TikTok Bans and Twitter Volatility: Mitigating Social Media Security Risks
Editor’s note: Social media announcements are unfolding quickly with impactful changes taking place in real-time. The below information was assessed prior to 9 a.m. ET, Monday, December 19, 2022.
Social media volatility has been flooding national headlines for months. Between the United States Senate’s recent vote to create a TikTok ban on government devices and Twitter’s ongoing instability, how brands interact via social platforms is top of mind. Social media platforms present tremendous business opportunities, but they also create a large, unregulated attack surface, the risks of which cannot be ignored. And, while social media evolution is not new, the rate at which we’re seeing significant changes is cause for concern from a security perspective.
TikTok
What happened?
On December 14, the U.S. Senate voted on a TikTok ban from government devices due to national security concerns. This vote comes on the heels of state government TikTok bans in Alabama, Maryland, Tennessee, Texas, and Utah that prohibit use of TikTok on state government devices and networks due to similar security concerns.
Why does it matter?
Despite its worldwide popularity, controversy has followed TikTok since its introduction. Three years ago, a researcher commented on social media that he had reverse-engineered the TikTok app, warning readers that “TikTok is a data collection service that is thinly-veiled as a social network.” His analysis was amplified by several media outlets, and the cybersecurity community has continued to warn individuals and organizations about significant social media risks associated with using the Chinese video-sharing platform. The FBI has expressed national security concerns regarding TikTok as recently as last month.
While TikTok executives have claimed they haven’t and wouldn’t share U.S. user data with the Chinese government, Chinese laws can compel companies to do so and it is widely accepted in the cybersecurity community that the business risks around this type of data exploitation cannot be overstated.
What can you do?
Much like any threat related to data loss, physical, or cybersecurity, the best course of action is to limit exposure to tools that are not critical to business operations. In the case of TikTok, a Chief Information Security Officer (CISO) may want to take a strong position to greatly reduce social media risks. But, as TikTok may be a key component to a company’s social media strategy, a Chief Marketing Officer (CMO) may have significant interest in continued access and use. We recommend:
- In conjunction with social media business stakeholders, create a corporate policy for official and employee use of social media, including TikTok.
- Monitor TikTok for references to your company and its interests, likely through the use of a third party vendor who can automate this capability to meet demands for scalability.
- Train the workforce, including leveraging outside experts, on how personally identifiable information (PII), pattern-of-life, and personal interests can be leveraged to conduct social engineering or cyber and physical attacks.
What happened?
In the past six weeks Twitter has cut its workforce in half (including security team members and engineers), lost its CISO and Chief Privacy Officer, bid farewell to its former Head of Trust and Safety, and disbanded its Trust and Safety advisory group just before their first official meeting. There are now even questions about who will lead the platform all together after Elon Musk launched a poll on Twitter asking Twitter users if he should step down, claiming he will abide by the results.
Twitter has been plagued with impersonation accounts, additional mass employee exoduses, upticks in hate speech, advertiser losses, and rapid-fire policy changes that create instability and erode Twitter’sbrand trust.
Why does it matter?
Twitter users are more vulnerable to scammers, cyberattacks, and mis-, dis-, and mal-information because reduced resources for content moderation have made it easier for adversaries to deploy unsophisticated but effective tactics, targeting brands and their customers.
What can you do?
Social media turmoil presents security risks to your brand, business, and people. Connecting with users across a democratized space that increasingly includes threat actors and fraudulent content requires actions to mitigate social media risks while maintaining the benefits of social media engagement. We recommend:
- Create and publish a policy that clarifies how you will and will not communicate with customers; making it easier for your audience to recognize impersonation scams.
- Monitor your brand’s external attack surface in real-time with technologies that scale monitoring across social media, spoofed websites, and other threat infrastructure.
- Adopt automation tools to – or work with third parties who can – rapidly detect and take down impersonations that pose threats to your brand.
Protect Your Social Media Presence from the Outside-In
As social engineering scams like phishing and impersonations proliferate across social media, platform instability increases the potential harm they can cause. What we’re seeing with TikTok bans and Twitter volatility reinforces the importance of brand protection when even the most responsible of social media platforms are limited in how much they can safeguard your brand. Social media’s populated attack surface attracts opportunistic cybercriminals, and whenever you have brands, customers, and adversaries interacting in the same space, proactive security measures are critical. Businesses need visibility in real-time into their external attack surface which includes social media and other digital platforms, and the ability to disrupt or takedown threats before they can cause damage. This is why a comprehensive social media security strategy is crucial.
For all its flaws, social media offers many business benefits, and jumping ship creates its own security vulnerabilities. Critical business functions, such as customer service, web development, content distribution, community building, can all be made more successful through the use of social media. So, by all means, be present on social platforms… as long as you can outfox threat actors with strong social media security practices.