© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social Social and Mobile Security Considerations Carl Culshaw and Laurence Bentley July 3rd, 2012

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 3 HP Information Security Management Incident Management Problem Management IT Security Health Check & Penetration Test Management Computer Forensic Management Covert Access Management Security Scanning Enterprise Security Event Management The HP Information Security Management (ISM) delivery for the DWP comprises a range of security management services, all designed to provide independent assurance that service providers protect information assets in line with DWP security policies and standards. Information Security Management sits between the DWP Business and its IT service providers, including HP, and provides an independent, enterprise-wide view of risk and compliance. HPISM Services include: Information Security Risk Management Compliance Assurance Management Threat and Vulnerability Management System Certification Management Policy Management Change Management Awareness

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 4 Who Are We Laurence Bentley Senior security consultant with HP Enterprise Security Service for over 7years, working in the Information Security Management delivery for a large UK Government account. My main focus is threat & vulnerability management, through the analysis and identification of current and emerging threats and treads, by way of penetration and automated vulnerability scanning test analysis. I am also involved in the identification, handling, and reporting of security issues and events. 12 Years experience in this arena. Carl Culshaw I Work for HP Enterprise Security within the Information Security Management section and specialise in Threat & Vulnerability Management for the DWP Account. This primarily involves keeping upto date with the latest online threats, monitoring websites, assessing websites, malware investigations and assessing vulnerabilities released by software vendors. 12 Years experience in this arena.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 5 Agenda Introduction What Is Social Media Evolution Categories What's Next Social Media & Mobile Statistics and Facts Usage of Media sites Mobile phone usage Government usage of Social Media Risks & Threats Of Social & Mobile Media Key Risks Examples Targeting

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 6 Agenda (Cont) Benefits & Rewards Of Social & Mobile Media Why use Social Media Benefits of Social Media Inter Government Social Media Security Policy and Procedures Security Countermeasures Conclusions Q&A

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 8 What Is Social Media The Wikipedia definition is: A social network service focuses on building and reflecting of social networks or social relations among people, e.g., who share interests and/or activities. A social network service essentially consists of a representation of each user (often a profile), his/her social links, and a variety of additional services. Most social network services are web based and provide means for users to interact over the internet, such as e-mail and instant messaging.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 9 Social Media Through The Ages The Beginning First Postal Service 550BC (Persia) Telegraph1792 (France) Pneumatic Post1865 Telephone1890 Radio1891 Taking Shape Email1966 ARPANET1969 CompuServe1969 BBS 1978 MUD11978 USENET1979 The Well1985 Listserv1986 IRC1988 The Palace 1994 MoveOn1998 The Modern Era Napster1999 Third Voice 1999 Blogger1999 Epinions1999 Wikipedia2001 LinkedIn2002 Friendster2002 Secondlife2003 Facebook2003 MySpace2003 Del.icio.us2003 Flickr2004 Digg2004 YouTube2005 Twitter2006 Google Plus 2010 The Evolution Of Social Media

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 10 Social Networking Today Publishing Sharing Geo-Locate Gaming Buying Networking

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 13 Social Media Usage A survey undertaken by InSites of senior managers and business owners from around the globe, asking whether these companies were currently using Social Media sites found:- A very high percentage reported to be using Facebook. Just under half had an official presence on LinkedIn. Under half had an official presence on Twitter. Less than a third had an official presence on YouTube. theSocialSkinny.com carried out a survey in the first half of 2012, across a broad range of Social Media subjects, their survey found that:- 36% of social media users post brand-related content. 50% of people follow brands in social media. 75% of companies now use Twitter as a marketing channel. 41% of the class of 2011 used social media in their job search. 38% of CEOs label social media a high priority. 57% of businesses plan to hike their social media spend in 2012. 89% of agencies said they would use Facebook to advertise for their clients in 2012.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 14 Mobile Phone Facts The mobile phone market has increased dramatically over the last 10 years with almost one billion smartphones in circulation today. Due to this rise, the way people interact with the internet is also changing:- 38% of people who use social media on mobile devices cite general browsing as their main activity. There are still more iPhones sold per day (402k) than people born in the World per day (300k). Users accessing the web through mobile devices has almost doubled every year since 2009. Global internet usage through mobile devices rose to 8.5% at the end of 2011 (from 4.3%). Mobile advertising is exploding – during Q4 2011, mobile advertising was up 39%. Almost 35% of all Smartphone users access Social Media sites every day. Accessing the Internet via Smartphone is close behind Desktops as the main method of access. 23% of Mobile users have accessed Online Government services from their phones.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 15 Government Social Media PEWInternet.org carried out a survey in 2010 regarding the usage of Government Services via or through Social Media sites. The same survey was carried out in 2011 but the findings have yet to be published. The findings from the 2010 survey identified:- 15% of internet users watched a video on a government website. 15% of email users signed up to receive email alerts from a government department or official. 13% of internet users read the blog of a government department or official. 5% of internet users followed or become a fan of a government department or official on a social networking site (this represents 9% of social networking site profile owners). 4% of mobile phone owners who use text messaging signed up to receive text messages from a government department or official. 2% of internet users followed a government department or official on Twitter (this represents 7% of Twitter users).

