Category Archives: Erik Bernstein

Social media crisis management advice straight from the horse’s mouth

After the umpteenth Twitter hack of recent memory, in which a false report of explosions in the White House going out from the official Associated Press account actually caused the stock market to dip, the big blue bird is finally doing some crisis management of its own.

Going with the educational approach, at least while further security systems like two-step authentication are perfected, Twitter sent a memo to news organizations that was full of tips on account security:

Take these steps right now:

Change your Twitter account passwords. Never send passwords via e-mail, even internally. Ensure that passwords are strong- at least 20 characters long. Use either randomly-generated passwords (like “LauH6maicaza1Neez3zi”) or a random string of words (like “hewn cloths titles yachts refine”).

Keep your email accounts secure. Twitter uses email for password resets and official communication. If your email provider supports two-factor authentication, enable it. Change your e-mail passwords, and use a password different from your Twitter account password.

Review your authorized applications. Log in to Twitter and review the applications authorized to access your accounts. If you don’t recognize any of the applications, contact us immediately by emailing ______@twitter.com.

Help us protect you. We’re working to make sure we have the most updated information on our partners’ accounts. Please send us a complete list of all accounts affiliated with your organization, so that we can help keep them protected.

Build a plan. Create a formal incident response plan. If you suspect your organization is being targeted by a phishing campaign or has been compromised by a phishing attack, enact the plan.

Contact us immediately at ______@twitter.com with the word “Hacking” in the subject. Include copies of suspected phishing emails.

If you lose access to an account, file a Support ticket and email the ticket number to ______@twitter.com.

Moving Forward:

Review our security guidelines to help make sure your accounts are as secure as possible.

Talk with your security team about ensuring that your corporate email system is as safe as possible. A third-party provider that allows for two-factor authentication might be a safer solution.

Strong security practices will reduce your vulnerability to phishing. Consider the following suggestions:

Designate one computer to use for Twitter. This helps keep your Twitter password from being spread around. Don’t use this computer to read email or surf the web, to reduce the chances of malware infection.

Minimize the number of people that have access. Even if you use a third-party platform to avoid sharing the actual Twitter account password, each of these people is a possible avenue for phishing or other compromise.

Check for signs of compromise. Checking your email address and authorized apps weekly or monthly can help detect unauthorized access and address the problem before access is abused.

Double-check the email address associated with your Twitter accounts:

https://twitter.com/settings/account

Review the apps authorized to access your accounts:

https://twitter.com/settings/applications

Change your password regularly. Changing your Twitter password quarterly or yearly can reset the clock if a password has leaked.

Using a Password Manager integrated into your browser can help prevent successful phishing attacks.

Third-party solutions such as 1Password or LastPass, as well as the browser’s built-in password manager, will only auto-fill passwords on the correct website. If the password manager does not auto-fill, this might indicate a phishing attempt.

Password managers make it much easier to use a very strong password. Very difficult passwords will discourage memorization, which will
greatly reduce the chances of being phished.

Be certain to set a master password, since otherwise passwords may be stored unprotected.

Now, a lot of this is common (e-)sense but we’ve seen an awful lot of people from very brainy organizations hacked, and Twitter’s done the right thing by putting this memo out to the media, both because they are at high risk of being hacked, and because they’re bound, as we did, to republish the tips for others to see.

Yes, we need Twitter to do its part to secure our accounts, but in the end the responsibility lies with each user. It’s your reputation that goes in the line when your account is compromised, so take the proper precautions and lock down those precious social profiles today.

The BCM Blogging Team
http://www.bernsteincrisismanagement.com/