small business owners used LinkedIn regularly and 41% said it had the most potential for helping their business. As shown in Figure 1.5, the other sites were used less and seen as less beneficial.

Figure 1.5 Social media sites used by small businesses versus their perceived potential of being useful.

A reason why small businesses don’t get as much out of using these sites is that they don’t have the resources that larger corporations have. A larger company will hire knowledgeable people who can use social media to their advantage and budget money and time to these sites as they would other aspects of their business like advertising or customer service. The survey found that only 4 out of 10 smaller businesses had an employee that was dedicated to handling the company’s social media, with almost half spending only 1–5 hours a week on it and one-third spending no time at all.

If you’re worried about foraying into social media or already done so and not getting the most out of it, you’re not alone. Harvard Business Review Analytics Services reported that while 79% of the 2100 businesses surveyed were using or planning to use social media, only 12% felt they were effective at it. This small group of successful companies established a presence on multiple social media channels where they learned about their customers, established user groups, researched and educated people about new products, and followed best practices to meet their goals. As we’ll see throughout this book, being successful in social media involves having a strategy that includes planning, creating policies and guidelines, training, implementation, and monitoring.

In going by these statistics, if you’re part of the majority who feel they aren’t getting all that they hoped from social media, don’t worry. This doesn’t mean you should give up and throw the baby out with the bathwater. Tossing away the good with the bad is never a sound decision, and you’d be better off trying to determine what’s working and what isn’t. In doing so, you can roll things back and focus on creating a new strategy that incorporates best practices.

Value can be found in the potential

While a primary feature of social media is the user-centric ability to publish your own content, the goal is community orientated in having people pay attention to what you have to say. Is there a potential audience? The answer is most definitely yes. Social media has the potential to reach a large segment of the online population and members of every age group. According to Pew Internet & American Life Project, 72% of adults on the Internet use social networking sites. As seen in Figure 1.6, the number of people using these sites has dramatically increased since 2005 across all age demographics.

Figure 1.6 Percentage of Internet users who use social networking, by age group.

Once you’ve tapped into the customers available on the Internet, statistics have shown that social media can result in tangible results. In a survey conducted for the 2012 Social Media Marketing Industry Report, 58% of marketers using social media for over 3 years reported increased sales. Other benefits include increased exposure for a brand, new business partnerships, new customers, and reduced marketing expenses.

Mobile social media

In developing social media strategies, it’s important to recognize how social media will be accessed. Mobile phones, tablets, and other devices are commonly used to connect to social media channels. According to Pew Internet & American Life Project, 40% of people with mobile phones access social networking sites on their phones and 28% do so everyday. Furthermore, Cisco reports that people are using mobile devices at a continually increased rate. In 2012, data traffic from mobile devices increased 70%, and average Smartphone usage increased 81%. They predict that by the end of 2013, there will be more mobile-connected devices than there will be people on Earth, and that this number will increase to over 10 billion devices by 2017. These staggering numbers show that mobile devices are an important part of how you incorporate social media into a business.

Many social media sites offer mobile apps, which users can download from an App Store or Web site. Once the application is installed on your mobile device, you have a quick and easy interface to using features of the site. For example, the Facebook app allows you to do such things as view profile page and update your status and information, while the Twitter app enables you to tweet from a mobile device. Content from the sites is displayed on the device in a format specifically for mobile users, making it easier to use.

Being aware of how mobile devices are used can help in creating a social media campaign that boosts sales and raises awareness of your brand. There are apps available for mobile devices that will help customers to search for products and businesses, such as finding a type of restaurant within your area. Mobile tagging can be used so that the device can read a two-dimensional barcode through a camera on the phone that takes the person to a Web site that displays additional information about a product or service. These tags can also display digital coupons that are instantly redeemed in the store. According to eMarketer, although most promotions are in print publications, an estimated 92.5 million Americans redeemed a digital coupon in 2012. They also predict that by 2014, 100 million people will use digital coupons. Beyond this, simple tweets or updates promoting sales or events can reach a consumer while they’re on the road or possibly in your store. When considering this, the benefits of including mobile users in social media campaigns become clear.

Unfortunately, mobile users can also be a source of problems for organizations. Usage of mobile devices within an organization should always be a security concern. Even if your company has blocked all social media sites through a firewall, this only means that an employee can’t access social media through a networked computer or other device. It doesn’t stop a person from visiting Facebook, Twitter, or other sites through his or her personal mobile phone or tablet. This means that there is the inherent security risk that they could leak information, upload data, or breach security in some other way by using the mobile device at work. While sitting in front of their computer, a disgruntled employee or someone involved in corporate espionage could take a picture of sensitive information displayed on their monitor and then upload it to a content community. A more innocuous breach of security would be a person getting excited over a new product or direction the company was taking and tweeting about it or posting information on a social networking site. While later chapters will discuss these issues in greater detail, policies and training are important methods of deterring and detecting such problems.

