Peter Suciu
Before the various social media networks became a place to see echoes of one's political opinions and to call out those who you disagreed with, many of the services were where you simply shared some thoughts of the day along with a photo or two. Fewer people actually do this today, and perhaps it would be good for the country – dare it even be said the world – if social media returned to being more about social.
That said, it turns out one group may be "oversharing" photos and information more than they should, namely those in uniform. This has been an ongoing problem in recent years, and one The New York Times reported about in early 2019 after social media posts revealed some NATO secrets.
The Department of Defense (DoD) has had to warn service members about sharing photos from military bases, while the U.S. Army has reminded soldiers that when using social media they must abide by the Uniform Code of Military Justice (UCMJ) at all times. That includes not posting or even linking to material that violates the UCMJ or basic rules of soldier's conduct, while also not using the platforms to share/post negative comments about supervisors or to release sensitive information.
There are now several concerns in how social media could be used nefariously by service members or to target them.
Targeted By Foreign Actors
Experts warn that social media could pose a real threat as it could be a gateway for service members to be targeted by foreign threat actors. These agents could try to befriend them and gain their trust. These foreign and professional threat actors are often very patient and may be biding their time, waiting for the right moment to bait or convince them to provide personal, business, or other sensitive information in order to maintain their social network.
"Service members are unique because they have a national security element tied to their role," suggested Tom Garrubba, director of Third Party Risk Management (TPRM) professional services with Echelon Risk + Cyber. "They are exceptionally ripe for foreign threat actors to try to befriend them and gain their trust over time, only to bait or convince them to provide personal, business, or other sensitive information in order to maintain their social network. As human beings, we have an ornate desire to be 'liked' and people often unknowingly then do things irrationally in order to keep the vibe of their social network 'positive.'"
The problem could even be with the actual apps. Garrubba suggested that service members do their best to research who has developed or owns the app and how data is captured or shared.
"Often, these apps – like TikTok, WhatsApp, and others – allow the data to be sent to places such as China and other geo-politically sensitive regions without the user having any idea as to what is happening behind the scenes," Garrubba continued. "If a service member was to use any such app, it would be very wise not to discuss anything sensitive about you, your family, your position, or to comment on strategic or political affairs. Service members must realize such comments reside online forever and can be used by anyone with the attempt to entice, goad, or threaten you or the people close to you."
Spear Phishing
Service members can be targeted much in the same way as those in the business world. Often times what one shares on social media provides the details that help the bad actors. From here spear phishing campaigns can be employed.
"Spear phishing is focused entirely on the ability of threat actors to target a network with relevant and highly customized information," warned Dr. Darren Williams, CEO and founder of cybersecurity firm BlackFog. "The best attacks are the ones that appear so real that no one even notices. The threat is real when the device has been compromised and your personal data is leaked on the Internet and when people they know have been victims of an attack."
Like everyone else today, service members need to be careful about not only what they post, but the links they click on. It is all too easy to be tricked into clicking the wrong link on a social platform said Dr. Williams. "The entire focus of threat actors is to make you click on something in order to deliver their payload, so avoiding direct clicks and redirections to other sites which make you download a file will limit your exposure dramatically."
"Photos posted to social media can pose significant force protection risks," explained Jake Williams, executive director of cyber threat intelligence at SCYTHE.
"Adversaries viewing photos of military units can assess type and condition of equipment in use, understand the layout of installations for use in targeting, and learn of security measures in place," added J. Williams. "Photos with geographic tagging, while increasingly rare on social media sites, pose obvious operational security risks for those operating outside of established bases. Even without geographic tagging through EXIF data, open source intelligence (OSINT) can often be used to pinpoint the location where a photo was taken. The team at BellingCat is exceptionally good at this and service members should expect that adversaries have identical (if not better) capabilities."
So what is the answer given these potential threats?
"Service members need to practice sound operational security (OPSEC) and actively manage their online presence. It is imperative that they use the security settings provided by each online platform and minimize their public information footprint," said Matthew Marsden, vice president of technical account management at privately held cybersecurity and systems management company Tanium. "It can be tempting to share pictures and information about work-related travel but doing so can unintentionally expose sensitive information."
No comments:
Post a Comment