Archive for the ‘Social Media’ Category
Sunday, June 28th, 2015
Over the past couple of weeks, I have spent a lot of time speaking with one of my clients about social media and posts from employees and contractors that may have a negative impact on the business. And the client is right to be concerned.
Most businesses are now using social media sites to communicate with their customers, potential customers, patients, employees, and everyone in between. However, such communications can often go awry at best, and result in privacy and security violations at worst. Here are just a few examples of what can go wrong. (more…)
Tags:awareness and training, change controls, Dell, facebook, Information Security, IT compliance, policies and procedures, power more, powermore, privacy, privacy compliance, privacy professor, privacyprof, program changes, risk management, security awareness, security training Rebecca Herold, social media, toprank
Posted in Social Media | No Comments »
Friday, August 29th, 2014
Over the past few months I’ve been creating some social media marketing privacy guidelines and requirements for a couple of my large clients. Today I read a post from a fellow IBM Midsize Insider contributor, Jason Hannula, “Social Media: Enterprise Content or Customer Relationship Information?” It stated that “93% of marketers are using social media for business.” A large number of these are from small and midsize organizations. It is important for these organizations to not only keep Jason’s suggestions in mind, and follow the business’s data governance requirements, but also to make sure privacy is also appropriately addressed. Many, perhaps most, small to midsize businesses do not yet have social media privacy requirements in place. (more…)
Tags:data protection law, encryption, facebook, IBM, Information Security, information security risks, infosec, marketing, midmarket, privacy, privacy law, privacy professor, privacy risks, privacyprof, Rebecca Herold, social media, twitter
Posted in Marketing, privacy, Social Media | No Comments »
Thursday, November 29th, 2012
Are you faking it online? Or faking it at work? While faking it certainly has its benefits in both places, I want to touch upon a couple of concerns I have with using fake identities. (more…)
Tags:awareness, breach, compliance, customers, data protection, e-mail, electronic mail, email, employees, employment, facebook, fake IDs, hiring, HR, human resources, IBM, Information Security, information technology, infosec, IT security, job applicants, laws, messaging, midmarket, non-compliance, patients, personal information, personally identifiable information, personnel, PII, policies, privacy, privacy breach, privacy professor, privacyprof, Rebecca Herold, reputation, risk, security, sensitive personal information, social media, social networking, SPI, systems security, test data, training, twitter
Posted in Social Media | 2 Comments »
Monday, October 22nd, 2012
Last week one of my Facebook friends started a “friends only” discussion on his wall. It was a very interesting discussion, and one of his friends took the discussion, pretty much verbatim, and posted within a “public” (as in meant for the world to see) popular blog site. So the information on the Facebook page, where around 250 – 300 people could see the posts were now in a location where the bazillion (possibly a bit fewer) blog readers could see all the posts and the full names of those who made them. This is not the first time a situation like this has occurred. A lot of the information posted on people’s social media pages are really tempting to take and use as examples, or for business activities such as for marketing and promotions. However, doing so could get you into some personal and/or legal hot water. As organizations and individuals consider taking information they find on social media sites, they need to consider the reasons why doing so may not be a good idea after all.
