The Security Skeptic

Defensive Social Networking

In June 2009, I finally created a Facebook account, but not for any of the conventional reasons folks join social networks. At the time, I worried about the threat of impersonation and possibility of reputational harm. After six months of Facebooking, I'd recommend that many professionals should join a social network even if the reasons are purely defensive. Here's the situational analysis that led me to this conclusion (from an earlier post).

Image by socialmediahq

Perhaps I'm too long in the security business, but I began to consider how easy it would be for someone with malicious intent to fabricate a social networking account for a targeted identity. For folks who have considerable online "visibility" - published articles, a blog, email activity published on a WiKi,... -  this isn't terribly difficult. Let's assume I'm targeted. All a miscreant needs is to create or gain access to an email account to which the membership confirmation email for Dave Piscitello is sent. Once the miscreant confirms the account, he can populate the newly created account with personal information about "me" that he can easily gather from other sources: my personal page at SecuritySkeptic.com, bios from conference speaker pages, ICANN, or Core Competence provide ample information for a convincing deception, especially if the deception targets colleagues and members of the security community over intimate friends and family.

If the purpose of this deception is to harm me, the miscreant might build a social network to serve as the audience for some embarrassment he'd create while impersonating me. Since social network sites constantly suggest friends to add, this is trivial. Once the miscreant grows a satisfactory friends list, he can use my Facebook wall or the walls of my colleagues, family and friends to post abusive, insulting or libelous comments, lies or misinformation. He can intimate that I'm unhappy with my employer, my wife or children. He can post photos that might be embarrassing, or for a truly worst case scenario, use the account for predatory or porn publishing purposes.

 

It's quite likely that someone who really knows me will undoubtedly contact me using one of my legitimate email accounts or phone numbers to read me the riot act or fire me. At this point, however, my Facebook situation is no different from any web defacement attack. I've been victimized and I'll have to take action to recover from the incident. I've got to contact the social network operator, provide compelling evidence of the impersonation, and get the page removed. And like all defacement attacks, my reputation is tarnished.

I haven't painted a particularly pretty picture of what might happen to me. Now, after 6 months of Facebooking, I've connected with enough colleagues and friends, and shared enough information both professional and personal that I would expect that my legitimate Facebook page would hold up against any impersonation social networking pages. Try unfolding the same scenario for yourself and see if a defensive social networking page isn't worth the effort.

 

 

 

Let sleeping tech terms lie

Carolyn Duffy Marsan wrote a seemingly innocent column, 12 words you can never say in  an office. The title of the article suggest she was about to update George Carlin's memorable list, Seven Dirty Words You Can't Say On Television. 

Office workers' reaction to the column were nearly as negative - and extensive - as those of the FCC when George did his monologue in the early 1970s. Visit the *seven* pages of comments and you'll find rebuttals regarding most of the terms Carolyn claims are passe. You'll also find plenty of comments questioning poor Carolyn's academic pedigree, her competency as writer/editor, and the competency/credibility of her journalism in general:-)

Why all the fuss? Carolyn made the not-so-career-ending mistake of tinkering with tech terms. Many people who work in or with technology value accurate terminology, but asimportantly, they are skeptical of claims they feel are uncorroborated. Tell someone who routinely uses his corporation's intranet that he's using a portal and he may object. (Actually, *they* may object. The comment thread wherein indignant techies debate not only the original version of Carolyn's post, but the editorial rewrite is an endearing and revealing aspect of the column.) 

Carolyn puts readers on notice: an extranet must now be called an VPN. Net and security admins posted comment after comment describing the differences between the two. I'm confident that only limits to comment submissions will prevented someone from enumerating and describing the several VPN technologies and protocols his company uses. 

A problem with declaring a technology term obsolete is that technology adoption has a long tail. IT staff at a company that is still wrestling with VOIP call quality and security is probably not easily convinced that the PSTN is obsolete. A webcasting company doesn't want to hear that only RSS feeds qualify as push technology any more than an application service provider wants to put all his SEO budget into terms including "cloud". 

Just about every word or phrase Carolyn mentions - Intranet, Extranet, ASP, PDA, surfing the web, push technology Internet telephony, weblog, thin client, world wide web, long distance call- is debated or her claim is debunked. Well, no one debates that RBOC is dead, so partial score there.

Earlier, I called this a not-so-career-ending editorial. In fact, I'll speculate that Network World is delighted with it. The editorial stimulated discussion. More importantly for Network World, it attracted visitors who left comments which created additional pages which created real estate for advertising.

What's next for Carolyn? Perhaps "15 ways to obfuscate the US health care debate"?