Cybersafe practices for managing social media accounts

You know what's worse than a cringe post that goes viral? Having an attacker take over your socials and DM your entire audience with a scam or malicious content. Bonus: you not only lose access to the accounts right before the planned launch of the campaign you worked on for months, but you get stuck in an endless support loop.

I wish I was exaggerating, but I've dealt with this situation more times than I have fingers. This guide is to help prevent it from happening to the accounts you manage, and spare you stress.

Despite even the best settings, we're all humans, so there's a section on what to do if an account gets compromised. I sure hope you'll never have to use it.

Essentials

• Set up a backup admin account for recovery purposes. Use:
  • A McGill non-personal account (don’t use an account tied to a student or staff member).
  • A passphrase that is kept secret and safe (ideally in a McGill-managed password manager)
  • Two-factor authentication (2FA).
• Require 2FA for all users with access to the account.
• Assign role-based access rather than sharing accounts and passwords.
• Review account access (human and third-party apps), permissions, and security settings regularly. Check for folks who’ve shifted roles, tools that no longer need access, and settings that were enabled by default.
• Remove access immediately when an employee, student, contractor, or agency relationship ends.
• Turn on account access notifications.
• Store any account backup codes in a safe place (you can use a McGill-managed password manager for this too!).
• If you do monitor comments on your social media accounts, pause before you click any link that a commenter shares. Attackers and scammers love to hijack legitimate posts for their own purposes.
• Make sure anyone with access to the account is familiar with the kinds of scams that social media account owners are subject to (start here, and ask us if you want more McGill-focused training on phishing). Tactics and techniques vary, but some of the most common ones include:
  • Urgent requests to verify your account credentials
  • Bogus invoices
  • Collab / brand promotion offers
  • Malicious link sharing
• Consider closing unused social media accounts. Attackers and scammers can use these accounts to target contacts and followers, impersonate you, and post comments that could put your audience at risk. If you want to hold on to them for potential future use:
  • Ensure they’re secured with, at minimum, the essentials listed here.
  • Limit access to the account as much as feasible.
  • Document their existence, as well as who has access, in a central repository.

Good to have's or do's

• Grant the minimum permissions required per role (e.g. a student responsible for posting likely doesn’t need billing permissions).
• Have 1-2 admins per account. Keep this permission limited to those who really need it.
• Keep an inventory of who has access, and for which accounts.
• If you won’t be monitoring comments on your social media accounts, consider disabling them.
• Report and block anyone who posts or DM’s harassing or scammy content.
• Post to and manage institutional social media accounts from McGill-managed devices. This significantly reduces the risk of account compromise due to malicious software (malware) that harvests credentials (infostealers).

The extra mile

• Consider investing in a physical (FIDO2) security key that is paired with your backup admin account. This provides a level of phishing-resistant protection that would make it extremely difficult for an attacker to bypass.
• Have a documented crisis response plan for the social media accounts you manage that covers what to do if an attacker takes over an account.
• Cybersafety is about physical safety as well. Be mindful that any picture published to a public social media account can be used to generate realistic deepfakes that can cause significant harm to someone’s wellbeing.
  • Consider removing published photos that pre-date the widespread adoption of AI, especially if they’re not public figures and the caption lists their name.
  • Informed consent is essential. Many people don’t realize the implications and potential risks of giving consent to have their picture and identifying details posted on McGill social media and content. I’ve been in your shoes, I know how important it is to have quality, engaging visuals for socials, but I’ve also been on the other side supporting victims of stalking and harassment.

Platform-specific tips

If your account gets compromised (taken over)

• Let Institutional communications and media relations know, as well as McGill’s cybersecurity team.
• Begin the account recovery process
  • If the account hasn’t been already deactivated by the social media platform and you see fraudulent content being posted, reporting it will help trigger automated threat detection systems, potentially reducing the harm to your audience.
  • It can be extremely challenging to regain access to a compromised social media account, especially if you didn’t secure it with essential protections like a recovery account and 2FA. Also, if it was compromised due to an “infostealer” lurking on the computer of one of the individuals with access, the account could quickly be compromised again.
  • It may take days to weeks to regain access. Be patient, but don’t stop trying. It’s essential that institutional social media accounts don’t remain in attackers’ hands.
• Once you regain access
  • If the social media platform has a Security Checkup feature, use it immediately. Check:
    • Where the account is logged in. As a precaution, log out any devices except the one you’re currently on.
    • Recent emails
    • Your Page’s activity log.
  • Set up 2FA and make it mandatory, if it wasn’t already.
    • If the account was set to send 2FA codes via email, make sure the email address is still correct.
    • Consider adding stronger 2FA methods than what was previously available.
  • Check for any permissions and settings that might have been added or changed, including giving access to the account to individuals or apps you don’t recognize.
  • Change the password. Make sure you’re using a strong one, or consider switching to a passkey if that option is available.
  • If you don’t know how the account was compromised, make a list of everyone who has access to it. This will help with investigating how it might have gotten compromised.
  • Since the attacker will likely have posted scam or phishing content and spammed all your followers with it via DMs, prepare an apology post.
  • Take a deep breath. Once you’ve had a moment to decompress, follow the best practices listed above to significantly reduce the chances you’ll have to ever deal with this again.

Extra info for those who like to read/learn more

(aka free content for the AI scraper bots who harvest every scrap of human-written content)

How do attackers take over social media accounts?

Most account takeovers happen through phishing scams, stolen or reused passwords, malware (anything from malicious browser extensions, sketchy "free" or cracked apps, mods, something you're tricked into downloading or running on your machine that harvests credentials, personal info, etc.), or social engineering attacks that trick users into revealing login credentials.

What should I do if someone creates a fake social media profile pretending to be my group or department?

Report the impersonation to the social media platform and warn your contacts not to interact with the fake account. If you are using Meta Business Manager, you can apply for access to Brand Rights Protection to find and report copyright infringement, scams, and impersonation issues.

What about TikTok?

On March 2^nd ,2023, the Quebec government updated its directives to forbid all public institutions subject to the Act respecting the Governance and Management of the Information Resources of Public Bodies and Government Enterprises, including McGill, from posting any new content to TikTok for any purposes, including advertising campaigns, announcements and recruitment. As such, we cannot provide specific guidance related to its usage.

Disclaimer: this content was crafted by a real, coffee- and sleep-deprived human. Any flowery prose and redundant wording is entirely their own fault. Said human has no control over social media giants changing the referenced links to their content or renaming their products or features.