Reason #1: It will (more…)
Tags:awareness, breach, compliance, copyright, Creepshots, customers, data protection, e-mail, electronic mail, email, employees, employment, facebook, Gawker, hiring, HR, human resources, IBM, Information Security, information technology, infosec, IT security, job applicants, laws, LinkedIn, messaging, Michael Brutsch, midmarket, non-compliance, patients, personal information, personally identifiable information, personnel, PII, policies, privacy, privacy breach, privacy professor, privacyprof, Rebecca Herold, Reddit, reputation, risk, security, sensitive personal information, social media, social network, SPI, systems security, training, twitter, Violentacrez
Posted in Social Media | 2 Comments »
Friday, August 31st, 2012
Every day I see yet another (often another dozen) situation where employees misused, abused or otherwise accused social media sites to the chagrin of their employers. Businesses need to make a coordinated effort, using a combination of policies, training and technology to mitigate the risks (to personnel as well as the business) of workers using social media sites. Today let’s consider what organizations should be telling their workers about social media information security and privacy. (more…)
Tags:awareness, breach, bullying, compliance, cyberbullying, e-mail, electronic mail, email, facebook, IBM, Information Security, information technology, infosec, IT security, lawsuits, Linked In, messaging, midmarket, non-compliance, online posting, personal information, personally identifiable information, PII, policies, privacy, privacy breach, privacy professor, privacyprof, Rebecca Herold, security, sensitive personal information, social media, SPI, systems security, training, tweet, twitter
Posted in Social Media, Training & awareness | 5 Comments »
Thursday, August 16th, 2012
At the end of July, Twitter suspended the account of Guy Adams, a reporter for the UK’s Independent, after he posted the corporate email address of Jim Bell, Producer of NBC Olympics, and said less than flattering things about his expectations for how NBC would do in their Olympics coverage. Adams reportedly claimed that he felt the email account was open to public use since it showed up in Google search results. However, privacy concerns were widely expressed over his decision to share the executive’s contact details, and thus his account was suspended. Apparently NBC complained, Twitter listened, and Guy’s account was shut down. After a bit of hullabaloo, Twitter then changed heart and re-activated his Twitter account. I received several great questions related to this, collectively boiling down to the following five: (more…)
Tags:awareness, breach, compliance, CSO Online, e-mail, electronic mail, email, Guy Adams, IBM, Information Security, information technology, infosec, IT security, Jim Bell, lawsuits, messaging, midmarket, NBC, non-compliance, Olympics, online posting, personal information, personally identifiable information, PII, policies, privacy, privacy breach, privacy professor, privacyprof, Rebecca Herold, security, sensitive personal information, social media, SPI, sue, systems security, training, tweet, twitter
Posted in Social Media, Training & awareness | No Comments »
Friday, March 23rd, 2012
In case you’ve not paid attention to the news in the past week, there has been a barrage of stories (over 1500 turned up in a quick online search) about organizations asking job applicants and employees for their Facebook, Twitter, LinkedIn and other social networking passwords. It’s a hot topic folks! I’ve listed a bunch of them at the end of this post. Compelled password disclosure is a very bad idea for organizations to do for many reasons. Here are six that should be compelling to business management: (more…)
Tags:employee privacy, employment practice, facebook, LinkedIn, midmarket, password, policies, privacy, privacy professor, privacyprof, Rebecca Herold, security, social media, social network, twitter, YouTube
Posted in privacy, Social Media | 3 Comments »
Tuesday, April 19th, 2011
News broke yesterday about a physician in Rhode Island, at the Westerly Hospital, who was sanctioned for posting protected health information (PHI) on her Facebook page: (more…)
Tags:awareness, facebook, HIPAA, HITECH, patient information, PHI, policies, privacy, procedures, Rebecca Herold, Rhode Island, security, social media, Than, training, Westerly Hospital
Posted in BA, CE, healthcare, HIPAA, privacy, Privacy and Compliance, Social Media | 1 Comment »
Saturday, February 12th, 2011
I recently engaged in an interesting discussion with Rafal Los about the erosion of privacy as it relates to the Internet in general, and social media sites specifically. I think my readers will some useful points and insights within our conversation; especially considering the often perceived adversarial relationship between anonymity and privacy. I welcome your feedback!
So here we go… (more…)
Tags:anonymity, Digital, EULA, facebook, Identity, internet, privacy, privacy professor, rafal los, Rebecca Herold, social media
Posted in Miscellaneous, privacy, Social Media, Training & awareness | 1 Comment »
Monday, December 20th, 2010
Looking ahead to what will happen in the coming year is always an interesting exercise. Just like within a great novel, foreshadowing occurs every day in our lives to drop the hints of things that are likely to come. The trick is to separate out the valuable hints from the extraneous breadcrumbs that are dropped by dozens of other inconsequential sources that mislead us and cause us to fail in our predictions. We shall see at the end of the year how close I am with the following predictions… (more…)
Tags:compliance, GLBA, HIPAA, HITECH, Information Security, meaningful use, PIA, privacy, privacy impact assessment, privacy training, risk assessments, security training, smar meter, Smart Grid
Posted in GLBA, Information Security, Laws & Regulations, privacy, Privacy and Compliance, Social Media, Training & awareness | 2 Comments »
