U.S.

Department of Justice
Preventive Measures at Work: • Disable Global Positioning System (GPS) encoding. Federal Bureau of Investigation
Many digital cameras encode the GPS location of a
• “Defense in Depth” – use multiple layers of security photo when it is taken. If that photo is uploaded to a
throughout the computer network. site, so are the GPS coordinates, which will let people
• Identify ways you have lost data in the past and know that exact location.
mitigate those threats. Educate employees about • Whenever possible, encrypt communications with
those threats and how to change their behavior, if websites. It may be a feature social network sites
necessary, to prevent future loss.
• Constantly monitor data movement on your network.
allow you to enable.
• Avoid accessing your personal accounts from public
computers or through public WiFi spots.
INTERNET SOCIAL
• Establish policies and procedures for intrusion
detection systems on company networks.
• Establish policies about what company information
• Beware of unsolicited contacts from individuals in
person, on the telephone, or on the Internet who are
seeking corporate or personal data.
NETWORKING RISKS
can be shared on blogs or personal social web pages.
Enforce the policy. • Monitor your bank statements, balances, and credit Internet-based social networking
• Educate employees about how their own online reports.
sites have created a revolution
behavior could impact the company. • Do not share usernames, passwords, social security
numbers, credit cards, bank information, salaries, in social connectivity. However,
• Provide yearly security training.
computer network details, security clearances, home con artists, criminals, and
• Ask employees to report suspicious incidents as soon and office physical security and logistics, capabilities
as possible. and limitations of work systems, or schedules and other dishonest actors are
travel itineraries. exploiting this capability for
Additional Preventive Measures:
• Do not store any information you want to protect on any ! nefarious purposes.

device that connects to the Internet.

No legitimate service or network administrator will ask There are primarily two tactics used
• Always use high security settings on social networking
to exploit online social networks.
you for your password.
sites, and be very limited in the personal information
you share. Monitor what others are posting about you
• Do not provide information about yourself that will allow In practice, they are often combined.
on their online discussions.
• Use anti-virus and firewall software. Keep them, your
others to answer your security questions—such as 1. Computer savvy hackers who
when using “I forgot my password” feature.
browser, and operating systems patched and updated. specialize in writing and manipulating
• Be thoughtful and limit personal information you share
• Change your passwords periodically, and do not reuse such as job titles, locations, hobbies, likes and dislikes, computer code to gain access or
old passwords. Do not use the same password for or names and details of family members, friends, and
install unwanted software on your
more than one system or service. For example, if co-workers.
someone obtains the password for your email, can they computer or phone. 2. Social or
access your online banking information with the same Educational Resources: human hackers who specialize in
password?
A number of organizations and websites provide additional exploiting personal connections
• Do not post anything that might embarrass you later or details on how to protect you and your workplace from
that you don’t want strangers to know. Internet social networking threats. through social networks. Social
• Verify those you correspond with. It is easy for people
[Link] hackers, sometimes referred to as
to fake identities over the Internet.
• Do not automatically download, or respond to content
[Link] “social engineers,” manipulate people
on a website or in an email. Do not click on links in [Link] through social interactions (in person,
email messages claiming to be from a social [Link] over the phone, or in writing).
networking site. Instead go to the site directly to
retrieve messages. [Link]

• Only install applications or software that come from [Link]

