jump to navigation

Managing online “Reputational Risk” August 24, 2011

Posted by Chris Mark in InfoSec & Privacy, Piracy & Maritime Security.
Tags: , , , ,
add a comment

In today’s world of near instant communication, and social media, it is easier than ever to get information to the world.  Companies would be well advised to consider employing such technologies as they often provide a very good return on investment.  Like many technologies, social media is a double edged sword and must be managed.  Companies can be exposed to many forms of risk including that of “reputational risk”. What is “reputational risk”?  Simply it is a risk to an organization (or person) which derives from a negative association to the brand.  This can be brought on by an executive saying or doing something illegal or an employee voicing a seemingly innocuous statement in what they believe is a private setting that gets forwarded and distributed.  Many Gen X job seekers are learning the hard way that their Facebook pictures of keg stands and Mardi Gras flashing follows them to their interview.  Companies are much more savvy in searching out indiscretions on social media.  The same holds true for companies and their executives.

I am constantly surprised by how little corporate executives seem to understand about the Internet, social media and how easy it is to find information.  In today’s age it is important that company’ have social media policies in place to ensure that 1) OpSec is not being compromised by an employee inadvertently giving away secrets and 2) reputational risk is being managed by ensuring employees understand that everything they do online is publicly available.

All employees should understand that everything they post online is accessible for perpetuity.  While it is certainly every person’s right to have their own views on politics, sexuality, religion, and other topics, posting these views may irreparably harm the very company for which they work.  It should be noted that the level of reputational risk exposure is directly proportional to the person’s role within the company.  A junior level employee that rails on about their views on gay marriage may harm their own reputation in some areas but likely will have less impact than a CEO who rails on about his dislike of women in the workforce.

Recently, I was doing some research on some companies and I found the CEO of a company that listed as his favorite quotation: “F@#K All”.  As a former Marine and Sailor I am not offended by colorful language but I question the professionalism of a CEO publicly listing his favorite quotation as something so patently offensive to so many people.  What is more disturbing is that this quote was not referenced once but many times in various places throughout the Internet (as were other things).  I am sure that this particular person felt his railings had been archived and deleted over time but, as stated previously, it is relatively trivial to find information that is believed to have been long deleted.

To protect yourself and your company from reputational risk follow these simple guidelines:

1) Operate with the belief that anything you post online is there “forever”. While the average user may not be able to retrieve some information, there are some people that can access nearly everything…and can repost.

2) Don’t post anything patently offensive.  While we all have our own political, religious and other beliefs, they may not be in line with our employer’s.  While most companies are tolerant (there are laws that protect expressions) of such beliefs, understand that patently offensive statements can harm the company and your employment.

3) Don’t say anything that is patently offensive.  Remember that this is 2011 and not 1988.  Calls are recorded ‘digitally’ which means they are easy to retain, repost, and republish.  If you are angry at someone, don’t call and record drunken, profane threats.  They are preserved forever (see #1).

4) Be aware that as an officer of a company there are likely people tracking your public online actions in near real time.  This means that if you twitter something and then immediately ‘delete’ it is still captured.   Look at all of the US athletes and actors that have ‘tweeted and deleted’ only to have the press have the original tweet.

Certainly some are reading this post and saying: “this hits close to home”.  It should.  Follow the simply rules above and you can manage online reputational risk for you and your company.

 

 

Security 101: The Human Element – “Trust but Verify” August 24, 2011

Posted by Chris Mark in InfoSec & Privacy, Risk & Risk Management.
Tags: , , , , ,
1 comment so far

As maritime security becomes more lucrative and companies to steps to stop attacks, it is the natural evolution of crime that the pirates will begin looking for new vulnerabilities to support their efforts.  Often the most vulnerable element of any security strategy is the human element.  People often provide the proverbial ‘weak link’ in the strategy.  Often it is not an intentional act by a person that creates and issue.  It could be a simple mistake or the person could be deceived into taking action.  While these are common aspects of security today I want to talk about people that take direct action with intentions that are contrary to the organization.  It not something that any company likes to consider but it is an unfortunate fact of life.  People are rational actors and as such a percentage of any population will be inclined to perform actions that are outside the bounds of what are considered by most to be ethical or moral behavior.   This is where the idea of “trust but verify” comes in.  We all like each other and we all want to believe that we are all honest people.  It is irresponsible however, to simply take people at their word.  It is responsible and appropriate given my access to information.  It is obvious that with increased responsibility comes increased authority.  Often this leads companies to believe that these senior “trusted” individuals do not require the same level of monitoring to which more junior level employees may be subject. This is a serious mistake.  Increased responsibility and authority comes with increased access to information.  It is often these very employees that can do the greatest damage.  I will give an example from my own experience.

Recently through some legal proceedings it was discovered that a former Chief Technology Officer of a company I previously owned had taken steps to download every single employee and contractor’s email to his personal system.  When confronted at the proceeding, he admitted he had indeed downloaded very email.  He then took a number of steps to hide his actions.  His actions were only discovered 2 years later through legal proceedings.  He has not divulged why he took such action.  It should be noted that in many states in the US this is not only a crime but is a felony.  This was not a junior level employee who could plead ignorance.  This was a person with a graduate degree in information security who, by his own admission, “defines security and risk”.  To say I was apoplectic when I discovered his actions would be an understatement.  He not only violated the trust of the company and me personally, but potentially committed a serious crime.  The point of this example is to demonstrate the need to “trust but verify” what ALL employees are doing.

Operational security, or OpSec, is increasingly important in a hyper-competitive world.  Add to that the new threat of information theft by pirates and those supporting piratical acts and the need to protect your information and assets becomes critical.  It is not only the junior level staff that should be monitored and ‘verified’, it is all employees.  Anyone with a security clearance is used to the fact that every few years the Gov’t decides to crawl through your life and put you through a polygraph to ensure that you are still ‘trusted’.  This is a good example of ‘trust but verify’.   When developing a strategy to address information security, and operational security, it is important that all areas of the business are considered and addressed.  Often it is a single trusted person that cause irreparable  harm to the organization.

Somali Pirates using Blogs and GPS to Hunt Ships June 23, 2011

Posted by Chris Mark in InfoSec & Privacy, Piracy & Maritime Security, Risk & Risk Management.
Tags: , , , , , ,
add a comment

Consistent with industry expectations, Somali pirates are increasingly turning to high technology to hunt high-value ships.  According to Techland, pirates are using GPS, as well as social media such as shipping company blogs to identify and hunt ships for attack.  According to an article in Fast Company:

“In addition to random attacks on cargo and passenger ships, Somali pirates are increasingly relying on the use of GPS systems, satellite phones, and open-source intelligence such as shipping industry blogs in order to figure out the location of ships. Much of the technological infrastructure used by the pirates is allegedly located in the Somalian city of Eyl, which has been described as the ‘piracy capital of the world.’

It is paramount that shipping companies recognize the new threats and understand that the protection of vessels and their crews extend beyond physical security and armed guards.  Ensuring that operational security processes are employed is as important, if not more important, than simply arming ships.  A review of the maritime security industry show a distinct lack of expertise in information security.