Embedded Files
Summary
The below information was compiled as part of IT 42000, Social Media Security, and covers a variety of topics that were learned throughout the year in coursework and readings, including employee monitoring tools, incident response, risk assessment, training, and social media policy development. Information on the site is pulled directly from submitted works.
Table of Contents
Social Media Monitoring Tools
Monthly subscription pending company size
Tracks mentions and interactions across a wide array of social media networks
Scheduling social media posts
Seemless direct message handling in one location
Free
Accessible
Track news articles and stories that mention the company name
Get automatic emails on a daily or even weekly basis that meet your criteria
Employee Monitoring Tools
Pricing varies by company size
Real-time clock in & out
Task management & delegation
Live GPS tracking
New device login alerts
Pricing is per user
Automated Classification of Websites & Apps Activity
Inefficiency and distraction analysis
Workload balance & burnout risk
Pricing varies by company size
Delivers identity and access management
Session recording and activity audits
Fast incident response with a visually structured evidence trail
Ethics of Employee Monitoring
When it comes to monitoring employees during work hours, the question often arises - is it ethical? What about whether or not is it legal? If you are monitoring an employee's every move, maybe not. For instance, you cannot monitor their time in the bathroom or locker room, it is off-limits. However, you can monitor them in general workspaces such as cubicles and hallways. But what about computer usage? This is a gray area that is the most commonly questioned monitoring area of a company. The main goals behind them are to prevent internal theft, keep an eye on employee productivity, ensure the proper use of company resources, and gather evidence in the event of a lawsuit against the company for misuse.
Federal workplace privacy and employee monitoring regulations came into play primarily from the Electronic Communications Privacy Act of 1986. The ECPA allows business owners to monitor all verbal and written communication as long as the company can present a legitimate business reason for doing so, such as protecting company assets. This includes forms of communication like SMS, email, and phone conversations, too. GPS Fleet tracking is another common use of surveillance. If items such as browsing history are monitored, the company must also ensure that the information gathered is protected. If a security breach were to occur and personal information accessed, the company could be at risk of litigation from the employees that were monitored.
You can find out more about this gray area in Max Freedman's Business News Daily piece.
Incident Response Plan | Disaster Recovery Plan
Recognize an Incident or Attack Has Occurred
Briefly Identify Extent of Incident
Identify the extent of the incident - areas affected, not, etc.
Revoke Access to Limit Further
Close off the company network, temporarily disable social media accounts, or lock access doors to a physical location.
Inform the Media
Report to media or userbase to alert them that an attack has occurred, working diligently to remedy the situation.
Identify Full Extent of Incident
How far did the attack reach? Was personal information accessed? Was a system that handles personal information affected?
Remedy the Situation
Begin repairs to any damages done, whether it's deleting posts on a social media account or rolling back affected computers and drives, as well as alerting any affected parties of what they need to do. Do users need to take action such as changing a password, or simply wait until the services come back online? Informing the userbase then of what they need to do can reduce panic, especially if their information was accessed or affected.
Incident Response Planning Personnel
When developing policies, it is important to build a team of policymakers with individuals from multiple departments. These could include HR, Marketing, Public Relations, Sales, Business Development, Legal, and Customer Service. Each of these areas of the company should have a say in policies that may directly affect them, reviewing each operational aspect of the response plan accordingly.
Social Media Policy Development
At a minimum, the social media monitoring that should be agreed upon needs to include HR, IT, Legal, and the Community Manager or similar position, team, or board. These departments need to come together to develop a baseline of monitoring points, such as tracking industry trends and influencers, especially those relating to your brand. Monitoring and reporting what different communities are saying about your company online. Monitoring other organizations’ activities in your industry. Deciding what tracking tools will be used to monitor employees on social media, as well as how lenient to be in this monitoring. Tracking sites that mention the company most often as well as any changes in interactions based on the training being done within the company. Defining how necessary the monitoring of social media usage is, as well as who should take part - the community management team or a larger pool of employees? Lastly, and likely most important, is updating any and all security threats to social media platforms that the company uses while monitoring employee activity on these platforms.
Due to the constant evolution taking place in the social media realm, it is important for companies to stay up to date with this policy. However, it also depends on how strict the company is. If a company is very lax on its social media policy, it could get by with reviewing the policy every other year. For companies that have a broad social media presence, it is more worthwhile to revisit the social media policy on a regular basis, such as quarterly, while recognizing the necessity to revisit the policy when the company looks to expand to a new social media platform. This updating should involve the same departments that took part in the development of the policy to begin with.