Humans are a weak link in cyber
trusted, well-known sites. “Free” software may come [Link]
security, and hackers and social
with malware. Verify what information applications will
be able to access prior to enabling them. Once manipulators know this. They try to
installed, keep it updated. If you no longer use it,
trick people into getting past security
delete it.
walls. They design their actions to
appear harmless and legitimate.
 Click-jacking - Concealing hyperlinks beneath Phishing - Usually an email that looks like it is from
legitimate clickable content which, when clicked, a legitimate organization or person, but is not and
You receive a message from a friend on your social contains a link or file with malware. Phishing attacks
causes a user to unknowingly perform actions, such
networking site. The message directs you to view
a video on another site. When you go to that site, a as downloading malware, or sending your ID to a site. typically try to snag any random victim. Spear phishing
message pops up and says you need to download a Numerous click-jacking scams have employed “Like” attacks target a specific person or organization as their
newer version of software. However, the software update and “Share” buttons on social networking sites. intended victim.
is really malware that, when downloaded, gives control of
your computer to the creators of the malware. (In some Disable scripting and iframes in whatever Internet browser Do not open email or email attachments or click on links sent
cases, simply visiting the site will download the malware.) you use. Research other ways to set your browser options to from people you do not know. If you receive a suspicious
The malware then sends a message to all your “friends” maximize security. email from someone you know, ask them about it before
on your social networking site directing them to the same opening it.
site with the malware. The malware creators soon have Cross-Site Scripting (XSS) - Malicious code is injected
multiple computers under their control (a “botnet”).
into a benign or trusted website. A Stored XSS Attack
is when malicious code is permanently stored on a
In March 2011, hackers sent two spear phishing emails to a
server; a computer is compromised when requesting the small group of employees at security firm, RSA. They only
Vulnerability of Social stored data. A Reflected XSS Attack is when a person is needed one employee to open an infected file and launch
tricked into clicking on a malicious link; the injected code the malware. The malware downloaded information from
Falling for an online scam or computer hack
Networking Sites travels to the server then reflects the attack back to the RSA that then helped the hackers learn how to defeat RSA’s
victim’s browser. The computer deems the code is from security token. In May and June 2011, a number of defense
could be damaging for an individual victim as Social networking sites are Internet-based services that
contractors’ networks were breached via the compromised
allow people to communicate and share information with a “trusted” source.
well as the organization the victim works for. RSA token.
a group.
Such risks include: Turn off “HTTP TRACE” support on all webservers. Research
additional ways to prevent becoming a victim of XSS. Phreaking - Gaining unauthorized access to
Risks: telecommunication systems.
• Identity theft / Impersonation Doxing - Publicly releasing a person’s identifying
• Harassment Once information is posted to a social networking site, it information including full name, date of birth, address, Do not provide secure phone numbers that provide direct
is no longer private. The more information you post, the and pictures typically retrieved from social networking access to a Private Branch Exchange or through the Public
• Peer pressure site profiles. Branch Exchange to the public phone network.
more vulnerable you may become. Even when using high
• Loss of employment security settings, friends or websites may inadvertently Scams- Fake deals that trick people into providing
Be careful what information you share about yourself, family,
leak your information. money, information, or service in exchange for the deal.
• Damaged business reputation and friends (online, in print, and in person).

• Damaged career or personal reputation Personal information you share could be used to If it sounds too good to be true, it is most likely a scam.
conduct attacks against you or your associates. The Elicitation - The strategic use of conversation to extract Cybercriminals use popular events and news stories as bait
• Damaged data or networks more information shared, the more likely someone could information from people without giving them the feeling for people to open infected email, visit infected websites, or
impersonate you and trick one of your friends into sharing they are being interrogated. donate money to bogus charities.
• Intellectual property theft / Data theft
personal information, downloading malware, or providing
Be aware of elicitation tactics and the way social engineers try
• Brand hijacking access to restricted sites. to obtain personal information.
• Delays or interruption in production Predators, hackers, business competitors, and foreign state Before the 2010 World Cup, cybercriminals offered tickets
Pharming - Redirecting users from legitimate websites
• Lost revenue or income actors troll social networking sites looking for information for sale or sent phishing emails claiming you won tickets to
to fraudulent ones for the purpose of extracting see the event.
or people to target for exploitation.
• Burglary confidential data. (E.g.: mimicking bank websites.)
Information gleaned from social networking sites may be After the death of Osama Bin Laden, a video claiming to
• Target for spam and phishing Watch out for website URLs that use variations in spelling or show Bin Laden’s capture was posted on Facebook. The
used to design a specific attack that does not come by way domain names, or use “.com” instead of “.gov”, for example. video was a fake. When users clicked on the link to the
• Content alteration of websites of the social networking site. Type a website’s address rather than clicking on a link. video, they were told to copy a JavaScript code into their
browser bar which automatically sent the hoax to their
• Malware and virus dissemination Tactics: friends, and gave the hackers full access to their account.

