VIPs need extra web 2.0 security

According to Dr Paul Judge, chief research officer with Barracuda Networks, Ms Coffey's account hacks were probably due to a lack of security awareness on her part, as well as the use of the same password on multiple accounts.

"The social media platforms of highly visible people will always be an irresistible target to hackers, whether commercially or politically motivated", he said.

The solution to the problem, he told Infosecurity, is a mixture of improved security on the part of the user, and technology to help to defend against this type of account security compromise.

Proper password and personal security controls are, he explained, something that almost all business technology users know about, but few follow rigorously.

"Any large organisations such as Parliament down to the smallest SMB can buy in the appropriate security technology like web application firewalls or spyware removal tools, but the weakest link is always the human element", he said. "It appears in this case that Therese Coffey used the same passwords across several sites, leaving her completely open to compromise," he added.

Dr Judge went on to say that IT managers need to address Web 2.0 services. "You really do need to control access to social networking sites and services on both a user and granular level, controlling who can do what and on which service. Then there is the question of timing – you might want to limit social networking access to 60 minutes during work hours, or, in some cases, limit access to outside working hours or lunch breaks", he said.

Some organisations, he says, now require users to load a virtual machine up for social networking site usage, and, when they log out, the virtual machine session shuts down, only for a second session to be loaded for 'normal' work usage. "Using this approach means that, when the virtual machine session is closed down, any potential security issues close down with them. It's a useful way of securing access to social networking services", he explained.

What’s hot on Infosecurity Magazine?