Setting up your business social media securely 

Protect your social media account

• Start with strong passwords

  Attackers can take over your account by getting your password. The most common ways they do this is by: 

  • getting you to click on a phishing link and tricking you into entering your password, 

  • obtaining your password through a data breach, or 

  • simply guessing a weak password.  

  A long and unique password is your best defence against account takeovers. You can find more on how to create good passwords here. 
  

  Create good passwords

  If you have multiple social media accounts, use a different password for each one, which should also be different from all your other online accounts. For example, don’t use the same password for your Instagram account as you do for LinkedIn. That way, if someone gets one of your passwords, it won't give them access to your other accounts.  

  Use a password manager to securely store your passwords but avoid saving your passwords on your browser. Encourage your employees to do the same.

• Enable two-factor authentication

  Enabling two-factor authentication (2FA) gives you a second layer of defence so even if someone has your password, they won’t be able to access your account. It's a simple tool, but incredibly powerful in stopping attackers. We recommend you turn it on across all your social media accounts and any other important accounts including emails and banking.  

  Protect your business with two-factor authentication 

• Keep your device and apps up to date

  Device manufacturers and app developers frequently release updates when they need to add a new feature or to fix security issues. Keeping your social media apps and the device you use to log in to them up to date helps protect your account from online attackers who are looking for a way to get into your accounts. You can also turn on automatic updates for your apps in your device settings. 

• Create a social media policy

  You may have more than one person with access to your social media accounts. This could include an external agency. Having a social media policy document will mean that: 

  • you have guidelines in place around who can access your social media accounts, 

  • you can better explain to your employees, your expectations around how your social media is used, and 

  • if there is a security issue involving your social media, people in your business can refer to this document for what to do next 

  Your social media policy should outline who gets access to your accounts, rules around what to post, rules around moderating interactions, and what to do in the case of an online event. 

  Your staff should only have the minimum level of access they need to do their job: this is known as the 'principle of least privilege'. While it's good to have backup options in case staff are unavailable, the fewer people that know the passwords or have admin rights, the lower the risk of unauthorized access.  

  You can also put in place security requirements, such as mandatory 2FA for anyone accessing the account. When employees with access to social media accounts exit the organization, promptly revoke their access and change the passwords, to decrease the risk of unauthorized access.  

  Storing passwords in a password manager also increases your security. A password manager is like putting your passwords into an online safe that only you have the key to. Using a password manager is an easy way for you and your staff to keep track of all the passwords used to access businesses accounts such as social media.  

  Use a password manager in your business 

• Keep the master key with you

  Social media accounts are linked to an email account which owns the account. This master email is also used to change passwords and to retrieve your accounts. If this email is compromised, an attacker can lock you out of your social media accounts by resetting your passwords.  

  Secure your email account with the same protections as your social media account above with a long, strong, unique password (not the same one as your social accounts) and two-factor authentication.  

  If you have more than one person with access to your online accounts, you can choose to keep the password for the master email account with you so nobody can reset the password without you knowing.

• Be on the lookout for phishing

  Phishing is the most common way for cyber criminals to get a foot in the door. All it takes is for someone to click on a wrong link and the account could be compromised.  

  It is very important to be able to spot a phishing email or message when you see one, and to train your employees to do the same.  

  Phishing scams