This is page 2 of:

Burger King, Jeep Tweet-Hacks Show It’s Time For A Social Kill Switch

February 20th, 2013

Part of the problem is with how retailers and other big organizations think about social media. It’s outside their hands, and they’re accustomed to either having control of tech-related functions or not having to worry about them.

But that mindset won’t work here. Chains have too much exposure when they put their names and reputations on a social media site. It’s easy to assume that security isn’t a big deal for Twitter and Facebook accounts. But those accounts should be treated with security as tight as internal accounts; namely, with passwords that are changed whenever an employee leaves the social media team and close monitoring to watch for anomalies.

(Something as simple as routine password changes would have saved the 257-store British entertainment chain HMV from an internal Twitter hijacking in December, when a former member of the retailer’s social media team tweeted layoffs in real time while the chain’s marketing director scrambled to shut down the Twitter feed.)

That’s preventive medicine. But chains also need a kill switch—the ability to shut things down quickly, regardless of whether the security failure is within the chain or on Twitter’s or Facebook’s side. That means acquiring an actual human contact at each social media company (they’re in short supply) and making sure there’s a process to disable the account, fast.

That may not be easy. Social media companies are really set up to handle customer-service problems with automated forms, so Walmart (NYSE:WMT) has to get in line behind every other Twitter tweeter whose account has been compromised. Chains are in the unfamiliar position of not being huge customers of Twitter and Facebook, so they don’t automatically qualify for special treatment.

That means it’s time to start talking to the big social media companies you deal with. If your social media is handled by an outside agency, it might be able to make progress. But sometimes a C-level title makes an impression that makes a difference.

And now is a good time to start that process. Twitter is likely to be very receptive. Facebook knows it’s next in line. With luck and their cooperation, you could end up with a relatively clean kill-switch process that minimizes the time between a social media takeover by hackers and recapturing your page. Without that, you may just have to watch your social media accounts and have a “we’ve been hacked” form constantly queued up and ready to send.

What’s certain is that the Burger King scenario will happen again, and someone is going to be first in line. You really don’t want it to be you.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.