The New Risks of Social Networking
How to protect your bank from the latest security and technology concerns
By Russ Horn, CISA, CISSP, Chief Operations Officer
CoNetrix Security and Compliance Consultant
This article was published in the July 2010 issue of Texas Banking
Social networking sites like Facebook, MySpace, Twitter, and LinkedIn are a topic
on everybody's lips today. Our kids communicate with them; our customers are on
them; our employees request them, but how do they fit into my bank's strategic plan,
and what are the risks associated with these sites? In this article, we will look
at the security and technology concerns related to social networking sites.
Each year, McAfee Labs produces a Threat Predictions report listing the top threats
they forecast for the coming year. This year, McAfee listed social networking threats
as the top two in their report: "1.) Social networking sites such as Facebook will
face more sophisticated threats as the number of users grows. 2.) The explosion
of applications on Facebook and other services will be an ideal vector for cybercriminals,
who will take advantage of friends trusting friends to click links they might otherwise
treat cautiously."
Let's take a look at some of the social networking-related threats banks face:
Phishing
Currently, the biggest threat to many social networking sites are phishing attacks.
These attacks are very successful because we tend to trust Facebook and Twitter
more than we do traditional e-mail (where we have seen phishing attacks originate
from in the past). When one of our friends posts on our Facebook page or Tweets
a link on Twitter, we are more likely to blindly follow the link or open the application
and end up on a spoofed website or with malicious software installed on our computer.
Based on Microsoft Security Intelligence Reports, phishing attack trends are moving
from financial institutions to social networking sites. Prior to May 2009, the financial
institution sector had always seen the largest percentage of attacks (usually over
50% of phishing attacks would be targeted at financial institutions on any given
month); however, since May 2009, social networking sites have seen more phishing
attacks each month. The last half of 2009 showed three months where social networking
sites received more than 70% of all phishing attacks. This is a very dramatic shift
in attack trends over a relatively short period of time.
In examining these statistics, I doubt the attackers have decided to stop going
after the money (financial institutions). Instead, I think financial institutions
have done a good job of stopping many of the traditional attack avenues (e.g. phishing
e-mails directly to the bank), so the attacks are finding new vectors we have not
addressed as well (e.g. social networking sites).
Reputation Risk
Due to the integration (or I like to refer to it as collision) of social networking
sites and business applications, we are beginning to see a new threat emerge from
social networking sites... reputation risk. For example, Outlook 2010 released with
a new "feature" that allows you to integrate your e-mail with social networking
sites like LinkedIn, MySpace, and soon-to-be Facebook. So, when you receive an e-mail,
it will pull the person's picture and status updates from these sites and display
them at the bottom of the e-mail. It integrates the information from the social
networking sites based on the e-mail address listed on each account.
What does this mean for your bank? Let's say you have a Loan Officer that is using
his bank e-mail address for MySpace or Facebook; we will call him Sam. Sam uses
a questionable picture for his MySpace profile and over the weekend posted an offensive
statement as his status update. Then, on Monday morning, he sends an e-mail to one
of your best customers who has just upgraded to Outlook 2010. When the customer
opens the bank e-mail, he sees the profile picture of Sam and his offensive statement.
Footprinting & Information Gathering
If we create a bank social networking site (on Facebook or Twitter), many of our
"friends" or "fans" will likely be our customers. This makes it much easier for
attackers to gather information about who our customers are and, therefore, makes
it easier for them to send targeted phishing attacks (spear phishing) against our
customers.
In addition, if our employees include work information on their personal profiles,
this information can be used by attackers to successfully implement social engineering
and spear phishing attacks.
Strategic Risk
There is a risk in not addressing social networking sites at all. In the 90's, many
banks did not go out and quickly reserve an Internet domain name for their bank
(e.g. www.bankname.com). This is because they either did not foresee or consider
the business value of the Internet. Ultimately, by not seeing the purchase of an
Internet domain name as a strategic objective, many banks ended up with domain names
that are less than ideal (e.g. www.banknameonline.net).
Right now, it is debatable whether Facebook, LinkedIn, or other social networking
sites will have significant business value; however, there is risk in not considering
them in our strategic planning. At a minimum, we should consider reserving the domain
name for key social networking sites (like Facebook and Twitter) and taking ownership
of bank business accounts on sites like LinkedIn where many business accounts are
already present. To register your bank name on Facebook, you must first create a
page and have 25 fans. Then, an administrator of the page can go to www.facebook.com/username
to select a name (e.g. www.facebook.com/bank.name). For Twitter, the name with which
you set up the account becomes your domain address (e.g. www.twitter.com/bankname).
Most banks already have accounts on LinkedIn; they just need to be managed. You
can do a search for your bank on LinkedIn by going to www.linkedin.com/companies.
Compliance & Privacy Risk
Right now there is not a lot of regulatory guidance regarding social networking
sites; however, I am sure applicable FILs and Bulletins are coming in the near future.
For now, general compliance and privacy rules and guidelines should be applied to
social networking sites in determining risks and controls.
What are other banks doing?
During a training event sponsored by CoNetrix on April 28, 2010, we asked more than
80 bankers questions about social networking controls. Of those surveyed, 23% said
they had a bank Facebook account and 15% said they had a bank Twitter account. However,
when asked if they had personal accounts, 75% said they had a personal social networking
account (with Facebook being the most popular at 68%). When asked how banks were
managing and controlling social networking sites, only 7% said they had conducted
a formal risk assessment. In addition, only 21% said they addressed social networking
in their policies with only 14% requiring employees to sign off on the policy.
What are some controls I should consider?
Technical Controls
Many institutions are implementing technical controls to keep employees from accessing
social networking sites while on the bank network. For example, during the survey
we conducted on April 28th, 71% of banks said they currently restrict social networking
sites through some sort of technical controls (e.g. web filtering). This at least
helps protect bank systems from many attacks while employees are connected on the
bank network; however, most technical controls do not address mobile devices, like
laptops, when they leave the bank network.
Policies and Procedures
Social networking sites need to be clearly addressed in bank policies and procedures.
Your policy should identify whether you plan to have a bank social networking site
and, if so, what sites the bank will maintain and how. It should state whether or
not your employees are allowed to access social networking sites on bank systems
or during bank hours and, if so, which ones and with what restrictions or guidelines.
You also need to make a decision on allowing bank employees to use their bank e-mail
address on social networking sites, or even if they are allowed to mention the bank
on these sites. Finally, you need to make sure these decisions are rolled into the
Acceptable Usage Policy (AUP) signed by all employees.
What Should I Do?
- Get Educated - treat social networks like any other risk and/or opportunity.
- Conduct a formal Risk Assessment.
- Make a Plan - at a minimum, monitor.
- Define Controls – both policy and technical.
- Regularly Review - these sites are changing frequently; we must schedule time
to regularly review the risks and our controls to ensure we are staying on top of
security concerns.
View More Articles