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 17 Social Networking Attacks Over the past few years many different company's and groups have undertaken reviews of the threats posed by the use of Social Media and Networking sites. These reviews have identified a number of different threat vectors, the common ones are:- Koobface ClickJacking Malicious Applications Malvertising (Malicious Advertising) Phishing attacks. These type of attack are also reported to make up around 85% of all Phishing attempts. Phishing is by far the biggest risk and from details published by Microsoft these types of attacks rose in 2010 by 1200%. With the company being targeted the most being eBay/PayPal. The act of luring a user into surrendering private information or conducting an act that will compromise the victims computer system. Is a multi-platform worm that collects user credentials and then connects the infected system into a Peer-2-Peer botnet. Spread via a message with an attached link over multiply Social Media sources:- Facebook Twitter Hi5 MySpace Is a User Interface Redress attack, which involves the attacker placing a transparent layer over the top of a legitimate element. This fools the user into thinking they are clicking the valid content under the transparent layer, but in fact they are activating the hostile code. Is software or code which is designed to provide its operator with access to data, systems, or devices to which they would not normally be allowed. These can also be used to disrupt the normal operation of the affected system. Is the posting of malicious content via advertisements on a site. Normally achieved via the use of Adobe Flash scripts. Just need to be viewed/rendered to be infected.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 18 Key Risks to Social Media As we have seen there are a number of risks and threats associated with the use of Social Media, the key risks are:- Information Disclosure. Professional Embarrassment. Reputational Damage. Malware.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 19 Facial Recognition Your in the background of a photograph but through the ability of facial recognition you can be automatically identified.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 20 Facial Recognition A member of the ACMEA Justice System was photographed at an Anti-Road Runner rally. Through the use of facial recognition tools members of the ACMEA Road Runner appreciation sociality were able to identify this person and published full details of the individual. Information revealed included:- Name. Address. Place of Work. Photographs. Result: Professional Embarrassment Theoretical

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 21 Facial Recognition Nigerian Scammers use facial recognition software to profile members of the US Armed Forces from photos found on various websites. Using this information, they set up numerous fake(real) profiles on dating websites to lure unsuspecting women. Once they had a target, they would scam money or goods out of them, in total, over $1 million. The end result was the Soldiers getting arrested for fraud causing them great embarrassment. The charges were initially dropped but the damage had already been done. Result: Professional Embarrassment / Reputational Damage Real World

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 22 MetaData Metadata revealed viewing Document Properties Author Last Saved Dates How Long Editing Company How many revisions Computer ID Domain/User details Full path of document Hidden information contained within documents, files and images, this data can contain personal or business information. Some examples of metadata that may be stored in your files:- Your name. Your company or organisation name. Email Addresses. The name of the network server or hard disk where you saved the document. Other file properties and summary information. The names of previous document authors. Document revisions. Hidden text or cells. Comments. DRM Information including certificate. Details of the camera used. URL Details. GPS details.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 23 MetaData A member of the ACMEA Royal family was having new press shots taken. Due to the hot ACMEA climate and lack of open green space or beaches, the family member traveled to a neighboring country to take the needed pictures. When questioned about the where the pictures were taken the Royal stated My one true home, ACMEA and then went on to state that they have never set foot in foreign lands. Through analysis of the Metadata it was found that the GPS coordinates were recorded and showed the picture was in fact taken in lands other than ACMEA. This caused major embarrassment to the Royal family. Result: Reputational Damage / Information Disclosure Theoretical

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 24 MetaData BHP one of Australias then biggest companies (2007). Litigation was taken against them by Papua New Guinea residents along a river which they claimed had been polluted by BHP. During the case, it became LAW in Papua New Guinea that BHP could not be prosecuted and by doing so the Lawyer and Plaintiff were committing an offence. Through examination of the legislation document it was found that the document itself had been drafted by BHP. The Law was reversed and BHP were sued for contempt of court and fined millions of dollars and lost 40% of their share value. Result: Reputational Damage / Information Disclosure Real World

