Our company has pages on LinkedIn, Facebook and Instagram and a channel on YouTube, and for years they were run by the marketing team with no involvement from IT. That seemed reasonable. They were marketing's pages, and none of them ran on anything we owned.
Last autumn a post appeared on our LinkedIn page at eleven at night advertising vacancies for drivers. It linked to an application form outside our domain that asked for a bank account number and a copy of a passport "for payroll". It stayed up for nine hours and was shared about forty times before our marketing manager took it down the next morning. We reported it to the platform and to the police.
When we asked who could post as the company, nobody had a list. Each platform keeps its own administrators, added one at a time by whoever was already an administrator, using personal accounts. Across the four platforms nineteen people could post or manage. Seven of them no longer worked for us, including a former marketing manager, two interns and a design agency we had stopped using in 2023. The post came from the agency's account, which had been taken over after one of its staff reused a password from a breached site. The agency did not know until we told them.
None of our controls applied. Our leaver process disabled the company account, but these were personal logins on somebody else's platform, beyond the reach of our single sign on. Two step sign in was left to each individual.
The pages now have an owner in marketing and a second owner in my team. Every platform has at least two administrators who are current employees, and nobody outside the company holds more than the lowest role that lets them post. Agencies get access for the length of their contract, with the end date in our contract register, and are removed on that date. Where a platform offers business management tools, access goes through them rather than personal invitations. Every administrator must use two step sign in. The leaver checklist asks whether the person holds a role on any company page, and the list of people who do is reviewed every quarter.
A company page speaks in the company's voice to every customer and candidate we have. We had protected far less important things far more carefully.
– Serguey Shinder
Top comments (0)