Update on enterprise social media risks
2 likes•1,049 views
The document outlines the increasing interest in social media among enterprises and the associated risks, particularly regarding the exposure of confidential information. It presents strategies for mitigating these risks, emphasizes the need for effective privacy policies, and discusses the dual nature of risks related to employee and consumer interactions on social media. The document also highlights the importance of transparency and responsible management of personal information in the context of social media use by organizations.
Update on enterprise social media risks
- 1. Social Media Risks to Enterprises Constantine Karbaliotis Data Protection & Privacy Lead
- 2. Session Description • Social media and software are of increasing interest to both private and public sector organizations. While these technologies offer exciting new opportunities to share information and to interact with customers, they also represent a new area of risk for the exposure of confidential and personal information. Get an update on the changes being brought about by social media in response to regulators’ and consumers’ concerns, and learn the latest strategies for minimizing risks to organizational security and reducing liability. Social Media Risks to Enterprises - Constantine Karbaliotis 2
- 3. Agenda 1 Introduction 2 Enterprise Uses of Social Media 3 Enterprise Risks from Social Media 4 Strategies and Tactics 5 Case Study 6 Conclusion/Q&A 3 Social Media Risks to Enterprises - Constantine Karbaliotis
- 4. Introduction Social Media Risks to Enterprises - Constantine Karbaliotis 4
- 5. What is Social Media? • “Social media” includes: – social networking (Facebook, MySpace) – blogging (WordPress, Blogger, TypePad, etc.) – wikis (Wikipedia, Wikia, etc.) – microblogging (Twitter) – business or technical networking (LinkedIn, Spoke) • in short, anything that can be considered user-generated content Social Media Risks to Enterprises - Constantine Karbaliotis 5
- 6. Generation Y/Millenials “Who uses e-mail anymore? – that’s old school!” • Demand … – 42% of office workers between the ages of 18 and 29 discuss work-related issues on blogs and social networking sites (YouGov) – 50% of surveyed organizations indicate that at least 30% of their network bandwidth is being consumed by social networking traffic (Forrester) • And supply … – It is estimated that nearly half of all web developers are already using AJAX – 66% of surveyed organizations indicate that Web 2.0 is essential to maintaining their company’s market position (McKinsey) Social Media Risks to Enterprises - Constantine Karbaliotis 6
- 7. Social Networking in the News… • Canada takes lead role in Facebook privacy issues – Discussions between Facebook Inc. and the Office of the Privacy Commissioner of Canada (OPC) over the social networking site's compliance with Canadian federal privacy law are moving along smoothly, according to spokespersons from both sides. .. Privacy Commissioner Jennifer Stoddart found Facebook in violation of the Personal Information Protection and Electronic Documents Act (PIPEDA). Canada is now recognized as the first country in the world to issue legally binding recommendations to the social networking site. (NetworkWorld, August 21, 2009) • Is Internet privacy dead? No, just more complicated: researchers – The numbers tell one story: With 10 billion Tweets sent and 400 million Facebook users signed, people clearly want to be heard and seen and able to hear and see others on social networks. But Internet users also care about privacy, according to experts. Particularly when they feel like they’ve lost control of their personal information. That is when trust is broken. (Washington Post, March 15, 2010) • Privacy watchdog takes issue with Google Buzz – Canada's top privacy watchdog is taking aim at another international tech titan.Less than a year after its investigation spurred sweeping privacy changes at Facebook, the Office of the Privacy Commissioner of Canada is now looking into complaints that Google Inc.'s new social networking tool, Google Buzz, might run afoul of Canadian privacy standards. (Vancouver Sun, February 17, 2010) Social Media Risks to Enterprises - Constantine Karbaliotis 7
- 8. Privacy’s role in selling the message in the organization…. • The goal is not to stop innovation or creativity • The goal is: – To understand the risks associated with an activity; – To address them by minimizing them to the extent reasonably possible; and – for a responsible person in the enterprise to accept the residual risk. • My mantra: – Conscious acceptance of risk – No sleepwalking Social Media Risks to Enterprises - Constantine Karbaliotis 8