Cutting edge versus bleeding edge

The attitude of decision makers can have a significant impact on how an organization uses technology and addresses security. On one extreme, social media may be treated as a cutting edge approach to publishing information and communicating with people. In such a case, they may dive into using it without forethought or proper risk assessment. On the other end of the spectrum, it may be treated as bleeding edge technology that is largely untried, untested, and/or poses a substantial threat. When an organization views social media as this, they may decide to completely block users from accessing social media sites and vehemently oppose using social media for their own potential benefit. As we’ll see later in this section, social media is neither a new concept nor one that’s untried.

In any project, you need to have decision makers and members of the team implementing the project to become evangelists for it. If they don’t believe in it, then others won’t. However, a balanced approach is needed. You don’t want to create an atmosphere of yes men who see nothing but good and don’t address the potential problems. An example of this was one project I was involved in where I was chastised for being negative by pointing out security issues. Just because you’re addressing risks does not mean you’re undermining the project; quite the opposite in fact. Your goal should be to have an end product that is both secure and enthusiastically utilized by the organization. In other words, you want to stay on the cutting edge without getting cut.

Dealing with the is it a fad? question

Being that the term social media has become a household word for anyone with an Internet connection, you might think that people would assume it is here to stay. However, a survey by Harvard Business Review Analytics Services found that 11% of the companies felt that social media for business purposes was a passing fad. This should not be unexpected. Anytime there is a new way of doing business, it takes time to get everyone on board.

There will always be some who won’t accept a new method or technology until they’ve been left behind. An example I always think of is an experience my wife had when attending college. An older instructor had always used traditional methods for doing graphic arts and believed this would never change. He said that computers are a passing fad. Obviously, he was wrong.

Deciding on whether your organization will use social media requires more than an off-the-cuff dismissal of it. An educated decision requires looking at what’s available, how others are using it, what benefits can be achieved, and what problems can be avoided. Without doing the work to find these answers, you can easily find yourself being left behind, while your competitors reap the rewards.

Earlier in this chapter, we mentioned how Harvard Business Review Analytics Services found that 79% of businesses were using or planning to use social media. Of these, 58% were already using social media and 21% were planning to use it. This means that there is a good chance that your competitors are already using or planning to use social media even if you haven’t. It also means that you can learn from the mistakes and successes of others in generating your social media strategy.

Social media has become entrenched in the business world to the point where professions have extended from it. Positions like Chief Digital Officer and Social Media Officer are being used in business to focus on the strategy needed to pull together social media for organizational gain. If a company doesn’t wish to handle their own social media, firms have grown to fill this need so that businesses can outsource the work to professionals.

Having a successful social media strategy requires getting everyone on board. It requires creating a solid communication plan that will address the concerns of others and will answer the questions they have. By showing that social media is a proven method of business that’s being used by others, you can answer the question of whether it’s a fad and worth pursuing.

Brief history of social networking

While the term social media is relatively new, the concept of it is not. For decades, computers have been used by people to connect with others, share information and data, play games, work together on projects, and use software and systems for social interaction. While the technology has changed, the basic premise of its use hasn’t.

In 1978, Ward Christensen and Randy Suess launched the first Bulletin Board System (BBS), which allowed people to connect to their system of phone lines. BBSs became a hobby for numerous people, and many organizations came to use them for a variety of purposes. For example, a number of libraries used BBSs so that people could view available books and reserve them. From personal experience, my own board called Dark Knight BBS ran for a number of years, allowing computers to use a dial-up connection to access the system via a modem. On the BBS, a person would use features that were essentially precursors to types of social media. A person could upload and download images, software, and other files (similar to a content community); read textual commentary (which was essentially a blog); and play games. There were hidden areas for those who worked on the BBS with me, allowing us to collaborate on changes made to the system. A major feature of BBSs was that people could post messages to communicate with others. In some cases, the message boards were networked with other BBSs, thereby allowing people to interact with others they wouldn’t normally meet. For example, my board in North America would make a long distance each night to Arkham BBS in England (run by Nigel Hardy) and transfer messages between the systems. This allowed a community of computer users to socialize overseas as well as with people within their own areas. Other message networks also allowed communication with people throughout the