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 25 Information Disclosure through Aggregation ? Family Details Photos Location Associates Interests Likes Associates Themes Interests Photos Mind Set Employer Work History Memberships CV / Skill-sets Associates Mind Set Associates Location Habits Interests Mind Set Photos Social media provides a wealth of personal and organisational information that when analysed through aggregation can be quite informative. For an Individual Full Name D.O.B. Address Family Details Phone Numbers Current Employer Friends & Co-Workers Holiday Destinations Habits & Interests Education Details Plus Much More…………….. For a Organisation Company Name Address Phone Numbers Employees Technologys In Use Required Skills Office Layout Suppliers Organisation Structure

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 26 Information Disclosure through Aggregation A prison office from HMP AMCE prison is in a dispute with a inmate, the inmate passs along the details of the prison office to his associates. The associates using the limited information and aggregated profiling, are able to identify a number of social media sites used by the prison office and his family. Information revealed included:- Family details. Personal photos. Location of their home. Result: Security risk / Coercion Theoretical

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 27 Information Disclosure through Aggregation Through the Facebook account of Sir John Sawers wife his new appointment as chief of the Secret Intelligence Service was identified, along with other sensitive information. Like many Facebook users Shelley Sawers privacy settings were not correctly configured and meant anyone in the open-access "London" network could view her updates. Information revealed by her included:- Family details. Personal photos. Location of their home. Result: National security risk Real World

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 28 Authorised/Official? How can you tell if the message, tweet or blog has come from the source it says it has? The source of a message may look and feel official but this is no guarantee, that it is. Many famous brand and individuals have numerous account on social media some run by them officially, and some not so. Can you tell the difference? BP_America @Twitter BPGlobalPR @Twitter ExxonMobile@Twitter ExxonMobil@Twitter American Airlines@Facebook American Air@Facebook In an effort to try and prevent this, some companies have taken to registering all possible derivatives of their name/brand and some have taken a different approach…

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 29 Account Impersonation An official looking account for the ACMEA Tax Office is created by a hostile group. These account starts issuing messages and tweets stating that a new form is required, and they provide a link to download the new form. These messages are re-tweeted by well meaning and/or infected systems spreading the word further and increasing the legitimacy through weight of numbers. Due to the belief that this is an Official account the ACMEA Tax office is held accountable by the general public for infecting systems with Malware. Result: Reputational Damage / Malware infection Theoretical

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 30 Account Impersonation Earlier last week Russian opposition leader Alexei Navalny, official twitter account was compromised and used by the attacker to send offensive content to more than 258,000 of his followers. The attacker created multiple tweets and photo posts with the apparent aim of discrediting Mr Navalny, by posting inflammatory and degrading comments on his account. Due to the offensive nature and large amount of tweets, Mr Navalny followers dropped as people unlinked him to stop the tirade. Result: Reputational Damage/ Professional Embarrassment Real World

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 31 Targeting Social Media As you have seen, the more information about an individual or an organisation the easier it is for an adversary to develop a clearer operational picture and find easy points of attack. Social networking sites are becoming one of, if not the, single most effective resource for an attacker when developing targeted attacks, such as spear phishing or social engineering. Through these sites it is possible to easily identify a particular company, profession, or user. Once information or data has been posted then there is little capability to monitor or protect against the aggregation of many small pieces of non-identifiable data becoming personal identifiable information. How can you or your customers tell the difference between legitimate information, Vs. bogus or fraudulent posts? Much of the information posted on social media sites has the ability to contain malicious content directly or via a link that can exploit a system. -Worst of all these links will most likely be received from someone you know.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 33 Why Use Social Media More and more corporations, businesses and governments are looking at utilising social media as part of their core business, those that already use it are looking to expand their capability over the next twelve months. The main reasons that social media has proven effective in this area are:- Compelling and relevant content can grab the attention of potential customers and increase visibility. You can respond almost instantly to developments and become heard. It can be much cheaper than traditional advertising and promotional activities. Social content can indirectly boost links to website content by appearing in universal search results, improving search traffic. You can deliver improved customer service and respond effectively to feedback. Customers can find you through new channels, generating greater information flow. Excellent recruiting tool for employment opportunities.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 34 Benefits Of Social Media Studies have shown that Government use of Social Media allows greater interaction with the public by reaching a larger audience, and publicising items faster traditional media channels. Thus allowing the public to receive the information instantly. Further benefits of using Social Media include:- It can provide greater transparency. Allows departments to reach citizens wherever they are. Provides easier access to services and information for citizens. Enables internal collaboration. Allows for information sharing with external partners or contractors. Harnesses the ideas of the public to support your mission. Increase governments access to audiences and improve the accessibility of government communications. Enable government to be more active in its relationships with citizens, partners and stakeholders. Increase the speed of public feedback and input. Reduce governments dependence on traditional media channels and counter inaccurate press coverage quickly.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 35 Using Social Media Social Media sites do not always have to be external on the internet, they can just as easily be used within large departments from within via an Intranet. This means that data with a greater protection level can still be shared with colleagues quickly and easily. Documents can be updated and shared with colleagues in real time rather than sending to multiple people then collating their responses. UK Government currently has 4 private social networks, these are:- Civil Pages (https://pages.civilservice.gov.uk): a networking directory of around 3,000 users and 28 communities. It allows users to find colleagues, showcase skills, share and comment on documents and create communities of interest.https://pages.civilservice.gov.uk CivilBlogs (http://blogs.gsi.gov.uk): a personal publishing tool to enable sharing of work experience, knowledge and thinking across GSI through the setting up of blogs.http://blogs.gsi.gov.uk Civil Wiki (http://wiki.gsi.gov.uk): a knowledge-sharing and collaboration tool for civil servants. As it is hosted on the Government Secure Intranet (GSI), it can only be viewed by those working within government. All content is generated and moderated by users, of which there are currently around 900.http://wiki.gsi.gov.uk Communities of Practice (www.communities.idea.gov.uk): a community platform to encourage knowledge sharing across local government and the public sector. It provides a secure environment for users to set up or join communities wanting to develop or share knowledge around specific issues.www.communities.idea.gov.uk

