GreyCastle Security presentation from smAlbany 2013

1. People Hacking
with Social Media
Reg Harnish,CISSP, CISM, CISA
ChiefSecurity Strategist
GreyCastle Security
Rose Miller, SPHR
ChiefExecutive Officer
PinnacleHR
JoanmarieM. Dowling,Esq.
DowlingLaw, PLLC
July 17, 2013

2. • Who am I?
• Who is GreyCastle Security?
• What are we doing here?
Introduction

3. Social Media
Security Challenges

8. Butwhatabout…

12. rharnish@greycastlesecurity.com
What’s in an e-mail
address?

13. People are
not awesome
Copyright Universal Pictures All Rights Reserved

14. People who care: here they are

15. Compliance regulations

16. Social Media
Horror Stories

20. Social Media
Security Solutions

21. 1. Operationalize security

22. 2. Implement
a policy

23. 3. Train relentlessly

24. 4. Test relentlessly

25. “Everybody has a plan until they get
punched in the face.”
- Mike Tyson
5. Plan for the worst

26. “We’ve been on a lot of
adventures together,
and it seems like you
haven’t learned
anything.
Anything.”
- Alan

27. Social Media:
Old Rules,
New Game

28. About Dowling Law, PLLC
• Dowling Law, a labor and employment boutique firm,
provides strategic legal advice and representation to
private-sector employers in Tech Valley and across New
York State.
• Joanmarie M. Dowling, Esq., is an attorney and founding
member of Dowling Law. Joanmarie counsels and
represents employers of all sizes, with a special focus on
small to mid-size companies and not-for-profit employers.
Joanmarie also currently serves as Vice President of the
Capital Region Human Resource Association.

30. The Applicant
You are about to hire a new
salesperson.
Before you make an offer,
should you:
conduct an internet search
for the applicant’s name and
background information?
check the applicant’s
Facebook, LinkedIn, and
other accounts?
request the applicant’s
social media account user
names and passwords?

31. The Salesperson
One year later, your assistant informs you that your
salesperson recently set up a website with your
company’s name and logo prominently displayed.
On that website, he has been complaining about your
company and its commission plan - and insulting
your management style as “boorish” and
“incompetent.”

32. The Salesperson Strikes Again
This same salesperson has been
posting derogatory comments about
your assistant on his Facebook
page.
She believes he is retaliating against
her because she refused to go out
with him.

33. On the Way Out the Door
Before you even had an opportunity to speak with your salesperson, you
receive a terse email from him, advising you that he is leaving your
company effective immediately. You breathe a sigh of relief… but your
relief is short-lived.
The next day, you see that your former salesperson is soliciting your clients
for a competitor, using LinkedIn contacts and Twitter followers you helped
him develop while he was your employee.
Are those contacts and followers property of your company?
Would communication to these contacts violate your former
salesperson’s noncompetition and nonsolicitation agreement?

34. Social Media Security and Human Resources
Pinnacle Human Resources, LLC

35. About Pinnacle Human Resources, LLC
Pinnacle’s staff is comprised of certified Senior Professionals in HR (SPHR)
from the Certification Institute in Princeton, NJ and Masters in Education.
Pinnacle employes over a dozen HR Professionals plus partners within a
network of independent consultants to increase bandwidth.
Rose Miller is the President of Pinnacle Human Resources with over 25 years
experience in strategic human resources management. Rose recently was
awarded HR Leader of the Year from the Albany Chapter of the Society
of Human Resources Management (SHRM)!
Rose Miller, SPHR/Owner rmiller@pinnaclehrllc.com
7 Century Hill Drive, Latham, NY 518-486-8151
www.pinnaclehrllc.com

36. Changes in the Workplace
 Technology & Social
Media has Changed the
Way We Work
 Pros and Cons

37. Management Concerns
 New Policies Need to be
Developed
 Multi-generational Issues
 Answers May Be Complicated
or Not Yet Available

38. Company Facebook
– Car Dealership
• The salesman, the cashier
and a third party on
Facebook

39. The Importance of Employee
Communications
 The result of poor communications
– Architect Firm
• What happens when
terminations are not
explained properly
– Engineering Firm
• Misuse of Smartphone, skype,
and email equal harassment

40. Supporting Technology, Communications &
Social Media Policies
 Reading and Understanding Policies
 Communicating Expectations- No Privacy
 Background Checks and Monitoring Social Sites
 Reporting Claims and Supporting Claims
 Developing Performance Measures
 Recording Hours Worked
 Checking for Abuse of Technology
 Collection of Signed Acknowledgements

41. Effective Supervision
 Being a Good Example
 Communicating Policies
and Following Procedures
 Communicating Standards
 Monitoring Performance
 Training