- 9. Enterprise Uses of Social Media Social Media Risks to Enterprises - Constantine Karbaliotis 9
- 10. Social Media and Privacy Risks • Most privacy risks not exclusive to social media sites and technology • Simply blocking these sites will not mitigate the hazards of increasingly interactive consumer Web applications • There are corporate advantages to use of social media, the most compelling of which are innovative marketing, attracting employees and providing a progressive work environment • Social media is just one part of our overall concerns about doing privacy ‘right’ Social Media Risks to Enterprises - Constantine Karbaliotis 10
- 11. Organizational Uses of Social Media • Internal Uses: – Employee social networking • External Uses: – Employee social networking – Technical and customer support – Marketing and customer data collection Social Media Risks to Enterprises - Constantine Karbaliotis 11
- 12. Content Creation • Social media can be operated by: – The organization – The organization with content provided by employees and customers – Others and used officially by the organization – Others informally – Others both officially and unofficially Social Media Risks to Enterprises - Constantine Karbaliotis 12
- 13. Behavioural Profiling • The data collected by observing what users do • Very interesting data, very valuable and at the same time, attracting a lot of negative attention from privacy regulators • One of the key reasons to set up social media sites and technologies – apart from advertising – is the generation of this behavioral information and thus targeted advertising Social Media Risks to Enterprises - Constantine Karbaliotis 13
- 14. Two main areas of risk for Enterprises: 1. Risks to enterprises of its employees using social media tools that the enterprise provides or uses (“Enterprise Social Media Risks”); and 2. Risks to enterprises from consumers using social media tools that the enterprise provides or uses, (“Consumer Social Media Risks”): Social Media Risks to Enterprises - Constantine Karbaliotis 14
- 15. Enterprise Social Media Risks Social Media Risks to Enterprises - Constantine Karbaliotis 15
- 16. Employee use of Social Media • Internal losses: Employees can - – Violate the privacy of others – Violate their own privacy • External losses: Employees can - – Can disclose confidential company information – Can create a ‘record’ Social Media Risks to Enterprises - Constantine Karbaliotis 16
- 17. Unintended Consequences : Security & Compliance • Facilitating social engineering • Additional security risk on computers • Spamware or spyware • Compromise not only their own but organizations’ security • Even legitimate toolbar tools can present data export issues Social Media Risks to Enterprises - Constantine Karbaliotis 17
- 18. Unintended Consequences: TMI •By offering TMI, employees can create awkward situations •Certain social networking communications may be seen as creating a hostile work environment and puts the company and employee(s) in jeopardy •Can lead to regulatory or legal actions against both employee and enterprise Social Media Risks to Enterprises - Constantine Karbaliotis 18
- 19. Hosting Issues •Risks also arise from choice to host internally or use third parties •Hosting internally has cost, governance and management issues associated with doing so •Third parties raise however a whole other dimension Social Media Risks to Enterprises - Constantine Karbaliotis 19
- 20. Consumer Social Media Risks Social Media Risks to Enterprises - Constantine Karbaliotis 20
- 21. Consumer Risks: Enterprises need to understand their consumers do care about privacy, but … • Behaviours contradict stated concerns about privacy • “Passwords revealed by sweet deal”, BBC News • The why: People are terrible at assessing risk • “The Drunkard’s Walk: How Randomness Rules Our Lives,” Leonard Mlodinow • Thus the duty of Enterprises as stewards Social Media Risks to Enterprises - Constantine Karbaliotis 21
- 22. Unintended Consequences: Intended versus unintended audience… •Enterprise social media sites must consider the personal risks that they may inadvertently create for their users: •Enterprises need to consider the forum that they are creating and how their consumers’ information might be used, or mis-used Social Media Risks to Enterprises - Constantine Karbaliotis 22