There are many tactics people may use to trick Most computer infections come from websites. Just visiting a
Baiting - Someone gives you a USB drive or other Spoofing - Deceiving computers or computer users by
others into providing information or granting electronic media that is preloaded with malware in
website can expose your computer to malware even if you do
not download a file or program. Often legitimate sites may be hiding or faking one’s identity. Email spoofing utilizes
access to that information through social the hope you will use the device and enable them to unknowingly infected. a sham email address or simulates a genuine email
networking venues. Although not exhaustive, hack your computer. address. IP spoofing hides or masks a computer’s IP
Websites with information on popular celebrities or current
this brochure lists some of these tactics sensational news items are frequently hijacked by criminals,
address.
Do not use any electronic storage device unless you
and suggests ways to mitigate online social know its origin is legitimate and safe. Scan all electronic or criminals may create such websites to lure victims to them. Know your co-workers and clients and beware of those
networking risks. media for viruses before use. who impersonate a staff member or service provider to gain
company or personal information.
 Click-jacking - Concealing hyperlinks beneath Phishing - Usually an email that looks like it is from
legitimate clickable content which, when clicked, a legitimate organization or person, but is not and
You receive a message from a friend on your social contains a link or file with malware. Phishing attacks
causes a user to unknowingly perform actions, such
networking site. The message directs you to view
a video on another site. When you go to that site, a as downloading malware, or sending your ID to a site. typically try to snag any random victim. Spear phishing
message pops up and says you need to download a Numerous click-jacking scams have employed “Like” attacks target a specific person or organization as their
newer version of software. However, the software update and “Share” buttons on social networking sites. intended victim.
is really malware that, when downloaded, gives control of
your computer to the creators of the malware. (In some Disable scripting and iframes in whatever Internet browser Do not open email or email attachments or click on links sent
cases, simply visiting the site will download the malware.) you use. Research other ways to set your browser options to from people you do not know. If you receive a suspicious
The malware then sends a message to all your “friends” maximize security. email from someone you know, ask them about it before
on your social networking site directing them to the same opening it.
site with the malware. The malware creators soon have Cross-Site Scripting (XSS) - Malicious code is injected
multiple computers under their control (a “botnet”).
into a benign or trusted website. A Stored XSS Attack
is when malicious code is permanently stored on a
In March 2011, hackers sent two spear phishing emails to a
server; a computer is compromised when requesting the small group of employees at security firm, RSA. They only
Vulnerability of Social stored data. A Reflected XSS Attack is when a person is needed one employee to open an infected file and launch
tricked into clicking on a malicious link; the injected code the malware. The malware downloaded information from
Falling for an online scam or computer hack
Networking Sites travels to the server then reflects the attack back to the RSA that then helped the hackers learn how to defeat RSA’s
victim’s browser. The computer deems the code is from security token. In May and June 2011, a number of defense
could be damaging for an individual victim as Social networking sites are Internet-based services that
contractors’ networks were breached via the compromised
allow people to communicate and share information with a “trusted” source.
well as the organization the victim works for. RSA token.
a group.
Such risks include: Turn off “HTTP TRACE” support on all webservers. Research
additional ways to prevent becoming a victim of XSS. Phreaking - Gaining unauthorized access to
Risks: telecommunication systems.
• Identity theft / Impersonation Doxing - Publicly releasing a person’s identifying
• Harassment Once information is posted to a social networking site, it information including full name, date of birth, address, Do not provide secure phone numbers that provide direct
is no longer private. The more information you post, the and pictures typically retrieved from social networking access to a Private Branch Exchange or through the Public
• Peer pressure site profiles. Branch Exchange to the public phone network.
more vulnerable you may become. Even when using high
• Loss of employment security settings, friends or websites may inadvertently Scams- Fake deals that trick people into providing
Be careful what information you share about yourself, family,
leak your information. money, information, or service in exchange for the deal.
• Damaged business reputation and friends (online, in print, and in person).

• Damaged career or personal reputation Personal information you share could be used to If it sounds too good to be true, it is most likely a scam.
conduct attacks against you or your associates. The Elicitation - The strategic use of conversation to extract Cybercriminals use popular events and news stories as bait
• Damaged data or networks more information shared, the more likely someone could information from people without giving them the feeling for people to open infected email, visit infected websites, or
impersonate you and trick one of your friends into sharing they are being interrogated. donate money to bogus charities.
• Intellectual property theft / Data theft
personal information, downloading malware, or providing
Be aware of elicitation tactics and the way social engineers try
• Brand hijacking access to restricted sites. to obtain personal information.
• Delays or interruption in production Predators, hackers, business competitors, and foreign state Before the 2010 World Cup, cybercriminals offered tickets
Pharming - Redirecting users from legitimate websites
• Lost revenue or income actors troll social networking sites looking for information for sale or sent phishing emails claiming you won tickets to
to fraudulent ones for the purpose of extracting see the event.
or people to target for exploitation.
• Burglary confidential data. (E.g.: mimicking bank websites.)
Information gleaned from social networking sites may be After the death of Osama Bin Laden, a video claiming to
• Target for spam and phishing Watch out for website URLs that use variations in spelling or show Bin Laden’s capture was posted on Facebook. The
used to design a specific attack that does not come by way domain names, or use “.com” instead of “.gov”, for example. video was a fake. When users clicked on the link to the
• Content alteration of websites of the social networking site. Type a website’s address rather than clicking on a link. video, they were told to copy a JavaScript code into their
browser bar which automatically sent the hoax to their
• Malware and virus dissemination Tactics: friends, and gave the hackers full access to their account.

