Blog
Executive Protection in the Cloud: Why it Matters More Than Ever
As we emerge from the past year and into a post-pandemic world, we face new challenges in a work-from-anywhere climate where businesses have adopted social and collaborative channels to a far greater extent than ever. While cloud-based apps for collaboration and communication enable teams to work effectively, they represent a largely unprotected threat landscape that security teams are scrambling to get their arms around.
And for a good reason: 2020 saw an exponential increase in attacks against company executives, as they were exposed and unprotected over platforms ranging from WhatsApp, Slack, Zoom, Telegram, and social media such as LinkedIn, Instagram, and Facebook. Many high-profile industry leaders have been targeted; the successful spear-phishing attack on Amazon’s Jeff Bezos, wherein he clicked a video link sent by what appeared to be a person known to him, is one of 2020’s more memorable cybercrimes. The campaign by the Lazarus Group (North Korea), which targeted security researchers across social and mobile, is another example that hits close to home.
Attackers are increasingly targeting these platforms with phishing schemes, ransomware attacks, social engineering, and more. The key problem is that, unlike email, people instinctively trust what they encounter in social channels. Culturally, we have learned to be wary of emails and are familiar with the dangers of spam. But a DM in an app? People still instinctively tend to see these as less threatening. A study by BlackHat found that 66% of social spear-phishing messages were opened by their recipients.
The use of cloud-based apps for business-critical work is now the norm. Yet, enterprises lag in their ability to protect employees and executives from this wide-open and novel threat landscape. Even applications like Salesforce now interact with social channels more than ever, meaning that this vast new landscape is also a potential threat vector into the enterprise. When it comes to executive protection, the problem goes beyond technology – it’s a cultural and organizational issue.
Who owns executive protection?
In late 2020 SafeGuard Cyber conducted an online survey of more than 600 enterprises’ security and marketing teams on the topic of executive protection.
Not surprisingly, 100 percent of respondents report that their executives use social media accounts; well over half expected the role of executive communications to increase in importance in 2021. As to what is keeping their security teams up at night, 70 percent of respondents said their company’s brand reputation would suffer in the event of a hack. At the same time, half predicted there would be an impact on shareholder value. Companies recognize that their CEO/C-level executives are their biggest brand evangelists; they are influencers in their own right. Their marketing teams know it; 40 percent of respondents say executive social media is embedded in their 2021 marketing plans.
Yet, 43 percent of these same enterprises report that their organizations offer no proactive oversight of executive social media use. Another 43 percent say their C-level executives use their social media independent of their brands’ marketing teams.
The 2020 Verizon cybersecurity report discovered that 50 percent of cyber attacks involve social phishing (not email phishing). Executives were “12 times more likely to be the target of social incidents, and nine times more likely to be the target of social breaches.”
This has to change.
In the people, process, technology equation—that popular mantra of digital transformation—there is clearly a lag in the people and process adaptation to the new normal. Stated simply, most organizations don’t have a clear plan for executive protection; our survey showed about a third reported that responsibility for executive protection resided with security teams, about a third said it lies in marketing and–not insignificantly–about a third don’t have a proactive commitment to it. The range of threats, from social media account takeover to outright impersonation, from compliance violations done in their name to the potential for incitement of actual violence—and their consequences, could be devastating.
Despite a strategic commitment to executive social media, and an awareness of the associated digital risks, enterprises are not doing enough to protect executives’ accounts. Oversight is lacking, record-keeping often remains manual, and risk management is unevenly distributed.
Fortunately, even in this uncertain world, these crimes are preventable. With modern tools purpose-built for cloud-based apps, organizations can now empower their teams to make full use of the new digital channels for brand-building. What is needed is a platform that delivers unprecedented visibility into these channels, including direct messages, post comments, and mentions, and can instantly scan links and attachments for malware, malicious content and phishing scams.
What about privacy? As organizations look to tap the power of tools that can safeguard these channels, executives and employees will resist oversight if they feel exposed. In order to offer a balance between enterprise governance and individual privacy, SafeGuard Cyber offers a TotalPrivacy feature, whereby security teams are flagged on malicious posts and content while the user’s actual message remains masked.
Enterprises must wake up to the totality of the borderless enterprise and embrace tools that offer deep visibility into the new normal—today’s AI-based solutions can see into direct messages in social media, scanning even for suspicious links and attachments, at scale and instantly.
Every crisis brings opportunity, which then presents challenges. For each collaboration, social media, or mobile chat tool we adopt, we expand our attack surface. That effect has magnified over the past year due to our rapid shift to Work from Anywhere, a trend that is clearly here to stay to one degree or another. We see a future with greater collaboration between security and marketing teams, and between those teams and executives who know their brand goes with them everywhere.
About the Author
Lisa Hayashi is the Senior Vice President of Marketing at SafeGuard Cyber, responsible for the company’s global marketing strategy that is positioned around the safeguarding of human connections. Her team bridges the gap between complicated cyber technology and applying it to real world use cases and clients. Lisa was recognized as one the Top 25 Women Leaders in Cybersecurity in 2021 by The Software Report.
Editor’s Note: The views expressed by the author are not necessarily those of the Global Cyber Alliance.
