LinkedIn may be the world's leading professional social network, but that is also contributing to its potential value to hackers.
Social networks have always attracted hackers. Sites like Facebook are regularly prone to a variety of different attacks, as members' willingness to share stuff quickly becomes there undoing. Before thinking about that hilarious picture of a singing cat that came from somebody they didn't know, they've clicked it and downloaded malware. As LinkedIn grows (150 million members and counting), the interest from hackers grows with it. Behavior on LinkedIn makes it a particularly useful target for hackers.
On Facebook, users can be encouraged to keep their accounts private and secure and they tend to be wary about the people they share personal information with. On LinkedIn, a different set of rules exist by the very nature of the site.
For a start, users potentially want to be sought out and contacted by recruiters and potential employers. That means that they need to be easy to find, so a public profile is an absolute must. Limiting the data on that profile generally limits the interest that potential recruiters might have too. If you can't demonstrate very specific career experience, then a recruiter is more likely to go and find somebody that can. If your employer is easily visible then your company's vulnerability to attack increases greatly.
It's not easy to guess somebody's personal email address but when it comes to corporate email accounts, things get a whole lot simpler. Chances are that it's name.surname@companyname.com and that makes it easy for people to get in touch with you, even if you don't want them to. The other problem, particularly in larger businesses, is that it makes it more likely that there will be people on LinkedIn that work for your company that you don't know. If you get a connection request from one of them, then the chances are that you won't decline, particularly because LinkedIn continually encourages you to connect with more and more people.
This problem was highlighted in a recent article on the CNN website, which outlined the efforts of a security specialist to 'infiltrate' a company network. Within days, he had achieved his goal, proving the theory that employees 'connect first and think later', by which time it may be too late.
For LinkedIn users this means simple precautions:
1 – Don't connect with somebody that you do not personally know and trust (even if LinkedIn suggests that you do otherwise).
2 – When administering groups, ensure that membership is controlled by an administrator to ensure that only genuine employees are able to join.
3 – When discussing your current role, be careful to talk in generic terms. Don't give away the details of specific projects or assignments.
Sensible precautions can help mitigate many of the risks that LinkedIn users face, but the fact remains that this is becoming an increasingly attractive proposition to hackers.
Comments
Post a Comment