Social Media Policy

What Is Social Media Policy?

A single enthusiastic post can hand an attacker their reconnaissance. A colleague announces a new partner project on a professional network, naming you, the partner, the toolkit and the deadline. Days later a phishing email arrives that knows all of it. You follow the link, enter your credentials and get a security alert. Then you trace the red flags you missed, connect the email's details back to the post, and report the attack.

What You'll Learn in Social Media Policy

• Identify types of corporate information that should not appear on personal or professional social media profiles
• Evaluate social media posts for operational security risks including location data, org charts, and technology details
• Trace the details in a targeted phishing email back to the public post they came from
• Recognize how attackers mine public social media profiles to build pretexting scenarios for targeted attacks
• Apply your organization's social media policy to ambiguous situations where personal expression and corporate risk overlap

Social Media Policy — Training Steps

1. Welcome to Catalyst Innovations

   It's a regular Wednesday morning. You've settled into your home office and are about to check your messages.

2. A Message from Mark

   Alice's phone buzzes with a Telegram notification from her colleague Mark Chen, a senior developer on the team.

3. Mark's LinkedIn Post

   Curious about what Mark shared, Alice opens LinkedIn on her desktop to find his post.

4. What Mark Shared

   Mark's post is enthusiastic, but take a closer look at what information he has publicly revealed.

5. An Email from TechForge

   Five days have passed. Alice receives an email apparently from TechForge Solutions about the Project Helios collaboration.

6. Clicking the Link

   The email looks legitimate - it references Project Helios, mentions Mark by name, and knows about the Q2 deadline. Alice clicks the link to access the partner portal.

7. Logging Into the Portal

   The partner portal asks Alice to log in with her work credentials.

8. Authentication Error

   The page shows an authentication error. That's strange - Alice is sure she typed her password correctly. A knot forms in her stomach. Why isn't it working? She decides to wait and try again later, but the uneasy feeling lingers.

9. Something Is Wrong

   Two hours later, Alice receives an urgent email from the Catalyst Innovations Security Operations Center.

10. The Sender Domain

    Alice realizes what happened. Let's go back to the original email and examine the red flags she missed. First - the sender's email address.