social media: an internal audit reality · 2018-11-05 · •social media hackers. currently,...
TRANSCRIPT
Social Media: An Internal Audit Reality
Presented by:Joe Schmidt, Manager
Stephen Chasser, Experienced Consultant
Moderated by:Sara O’Banion
TODAY’S PRESENTERS
Stephen Chasser Experienced Consultant
Columbus
Joe SchmidtManagerCincinnati
Agenda
Social Media – An operational perspective
•Overview
•Social media objectives
•Social media risks
•Internal audit response/approach
•Examples
Social Media’s Impact on the World
Overview – Social Media Impact
Social Network – a network of social interactions and personal relationships
Social Media – websites and applications that enable users to share content/participate in social networks
• Societal Impact• Increased transparency• Information availability
2018 Study, Pew Research Center
• Corporate Impact• Corporation Customer barriers• Platform economy• Social media linkages
2.62 billion global social media users
in 2018 (34% penetration)
By 2021; mobile e-commerce = 54% of all online sales
Facebook Ad revenue in the US
> total print ad spending by 2019
2018 Study, Forbes Magazine
Overview – Social Media Impact
Corporate Objectives
Corporate Objectives
A corporation’s social media objectives should be measurable and trackable.
• Brand Awareness• Number of consumers being exposed to the brand• Developing a brand reputation• Increase the size of social networks and communities
• Monitor consumer activity and feedback
• Social followers new business
Risks Inherent in Social Media Use
Social Media Risks
Brand and Reputational Damage• Speed of information and
organizational transparencyare main factors
Social Media Risks
Compliance •NLRA (National Labor Relations Act) Section 7• Gramm Leach Bliley Act (GLBA)• Financial Industry Regulatory Authority (FINRA)
Outsourcing Social Media Activity
Social Media Risks
Information Leakage• Sensitive and important information
open to the public• Customer information, intellectual
property, M&A, etc.
Lack of Governance
• IT oversight
• Corporate strategy
• Goal consistencyGreenfile Developments
Internal Audit Response & Corporate Social Media Policy
A Risk-Based Approach
• Develop controls to mitigate risks
• Educate personnel
• Periodically validate effectiveness of controls
A Risk-Based ApproachImportant Internal Audit responses
Brand damage• Help to develop an organization-wide social media policy• Policies should be established for personal and company
social media accounts• Crisis management plan(s)
Compliance• Educate personnel on applicable regulations and laws• Develop procedures consistent/perform gap assessments
A Risk-Based Approach
Important Internal Audit responses• Third Party Risk and Information Leakage• Loss prevention• Strict third-party selection criteria• Evaluation of third-party’s business and
control environment (SOC reporting)
Operational/Effectiveness Audit• Are objectives being met?•Utilize metrics (ROI/KPIs)
Overview – Drivers
Business Awareness
Business/ Employee Productivity
Employee Education
Acceptable Use
Business Awareness
What is Business Awareness?Visibility and security controls/ policies in place for all levels of business. In addition to company social media presence with access to those accounts.
What is the value?Prevention of phishing, posting and additional risk leading to exposure of company information exposed to the public.
What is the scope?Frequently viewed as though personal communication tool rather than a business platform, risk monitoring & governance, employee security awareness and corporate security policies.
What restrictions are used? A two sided approach, establishing user usage restrictions and company monitoring of social media platforms where there is a presence.
Business Awareness
Enterprise Social Media
Accounts
Administration Posting
Social Media Accounts
Management
Monitoring User Posts and
Comments
Monitoring Employees
Posting
Administrations Role
Security Administration
User Population
Controls & Restrictions
Social Media Account Administration
Single Point Posting
Company Endorsement
Controls & Restrictions
Social Media Account Administration
Company Endorsements
Company Responses
Removal of Defamatory Content
Monitoring Account Activity
Monitoring Account Activity
• Centralized promotion and sharing through the established social media account.
• Responding and resolving customer responses on social media.
Company Monitoring
• Having visibility to the employee user social media accounts.
• Controlling the content that is posted by the employee that may impact the company.
Employee Monitoring
Employee Accountability
Acceptable Use
• Having a clear and established policy for the rules and behavior of the employee
• Employee acknowledgment of the Acceptable Use Policy
Employee Education
• On going security awareness training, through annual classes or staging phishing attempts approved by management, internally
• Receiving a conformation that the training was successful
Accountability
• Empowering the employee to report any issues that are discovered
• Recognition of possible issues they notice or report
Exploits Through Social Media
• Social media hackers. Currently, according to in depth statistics, there are more than 3 billion active social network users worldwide. They use links on social media to direct you to download virus, these links may be disguised as ‘like’ buttons or links to other pages. Attempts are also made to acquire information through social media such as usernames and passwords
• Average time to detect a malicious or criminal attack by a global study sample of organizations was 170 days.
• 98% of tested web apps are vulnerable to attack.
• Only 38 percent of global organizations claim they are prepared to handle a sophisticated cyber attack.
Exploits Through Social Media
• Experienced DOS attacks
• Discovered malicious code and botnets
• Experienced phishing & social engineering attacks
• Percentage of companies that have experienced web based attacks
68% 62%
51%59%
Conclusion
How do we protect ourselves from Social
Media Exploits?