- 23. Unintended Consequences: The Durability of Data •Search engines also scan social media content created by users, including risks associated with ‘deep web’ search engines •Enterprise risks are considerable in the retention area of social media if not addressed through careful design Social Media Risks to Enterprises - Constantine Karbaliotis 23
- 24. Strategies and Tactics Social Media Risks to Enterprises - Constantine Karbaliotis 24
- 25. Internal Governance: Revisit and Update Privacy Policies, Privacy Notices, and Code of Conduct • Ensure your Code of Conduct addresses the risks associated with social media • Revisit policies, privacy notices/statements – do they address the risks of social media? • Train and Inform • Update employment contracts and acceptable use agreements to allow for social media Social Media Risks to Enterprises - Constantine Karbaliotis 25
- 26. Privacy Notices: Revisit Notice and Consent Informed consent is key to obtaining and using personal information in social media and elsewhere Consider use of layered notices Update and revise the terms and conditions associated with use Social Media Risks to Enterprises - Constantine Karbaliotis 26
- 27. Behavioural Profiling: FTC Principles on Behavioral Tracking 1. Transparency and consumer control 2. Reasonable security and limited data retention for consumer data 3. Affirmative express consent for material changes to existing privacy policies 4. Affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising Social Media Risks to Enterprises - Constantine Karbaliotis 27
- 28. Design Considerations: Taking the High Road in Social Media • Privacy impact or risk assessment • Notify what activities are tracked • Allow ‘opt out’ of tracking • Always link to privacy notices • Transparency Social Media Risks to Enterprises - Constantine Karbaliotis 28
- 29. Design Considerations: Taking the High Road (2) •Retention clarity •Anonymization as part of retention •Data Security •Manage search engine risks Social Media Risks to Enterprises - Constantine Karbaliotis 29
- 30. Design Considerations: Taking the High Road (3) •Preference management •Appropriate security for account •Prominent display of privacy notices and terms of use •Effective deletion of accounts and PII Social Media Risks to Enterprises - Constantine Karbaliotis 30
- 31. Design Considerations: Purpose & Data Minimization • Honestly be able to assess the value of the trade being made by your community: – Is what they’ve traded for, a fair trade? – Are they giving too much? – Do they really know all that is really intended – or perhaps unintended but likely – in relation to what they’re trading? – Are they entrusting it to an enterprise who can protect that asset properly? Social Media Risks to Enterprises - Constantine Karbaliotis 31
- 32. Design Considerations: Social Media Privacy Considerations • User names • Profiles • Uses • User account deletion • Lawful disclosure • Transfers • Complaints Social Media Risks to Enterprises - Constantine Karbaliotis 32
- 33. Case Study Social Media Risks to Enterprises - Constantine Karbaliotis 33
- 34. SymConnect: Technical Networking Social Media Risks to Enterprises - Constantine Karbaliotis 34
- 35. Social Media Privacy Policy Social Media Risks to Enterprises - Constantine Karbaliotis 35
- 36. Pseudonymity Social Media Risks to Enterprises - Constantine Karbaliotis 36
- 37. Ts & Cs Social Media Risks to Enterprises - Constantine Karbaliotis 37
- 38. Design Standards & Guidelines • Developers building social media sites – Design considerations mentioned previously • Employees using social media sites given specific direction but reminded to comply with: – HR policies – Privacy policies – Security policies Social Media Risks to Enterprises - Constantine Karbaliotis 38
- 39. Conclusion/Q&A Social Media Risks to Enterprises - Constantine Karbaliotis 39
- 40. Enterprises’ Duty as Stewards •Essential to be the ‘good guys’ in the management of customers’ data •Understanding risk in relation to your stewardship of personal information in the social media context •Act as the customer’s IT department Social Media Risks to Enterprises - Constantine Karbaliotis 40
- 41. Conclusion •What is the intent of collecting this information – no service is really for free, so what is being ‘traded’? •Be up front about what the trade is •Have in place the measures to enforce the deal •And keep in mind that transparency won’t excuse actions representing unexpected uses of personal information Social Media Risks to Enterprises - Constantine Karbaliotis 41
- 42. Thank you! Constantine Karbaliotis, J.D., CIPP/C/IT [email protected] 416.402.9873 Copyright © 2010 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Social Media Risks to Enterprises - Constantine Karbaliotis 42