Social Media Security Template
Key points and descriptions of areas that should be covered in a company's social media security policy.
Introduction
An introduction clearly stating information about the policy: the purpose, the scope (does it cover employees only, or does it include contractors?), and who manages the policy.
How Social Media is Used
The policy should also cover how social media is used, covering key information such as what social media channels the policy refers to, the benefits these channels may offer to departments, and defining responsibilities throughout the company (such as IT, marketing, HR, legal, and if there is a designated community manager).
General Policies
Next, it is important for the policy to include information regarding general policies: these include regulatory requirements held to the company, community management strategies, confidentiality definitions (including disclosure and private company information), legal issues and restrictions that are applicable to the social media usage, how engaged the company should be with the community, handling negativity online, properly dealing with the press, and clearly defining how to interact with trademarks, copyrights, and intellectual property (such as stating that users are not allowed to use another person’s content unless they have clear written permission from that person or company.) This section may also lay out the chain of command to follow when looking for approval to create a post. Perhaps most importantly, this section should clearly define that employees are going to be held responsible for any of their actions if a policy is broken.
IT Security Policies
Some companies may want to look into a dedicated section for IT security policies, which would cover anything from password requirements to how to detect and prevent intrusions into accounts and even defining any training requirements, such as the IT department being required to train the end-user employees on the security requirements defined.
Social Media Do's and Don'ts
An extremely useful area for companies, and one that was common among the examples I researched, was social media do’s and don’ts. Essentially, how to make the most out of social media in a productive, professional, and positive manner. Clearly defining the line of communication in common examples, such as to not disparage competitors, partners, or be generally condescending towards other users outside of the company.
Brand Guideline Policy
What is the brand policy and what are the guidelines for discussing and promoting the brand?
Media-Channel-Specific Rules
The policy should include a section dedicated to explaining a media channel’s specific rules, such as the difference between Twitter’s retweet and quote tweet to Facebook’s interactions. Similarly, it may define whether or not memes should be incorporated into the use of that media channel. Just look at Slim Jim’s Instagram account! The marketing and community involvement with their page has set the standard for other companies, so perhaps a section dedicated to memes will be in order. Or, at the very least, define a board approval process for any memes in order to ensure they do not offend the intended audience. The Slim Jim Instagram account typically uses 69 ♋, nice (n🧊), or a 420 (🔥) reference in their memes - all reasonably harmless in the culture on Instagram - while also calling themselves the “Long Boi gang.”
Personal Use of Company Information
No matter what media channels are used, it is worth defining how employees can use company information in their personal blogs, social media posts, and beyond. This should clearly define any information that can be used while also referring to any HR policies that restrict employees from sharing this information in the first place.
Referrel to Code of Conduct
Along the same lines, the last section should refer employees, and other affected parties such as subcontractors, to the HR handbook for code of conduct while reiterating that they are not to damage the company's reputation.
Conducting a Risk Assessment
Conducting a risk assessment is a sure way to protect the company, especially when it comes to prioritizing the threats that could affect the company. During this assessment, the company looks at the threats on hand and determines the level and priority of these threats, as well as the risks they offer if not dealt with properly.
Proper risk assessment can be completed via the threat management lifecycle that does just that. This identifies and collects the threats, assesses the risk involved with each of these threats, analyzes the company's ability to respond to these threats, and creates action plan approaches that identify how threats will be discovered and monitored for activity. This also includes planning for future threats and how the company will respond.
Training & Policy Review
Training in social media security is extremely important to protect the company. Companies should look into training community managers and employees alike. This training would be best delivered via a mix of training seminars and interactive informational sessions. In order to ensure community managers and employees stay up to date with the endless changes surrounding social media security and properly prepare for social media catastrophe, it would be best to hold training at least once a year. This would be mandatory for both parties on a yearly basis with optional refreshers available throughout the year.
The training would be different for each party, however, both would be required to review applicable policies. For community managers, it would cover social media disaster recovery, how to go about reporting in the event of an emergency or technical issue, defining and revisiting communication principles that fit with the online worlds’ everchanging mood, and refining security practices in partnership with the company’s IT and HR departments. For other employees, it would cover a variety of the basics - protecting sensitive information, implementing email safeguards, recognizing and reporting phishing attempts, reinforcing safe web-browsing practices, and detecting and avoiding social engineering attacks. While this seems like a lot, it is of utmost importance for companies to ensure their employees are properly trained to handle the wide variety of attacks out there, all of which could compromise the company both on social media and via hackers.
Page updated
Google Sites
Report abuse