For Jeff Bezos at Amazon, this was just another routine step along the path that led to a massive breach of his security. After a personal connection, what is more natural than accepting social media contacts?
Today, companies are under ever-increasing pressure to ensure their business processes are robust enough to withstand a cyberattack. Firewalls and anti-virus software are installed, patches applied and staff required to change their passwords on a regular basis, among other measures.
Yet at the same time, we see a rise in the number of possible attack vectors open to the criminals.
Social media channels offer new ways to get past the watchdogs and security measures in place. Staff are making great use of cloud-based storage to share documents and larger files.
Everyone in your business has a smartphone that's capable of wreaking havoc yet we regularly let staff 'bring their own device' and companies like it because there's more appeal for staff to work late or on weekends if they do so remotely.
Boss gets away with murder
All of this creates more opportunity for the bad guys and more risk for organisations, and especially for business leaders.
And ecause while security restrictions are usually put in place vigorously across the company, the one person who should have extra layers of protection tends to demand fewer.
Datacom Director of Cyber Security David Eaton. Photo / File
The boss tends to get the special treatment which allows him or her to have greater access to files and services.
They may receive more leniency around passwords and security protocols, and have a hands-on role with their marketing team when it comes to a presence on social media including Twitter, Snapchat and WhatsApp - even if company rules prohibit such activity for others.
Jeff Bezos's (and other high-profile business and political leaders) Twitter use demonstrates CEOs and organisational leaders are willing to live by a different rule to the rest of the team, and that leaves the organisation open to some serious challenges.
How do you tell the boss that he or she shouldn't have admin rights on their laptop? That they shouldn't give out their contact details to everyone they meet, no matter how royal? What about insisting they don't use their work phones for personal use, such as social media, even when they use social media to talk with customers and represent the company?
It's a minefield for the security team because, of all the staff in the organisation, those at the top are more likely to be targeted by criminals trying to harvest information and access sensitive information.
'Spearphishing', where criminals attempt to pass off communications as being from the CEO or financial department, is a growing area of concern. Having senior leaders who are active on social media, and use it interchangeably with email and other more formal channels of communication, makes life doubly difficult for the security team.
So in light of Jeff Bezos's breach, here are five tips about cybersecurity for CEOs:
1. Private vs company
If you do want to share your contact details, use a cut-out service. A phone number that you only use for those instances or an email address that your executive assistant (EA) manages. Keep some distance, and keep it ring-fenced so if there is a problem, it's limited.
2. Security isn't optional
Boring but true. Talk to your cybersecurity leads about how best to handle your specific needs. Routine sweeps of your accounts and devices might be required – especially if you travel overseas a lot – so be prepared for some hassle and annoyance. It's not their fault – it's good that they nag.
Make it clear how you'll communicate with the rest of the company. You might use a social media account to talk about the company publicly but you won't use it to message the CFO at midnight to make an urgent transfer of money, for instance. That way if you are hacked it shouldn't lead to the company running into financial strife.
4. If in doubt, there is no doubt
Be suspicious of every communication you receive. If a competitor suddenly wants to share files with you, if a new supplier sends you something directly via an unusual channel, if someone offers to invest large amounts of money out of the blue, be suspicious and if in doubt, check in with your cybersecurity team.
5. Less is more when travelling
Sure, you might need a laptop and a phone when you're travelling but you're also more vulnerable to an attack. Talk to your cybersecurity teams about risk mitigation when on the road and how best to handle that. You should back everything up before you go. You may also be advised to take a 'travel-only' laptop (and, depending on the country you are travelling to, perhaps a tablet only) and a phone that can be wiped when you return.
The best defence against cyberattacks is both preparation and planning. Consider the risks, and plan and anticipate the consequences of a breach in terms of your company, your business and you personally. Doing these things means you're in a better place to manage any potential attack.
And remember that we all suffer from 'optimism bias' – "why would anyone target me?" Don't rely on having never been attacked as proof that you won't be. Just ask Jeff Bezos how that worked for him.
David Eaton is Associate Director of Cyber Security for Datacom.
