Bridging the Social Media
Implementation/Audit Gap Jerod Brennen, CISSP CTO and Principal Security Consultant, Jacadis
Agenda
• Perspective
• Preparation
• Implementation
• Monitoring
• Resources
The Five W’s
• Who?
• What?
• When?
• Where?
• Why?
• How?
[Image courtesy of Master Isolated Images / FreeDigitalPhotos.net]
Strategy (Who + Why + When)
• Risk vs. Reward ▫ Customer interaction ▫ Revenue streams ▫ Malware attack vectors ▫ Legal and HR concerns
• While revenue may be on the rise… ▫ … so are social engineering
attacks
Image from http://www.isaca.org/About-ISACA/Press-room/News-Releases/2010/PublishingImages/Social-Media-Business-Risks.JPG
Risk vs. Reward
FromWAPSM-Social-Media-Research-1Feb2011.doc, pages 11-12
Risks Rewards
• Disclosure of corporate assets and sensitive (privileged) information accessible to unauthorized parties
• Violations of legal and regulatory requirements
• Loss of competitive advantage • Loss of customer confidence • Loss of reputation • Dissemination of false or fraudulent
information • Inappropriate or unapproved use of
company intellectual property such as logos or trademarked material
• Increasing brand recognition • Increasing sales • Immediately connecting with
perspective customers • Exploring new advertising
channels • Monitoring competition • Researching perspective
employees
Regulatory Concerns
• FINRA (Financial Industry Regulatory Authority) ▫ Regulatory Notice 10-06 ▫ Regulatory Notice 11-39
• Advertisements ▫ Public websites & banner ads
• Sales Literature ▫ Email or IM to 25+ prospective retail customers ▫ Password-protected websites
• Correspondence ▫ Email or IM to 1 customer ▫ Email or IM to 1+ existing customers and/or <25 prospective retail
customers • Public Appearances
▫ “Content posted in a real-time interactive electronic forum”
From http://www.finra.org/industry/issues/advertising/p006118
Scope (What + Where)
Scope, per ISACA
• Current social media tools include: ▫ Blogs (e.g., WordPress, Drupal™, TypePad®) ▫ Microblogs (e.g., Twitter, Tumblr) ▫ Instant messaging (e.g., AOL Instant Messenger [AIM™],
Microsoft® Windows Live Messenger) ▫ Online communication systems (e.g., Skype™) ▫ Image and video sharing sites (e.g., Flickr®, YouTube) ▫ Social networking sites (e.g., Facebook, MySpace) ▫ Professional networking sites (e.g., LinkedIn, Plaxo) ▫ Online communities that may be sponsored by the
company itself (Similac.com, “Open” by American Express) ▫ Online collaboration sites (e.g., Huddle)
FromWAPSM-Social-Media-Research-1Feb2011.doc, page 11
Implementation (How)
• Begin at the beginning ▫ Meet with Marketing, HR, Legal, and IT to discuss risks and benefits
• Define policy ▫ More on this later…
• Document training requirements ▫ Employees ▫ Consultants & Contractors ▫ Vendors & Partners
• Document procedures and controls
▫ Access Requests ▫ Monitoring ▫ Assessing
Audit/Assurance Program (1 of 3)
• Available at http://www.isaca.org/Knowledge-Center/ITAF-IT-Assurance-Audit-/Audit-Programs/Documents/WAPSM-Social-Media-Research-1Feb2011.doc
• Aligned with COBIT (cross-references)
• Planning and Scoping the Audit ▫ Define the audit/assurance objectives ▫ Define the boundaries of the review ▫ Identify and document risk ▫ Define the change process ▫ Define assignment success ▫ Define the audit/assurance resources required ▫ Define deliverables ▫ Communicate
Audit/Assurance Program (2 of 3)
• Strategy and Governance
▫ Risk Management
▫ Policies
• People
▫ HR Function
▫ Training/Awareness
▫ Staffing
Audit/Assurance Program (3 of 3)
• Processes
▫ Social Media Alignment With Business Processes
▫ Social Media Brand Protection
▫ Access Management of Social Media Data
• Technology
▫ Social Media Technology Infrastructure
▫ Monitoring Social Media and Effect on Technology
Policy and Training • Personal use in the workplace:
▫ Whether it is allowed ▫ The nondisclosure/posting of business-related content ▫ The discussion of workplace-related topics ▫ Inappropriate sites, content or conversations
• Personal use outside the workplace:
▫ The nondisclosure/posting of business-related content ▫ Standard disclaimers if identifying the employer ▫ The dangers of posting too much personal information
• Business use:
▫ Whether it is allowed ▫ The process to gain approval for use ▫ The scope of topics or information permitted to flow through this channel ▫ Disallowed activities (installation of applications, playing games, etc.) ▫ The escalation process for customer issue
From http://www.isaca.org/Knowledge-Center/Research/Documents/Social-Media-Wh-Paper-26-May10-Research.pdf?id=c1f7b9d8-516d-40c1-8087-e3b0e6cd138c
Recurring Assessments
• Risk Assessment
▫ SOX, PCI, HIPAA, etc.
