Cybersecurity Challenges in Social Media Erdal Ozkaya

4.6.5
 
Identifying targeted phishing attempts 
A determined attacker will take time to study the social media account of a particular 
user just to identify the weak spots they can exploit. An accountant, for example, could get a 
message from a purported senior manager on Facebook asking for some amount of money to 
be sent to a certain bank account. An underlying and superficial excuse could be that the 
senior manager wishes to keep that information off the records since it would be impugning 
to his or her reputation to have delayed in paying the person the money is being sent to. An 
IT officer could get an inbox on social media from a user claiming to be a colleague in the 
same organization who has forgotten her email password and wishes to get it so that some 
urgent files can be sent to her boss. There are many other scenarios, where targeted phishing 
may be used in order to get a user to divulge some information or comply with malicious 
requests of users. Mostly, they will masquerade as people known by the target. It is not 
suspicious for a user to reach out to an IT officer on Facebook anyway. Targeted phishing 

---

75 
attacks are particularly dangerous due to the length that the attackers take to get something 
that the target will yield to. 
4.6.6
 
Managing accidental disclosures 
At times, social media users end up disclosing very sensitive information. For 
example, one can unknowingly give out his or her social security number. A picture of one’s 
new work laptop could also show a nearby piece of paper that has a number of login 
credentials listed on it. Some posts may disclose one’s bank account number or debt status 
and other private information that should remain private. Therefore, users ought to be careful 
when posting information. They should look keenly at what they are posting to ensure that 
there is no sensitive information that will be disclosed.