Social Media Policy

What You'll Learn

• Identify types of corporate information that should not appear on personal or professional social media profiles
• Evaluate social media posts for operational security risks including location data, org charts, and technology details
• Rewrite social media content to remove sensitive information while preserving the original message's purpose
• Recognize how attackers mine public social media profiles to build pretexting scenarios for targeted attacks
• Apply your organization's social media policy to ambiguous situations where personal expression and corporate risk overlap

Training Steps

1. Welcome to Catalyst Innovations

   Welcome to Catalyst Innovations! You are Alice, a product manager working on several high-profile client partnerships. It's a regular Wednesday morning. Alice has settled into her home office and is about to check her messages.

2. A Message from Mark

   Alice's phone buzzes with a Telegram notification from her colleague Mark Chen, a senior developer on the team.

3. Mark's LinkedOut Post

   Curious about what Mark shared, Alice opens LinkedOut on her desktop to find his post.

4. What Mark Shared

   Mark's post is enthusiastic, but take a closer look at what information he has publicly revealed.

5. An Email from TechForge

   Five days have passed. Alice receives an email apparently from TechForge Solutions about the Project Helios collaboration.

6. Clicking the Link

   The email looks legitimate - it references Project Helios, mentions Mark by name, and knows about the Q2 deadline. Alice clicks the link to access the partner portal.

7. Logging Into the Portal

   The partner portal asks Alice to log in with her work credentials.

8. Authentication Error

   The page shows an authentication error. That's strange - Alice is sure she typed her password correctly. A knot forms in her stomach. Why isn't it working? She decides to wait and try again later, but the uneasy feeling lingers.

9. Something Is Wrong

   Two hours later, Alice receives an urgent email from the Catalyst Innovations Security Operations Center.

10. The Sender Domain

    Alice realizes what happened. Let's go back to the original email and examine the red flags she missed. First - the sender's email address.