Social Media and Security – Are They Mutually Exclusive?

Social media has become a major talking point in many organizations, and for good reason. There are plenty of horror stories around the phenomenon and the risks have been widely discussed. They include the possibility of introducing malware via third-party applications, security issues resulting from information leaks, legal concerns over issues such as bullying, discrimination and stalking, and damage to corporate reputations as a result of employees’ postings.

There are less obvious risks too. For example, it’s likely that, even in companies where a ban is in force, managers are in a position both to flout it and to reveal company secrets.

What can you do? Banning access is the obvious, knee-jerk response, but it’s not as simple as that – nor is it in most cases even possible. The number of devices to which people now have access means that it’s simply not possible to ban Facebook et al, even if it were desirable. And fears that people will waste company time on Facebook rather than working is likely to be more of a management issue: if some people aren’t motivated to do their jobs, then banning Facebook is likely to drive them into finding something else with which to occupy their time.

Instead, the answer is to embrace it – cautiously. There are departments, such as marketing, which absolutely need access to social media. This is the first opportunity to be grasped. Your customers are likely to be using social media too, so this is an ideal opportunity to make connections, promote the company’s name and products, and learn more quickly what customers are thinking, which in turn can provide a competitive edge.

What’s needed to back this up is a social media policy. This should state clearly what the purpose of the policy is – for example, to promote the company and its products and services – and to explain under what circumstances using company time and equipment to access social media sites is acceptable.

More tricky is what employees can and can’t say about the company when they’re not at work. Here it’s a good idea to be explicit about the things that people clearly shouldn’t be saying about the company and other employees – such as being defamatory, discriminatory, obscene and so on – that they shouldn’t disclose confidential or proprietary information, and that, when they mention the company online, they must disclose their relationship with the company.

Ultimately, you need to rely on the common sense of your employees, and to remind them that internet postings endure, and that they must bear that in mind when posting.

Thanks to NetIq for the article.