▫ Did your previous assessment(s) include social media?
• Penetration Test
▫ Is social engineering in-scope?
Preventative Controls
• Antivirus > Endpoint Security ▫ Prevent devices from being infected with malware ▫ Also, host-based firewall and URL filtering
• URL Filtering ▫ Prohibit access to certain websites from corporate devices
• Training ▫ How to use social media responsibly ▫ How to identify and respond to social engineering attacks
• Data Loss/Leakage Prevention ▫ Prevent sensitive corporate information from being transmitted
via email, instant messaging, file uploads, etc.
Detective Controls
• Content Filtering ▫ Configure email and web security solution to monitor for
patterns in outbound messages
• Google Hacking ▫ Using powerful customized Google search queries to gather
information
• Monitoring Tools (e.g., Maltego) ▫ Open source intelligence and forensics tool
• Monitoring Services (e.g., RiskIQ) ▫ Monitor web-based content for threats and fraud
Resources • ISACA documents
▫ Social Media Audit/Assurance Program http://www.isaca.org/Knowledge-Center/ITAF-IT-Assurance-Audit-/Audit-
Programs/Documents/WAPSM-Social-Media-Research-1Feb2011.doc ▫ Social Media: Business Benefits and Security, Governance, and Assurance
Perspectives http://www.isaca.org/Knowledge-Center/Research/Documents/Social-Media-Wh-
Paper-26-May10-Research.pdf
• Related Documents ▫ CDC – Social Media Security Mitigations
http://www.cdc.gov/socialmedia/tools/guidelines/pdf/securitymitigations.pdf ▫ Ponemon – Global Survey on Social Media Risks
http://www.websense.com/content/ponemon-institute-research-report-2011.aspx ▫ Social Media Standard, State of California
http://www.cio.ca.gov/Government/IT_Policy/pdf/SIMM_66B.pdf ▫ Wikipedia – List of Active Social Networking Sites
http://en.wikipedia.org/wiki/List_of_social_networking_websites
Resources
• FINRA ▫ Regulatory Notice 10-06
http://www.finra.org/Industry/Regulation/Notices/2010/P120760 ▫ Regulatory Notice 11-39
http://www.finra.org/Industry/Regulation/Notices/2011/P124187 ▫ Advertising Information
http://www.finra.org/Industry/Issues/Advertising/index.htm
• Securing Social Media Profiles
▫ Facebook http://slandail.posterous.com/four-steps-to-secure-your-facebook-profile
▫ Twitter http://www.mediabistro.com/alltwitter/twitter-security-101_b11985
▫ LinkedIn http://www.cio.com/article/485489/LinkedIn_Privacy_Settings_What_
You_Need_to_Know
Resources
• Securing Corporate Blogs ▫ Hardening WordPress
http://codex.wordpress.org/Hardening_WordPress ▫ 11 Best Ways to Improve WordPress Security
http://www.problogdesign.com/wordpress/11-best-ways-to-improve-wordpress-security/
• Tools and Services
▫ Google Hacking Database (GHDB) http://www.hackersforcharity.org/ghdb/
▫ Maltego http://www.paterva.com/web5/
▫ Risk IQ http://www.riskiq.com/
▫ Jacadis http://www.jacadis.com/
Questions? Jerod Brennen, CISSP
614.819.0151
http://www.linkedin.com/in/slandail
http://twitter.com/#!/slandail
Recommended