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 37 Policy and Procedures There are a number of steps and procedures that can be adopted that may help to keep your social media accounts from being compromised:- Establish a social media policy. Keep security software up to date on all devices that access social media websites. Change passwords often. Stay informed. Monitor accounts closely and frequently. Report any suspicious activity on the sites immediately. Quickly alert stakeholders and everyone in your social network of the suspicious activity. Have a contingency plan in place. Protect yourself from the inside. Don't allow employees to access company social media sites from outside the office. Be suspicious of anyone who contacts you out of the blue claiming to be part of one of the networks you are a member of.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 38 Security Countermeasures There are also software/devices/services that can play a role in preventing security breaches via social media:- Data Loss Prevention (DLP) This would help prevent most information that should not be made public from being uploaded to Social Media websites, thus helping to reduce Information Leakage. Digital Fingerprinting By embedding information within Corporate media, particularly images, the image can be tracked if copied and used on a malicious website. This can provide early alerting and allow action to be taken. Central Management This would help to keep control of the content being published and also provide a consistent name, look, feel and message thereby reducing the risk of account impersonation. A further related benefit is a reduction in the costs associated with operating Social Media.

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 40 In conclusion The risks from social media are real:- For you. For your organisation. Social Media can be used from a corporate perspective and has many justifiable benefits. Trends suggest that attackers will use Social Media increasingly for their malicious activities in the future. Social Media is a powerful tool in the corporate arsenal. Dont assume your information is protected. Consider the risks of exposing too much information through aggregation. Both employers and jobseekers will progressively use Social Media for both advertising or finding job opportunities. Consider the risks of embedded or shared data (GPS, Metadata, etc.):- Photographs. Documents. Dont stop using social media … Just make sure you use it safely!

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 43 References InSites Consulting (http://blog.insites.eu/)http://blog.insites.eu/ Microsoft Security Intelligence Report (http://www.microsoft.com/security/sir/archive/default.aspx)http://www.microsoft.com/security/sir/archive/default.aspx Pew Research Center (http://www.PEWInternet.org)http://www.PEWInternet.org Sophos Social Media Threats (www.sophos.com)www.sophos.com Symantec Social Media Protection Poll (http://www.symantec.com/about/news/release/article.jsp?prid=20110721_01)http://www.symantec.com/about/news/release/article.jsp?prid=20110721_01 The Social Skinny Survey (http://thesocialskinny.com/100-more-social-media-statistics-for-2012/)http://thesocialskinny.com/100-more-social-media-statistics-for-2012/ UK Govt Cabinet Office (http://www.cabinetoffice.gov.uk/sites/default/files/resources/Social_Media_Guidance.pdf)http://www.cabinetoffice.gov.uk/sites/default/files/resources/Social_Media_Guidance.pdf Wikipedia (http://www.wikipedia.org)http://www.wikipedia.org

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social.

Similar presentations

Presentation on theme: "© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social.

Similar presentations

Presentation on theme: "© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The Risk of Being Social."— Presentation transcript:

Similar presentations

About project

Feedback