(NOTE: I removed the graphic that showed the hack on the Twitter feed as it confused and even alarmed someone. Not my intention. This is a story about hacking and social media security)
I was startled by the hacking of the NBC News twitter handle this past week. NBC News had their collective wits about them and responded well and fast. It's hard to see what they could have done although I wish we could all see the "forensics" report when the dust settles as to what led to the breach. They are a news organization and well-attuned to the preciousness of their feeds and channels. I doubt most brands are as ready as NBC News to deal with a security breach.
"The FBI is investigating the NBC News Twitter account hacking committed by perpetrators who posted bogus information about the hijacking of a civilian airliner....The postings were swiftly taken down minutes after they appeared on the main NBC News Twitter account — a tightly controlled account for which only three NBC News executives have the password. Anchor Brian Williams read a statement on the NBC Nightly News Friday night disclosing the attack, adding that the network was "working with Twitter to correct the situation" and apologizing "for the scare that could have been caused by such a reckless and irresponsible act."
There was a similar attack on Fox News in July where false tweets about the President went out. The culprit's did not use some crazy-cool way to "back-door" their way into Twitter:
"In a statement Monday afternoon, Twitter indicated that its own servers had not been broken into; instead, the e-mail account associated with the specific Twitter feed had been compromised, and from there the hacker or hackers had been able to gain access."
Protect Yourself
For brands, social media has likely evolved along the lines of the Social Media Adoption Path. That means that brand-related accounts and users of Twitter, Facebook, Renren, Orkut and others sprang up through uncontrolled experiments. Well-intentioned enthusiasts took advantage of the social media "blind spot" that so many companies had in 2005, 2006 to launch their own initiatives. They found a way around IT (easier than it sounds as IT suffered the blind spot, too).
By now, most organizations should be connecting their social media accounts and activities back into their IT departments security protocols by now. For the good of the brand and the business, it's time to embrace "procedure."
Against the Threats
- Hacking from outsiders (e.g. what we saw in the CNN and Obama cases in 2009)
- Unauthorized use of a Twitter, Facebook or other account (e.g. "how come so many people have posting rights?"
- Getting locked out of accounts (e.g. "who's got the password to the SlideShare account?" "Victoria." "Where's Victoria?" "Her last day was last Friday....")
- Protocol to get help from a social network in a crisis or when an issue comes up (e.g. "someone just stole our intellectual property and posted it up on YouTube.")
- Escalation procedures (e.g. "this has never happened. Who do I call.")
- Good user education on tools and platforms (e.g. "Oops, I just published via Tweetdeck to the brand account not my personal account..."
...and so forth. It is never more real than when something like this happens and you think of the impact to a channel like Facebook where there are 700M+ users and you have 1M+ followers. When a bad message goes out, the concept that 'the social Web is self-correcting' just feels like small comfort.
7 Suggested Steps
Get your contacts at the various social networks on speed dial - You will need an explicit agreement from them that they will respond. The folks at Facebook, Twitter et al are always understaffed and even brands who spend significantly with them don't always get them on the phone. Cut through that and know who your "go-to" is and get an executives phone number, as well.
Limit publishing rights and manage that list centrally - it may smack of bureaucracy but its worth it
Implement good password protection etiquette - educate on the quality of a good password and change it periodically as a precaution
Implement simple "flight training" for users - no need that it be as corny as the harassment training modules we all endured
Manage account login's and passwords centrally and have a 24/7 human contact with the"the keys" - please, please do not leave the keys in the hands of the single social media "guru" you hired last year. In a word, that would be "bad."
Write down and socialize your procedures for the most likely scenarios - you know the adage - "best time to deal with a crisis is before it happens...". there is some good content already out there like Twitter's page - "My Account Has Been Compromised"
Update your url strategy to protect valuable assets (e.g. like protecting your brand from a .xxx domain extension)
What are the other good practices of social media security?