There are many tactics people may use to trick Most computer infections come from websites. Just visiting a
Baiting - Someone gives you a USB drive or other Spoofing - Deceiving computers or computer users by
others into providing information or granting electronic media that is preloaded with malware in
website can expose your computer to malware even if you do
not download a file or program. Often legitimate sites may be hiding or faking one’s identity. Email spoofing utilizes
access to that information through social the hope you will use the device and enable them to unknowingly infected. a sham email address or simulates a genuine email
networking venues. Although not exhaustive, hack your computer. address. IP spoofing hides or masks a computer’s IP
Websites with information on popular celebrities or current
this brochure lists some of these tactics sensational news items are frequently hijacked by criminals,
address.
Do not use any electronic storage device unless you
and suggests ways to mitigate online social know its origin is legitimate and safe. Scan all electronic or criminals may create such websites to lure victims to them. Know your co-workers and clients and beware of those
networking risks. media for viruses before use. who impersonate a staff member or service provider to gain
company or personal information.
 U.S. Department of Justice
Preventive Measures at Work: • Disable Global Positioning System (GPS) encoding. Federal Bureau of Investigation
Many digital cameras encode the GPS location of a
• “Defense in Depth” – use multiple layers of security photo when it is taken. If that photo is uploaded to a
throughout the computer network. site, so are the GPS coordinates, which will let people
• Identify ways you have lost data in the past and know that exact location.
mitigate those threats. Educate employees about • Whenever possible, encrypt communications with
those threats and how to change their behavior, if websites. It may be a feature social network sites
necessary, to prevent future loss.
• Constantly monitor data movement on your network.
allow you to enable.
• Avoid accessing your personal accounts from public
computers or through public WiFi spots.
INTERNET SOCIAL
• Establish policies and procedures for intrusion
detection systems on company networks.
• Establish policies about what company information
• Beware of unsolicited contacts from individuals in
person, on the telephone, or on the Internet who are
seeking corporate or personal data.
NETWORKING RISKS
can be shared on blogs or personal social web pages.
Enforce the policy. • Monitor your bank statements, balances, and credit Internet-based social networking
• Educate employees about how their own online reports.
sites have created a revolution
behavior could impact the company. • Do not share usernames, passwords, social security
numbers, credit cards, bank information, salaries, in social connectivity. However,
• Provide yearly security training.
computer network details, security clearances, home con artists, criminals, and
• Ask employees to report suspicious incidents as soon and office physical security and logistics, capabilities
as possible. and limitations of work systems, or schedules and other dishonest actors are
travel itineraries. exploiting this capability for
Additional Preventive Measures:
• Do not store any information you want to protect on any ! nefarious purposes.

device that connects to the Internet.

No legitimate service or network administrator will ask There are primarily two tactics used
• Always use high security settings on social networking
to exploit online social networks.
you for your password.
sites, and be very limited in the personal information
you share. Monitor what others are posting about you
• Do not provide information about yourself that will allow In practice, they are often combined.
on their online discussions.
• Use anti-virus and firewall software. Keep them, your
others to answer your security questions—such as 1. Computer savvy hackers who
when using “I forgot my password” feature.
browser, and operating systems patched and updated. specialize in writing and manipulating
• Be thoughtful and limit personal information you share
• Change your passwords periodically, and do not reuse such as job titles, locations, hobbies, likes and dislikes, computer code to gain access or
old passwords. Do not use the same password for or names and details of family members, friends, and
install unwanted software on your
more than one system or service. For example, if co-workers.
someone obtains the password for your email, can they computer or phone. 2. Social or
access your online banking information with the same Educational Resources: human hackers who specialize in
password?
A number of organizations and websites provide additional exploiting personal connections
• Do not post anything that might embarrass you later or details on how to protect you and your workplace from
that you don’t want strangers to know. Internet social networking threats. through social networks. Social
• Verify those you correspond with. It is easy for people
[Link] hackers, sometimes referred to as
to fake identities over the Internet.
• Do not automatically download, or respond to content
[Link] “social engineers,” manipulate people
on a website or in an email. Do not click on links in [Link] through social interactions (in person,
email messages claiming to be from a social [Link] over the phone, or in writing).
networking site. Instead go to the site directly to
retrieve messages. [Link]

• Only install applications or software that come from [Link]

Humans are a weak link in cyber
trusted, well-known sites. “Free” software may come [Link]
security, and hackers and social
with malware. Verify what information applications will
be able to access prior to enabling them. Once manipulators know this. They try to
installed, keep it updated. If you no longer use it,
trick people into getting past security
delete it.
walls. They design their actions to
appear harmless and legitimate.