How brands protect themselves from threats on social networks
Rule 1: Get an overview of all accounts
It goes without saying that every company that has set up a brand presence on social media should also know how many accounts and profiles relate to the brand. This also applies to the official accounts of employees. After all, users can write to any of these accounts - and cyber criminals can take over any of the profiles. However, many companies have lost track of this at some point, as the Swiss financial technology company SIX has also discovered. SIX offers global financial services relating to securities transactions, payment transactions and financial information. Security is one of the core issues at SIX. When those responsible decided to develop a brand protection strategy for social media, they first obtained an overview. The nasty surprise: many of the company-related social media accounts were difficult to identify and many could therefore not simply be deleted.SIX therefore recorded all company-related social media accounts and clarified which accounts were relevant and which were no longer maintained and therefore represented potential gateways for attackers. SIX then deactivated these accounts, thereby closing the first security gaps.
Rule 2: Assign responsibilities
In its inventory, SIX also found that even the maintained accounts had security gaps. Access was not clearly regulated; in cases of doubt, you had to ask around to be able to do anything with the account. If the overview is in place, it is therefore important that there are people responsible for accounts. This means that an employee always knows what is happening on the account and notices if the account is being misused. This sounds obvious, but this simple basic rule is often neglected for reasons of convenience.
Rule 3: Organize teamwork correctly
When assigning responsibility, it is also worth checking which employees have access to the accounts. Those responsible must always know what is happening on the channels, but that doesn't mean they have to manage them alone. Like all communication processes, social media also benefits from teamwork, and in the case of SIX, those responsible decided to implement social media management software, which acts as a compliance hub to network all social media activities and minimize risks. All content can be centrally posted there in advance, checked and approved before publication.
Rule 4: Establish content guidelines
Clarifying access and responsibilities is very important, but this is not enough for consistent communication. Brands also need to define clear content guidelines and clarify the questions: Who creates content? What content is created? Who releases this content? A list with examples of appropriate and inappropriate content as well as content ideas developed by the social media team can support the employees involved with helpful recommendations for action.
Rule 5: Set up a crisis plan
No matter how well a company manages its brand presence on social networks: No brand is immune to a shitstorm. Social media has shifted the balance of power in the relationship between brand and customer. Whereas in the past almost all customer complaints could be dealt with in hotlines and customer centers without the public finding out, every disappointment, every mistake and every misunderstanding is discussed publicly on Facebook and the like. And this happens so quickly that many a brand manager has gone to bed in a good mood only to realize at breakfast that a shitstorm has affected their brand.The good news is that companies can also prepare for this often unpredictable scenario. Every brand should define for itself what constitutes a crisis. These scenarios can be mapped and simulated with a crisis plan that is managed by a central crisis manager. The plan contains, for example, pre-approved messages that can be used quickly without the crisis manager's approval in the event of a crisis. It should also determine which internal and external communication channels will be used to manage the crisis. This shortens the response time and brands regain control of the crisis, and those responsible at SIX also integrate their social media platform in the event of a crisis. The social media team receives automated alerts in the event of a crisis and is involved immediately. With the help of the platform, the team can track and document crises in real time. In addition to standard queries, special hashtags and keywords relating to the crisis are monitored.
Rule 6: Protect passwords and log in securely
Particularly in sectors where critical customer data is involved, such as banks and insurance companies, fears of loss of control and security problems prevail when companies open up. Phishing attacks are also a concern for companies, and rightly so. According to Kaspersky, the global cost of phishing attacks on social media channels amounts to 1.2 billion dollars per year, making them an increasingly common gateway for cyber criminals: The employees of companies. According to Bitkom, one in five German companies reported social engineering in 2017. This involves manipulating employees in order to obtain sensitive information that can then be used to install malware on company computers. The most important measure for protection against cyber criminals is the correct use of passwords. Password guidelines are extremely effective. They should stipulate that passwords should always be between eight and 20 characters long and contain upper and lower case letters as well as special characters. These are databases that store all access data in encrypted form. When a password is requested, the password safe is decrypted and the access data can be copied or automatically pasted. Most managers even generate secure passwords automatically on request, and accounts should only be logged into using two-factor authentication, which is also recommended by the German Federal Office for Information Security in its IT baseline protection catalogs. A single sign-on also reduces the risk of login data falling into the wrong hands, and the Swiss financial experts at SIX also rely on support from monitoring software. It checks all company accounts for manipulation, misuse or hacks. The program generates alerts in the event of unauthorized activities and proactively searches for fake accounts or posts that violate the applicable guidelines - and then initiates the deletion process.
Social media is complex and requires discipline
Social media is a perfect tool for developing a brand. However, due to its complexity, brands are also exposed to a confusing risk situation. The six basic rules can already significantly reduce most risks, but this requires disciplined implementation of the measures. Social media management tools can take a lot of work off companies' hands by automating many processes.*Markus A. Boehm is Sales Director DACH at Hootsuite. Via its platform, the company offers important assistance in the social media representation of companies of all sizes. This includes not only the advance planning and data-supported evaluation of campaigns, but also protection against security risks and negative publicity.
