Here are some tips to help administrators to mitigate such cyber risks in 2023.

1. Delete old irrelevant information in direct messages and draft folders
   People often use corporate social media channels to write directly to brands, asking for help, using the account holder’s product or service. Also, some partnerships, such as those with bloggers, can be negotiated in direct messages. The personal or financial information that is shared in these conversations could remain in the messages folder long after the interaction. In the event of a breach cybercriminals can harvest such information.

   To avoid this risk, delete irrelevant messages when the dialog has ended, and the information it contains is no longer relevant. The same applies to posts: regularly review what is saved in the drafts folder from time to time.

2. Review old posts to minimize reputational risks
   Every word, action, and decision posted in social media can either help or harm the company’s image. When sensitive information (re)appears in public, it almost always ends up hurting a firm’s reputation and could incur financial losses

   To be on the safe side, spend some time reviewing already-published posts and check for old information that does not fit into the current reality — anything from inappropriate jokes to controversial advertising campaigns.

   What was normal yesterday, can cause a negative public reaction today. A review of publications made over the past few years can help reduce related reputational risks.

3. Be careful posting your success stories
   Having signed a lucrative contract or reached a deal, we want to post it on social media to tell as many people as possible about our success. But we really need to be aware of unwanted cybercriminals’ attention. If a potential attacker knows who your suppliers or contractors are, they could try to conduct an attack impersonating them or breaching their accounts and acting on their behalf.

   Moreover, the clearer you reflect your organization’s structure and working methods on social media, the easier it is for perpetrators to organize a BEC or other type of attack.

4. Warn newcomers
   After getting a new job, newcomers usually share the news on social, but they may not yet understand how cybersecurity processes are built in the organizations, such as how identification works or with whom they can share sensitive information. Therefore, newcomers are more vulnerable to social engineering attacks.

   Cybercriminals may impersonate the firm’s IT administrator to write to a new employee to divulge a password on the pretext of some technical requirement. It is highly likely that newcomers will share the password because they do not know that the administrators would never make such requests. Moreover, new employees may hesitate to ask their colleagues if the letter is authentic. A tiny little post on social media may just turn the employee into an entry point for cybercriminals.

   To mitigate the risk, offer newcomers a course on information security immediately.

5. Control account access and weed defunct profiles
   Logins, passwords, and access to the email address are used to create a social media account are just as valuable as other internal corporate documents. When an employee with access to accounts and authentication data leaves the company, it is useful to apply the same rules as when blocking their access to the corporate network.

   To begin with, change the password for the e-mail account linked to the corporate social network; then unlink the ex-employee’s mobile phone number and check other authentication methods; for example, a spare mailbox.

6. Secure social network accounts with multi-factor authentication
   Multi-factor authentication is an absolutely necessary setting for any type of account.The email address linked to the corporate social media account should be as protected as the social media account itself.

   Often the attack begins with an initial access to e-mail. After breaching an account, an attacker can configure filters in the mailbox settings to delete all support emails from the social network. Users will not be able to restore access to their account, because all emails will be deleted automatically. Not to mention that in a stressful situation we will not be checking which filters are currently configured in our mailbox.

   Also, it is best to register a social media account using a corporate e-mail address. To begin with, it is better protected (assuming the firm cares about cybersecurity). Furthermore, in-house security specialists can block access to this mailbox along with all access to the corporate network.

7. Train staff on phishing threats
   Even tech savvy Gen Z staff succumb to sophisticated social engineering techniques. The human factor cannot be reduced to zero, but it can be minimized with the help of continual dedicated training.