Reputation Management
All social media results in both a reputation opportunity and challenge for the company. For a small company, any damaging information spread through social media venues might be disastrous for the company whereas for a larger company, a damaging story can be weathered. But how the reputation and brand of any company gets affected by social media and what the company does to manage, monitor, and report on activity are the key to successful reputation management.
Assessing the Current Environment
Reputation management starts with establishing a baseline for your organization’s brand equity. What is your current brand equity and how would you measure it? Unless you can measure the brand value, you do not know how to allocate your security budget and the processes and technologies to secure your brand. Currently, brands worth millions of dollars in value have invested nothing in social media management. A brand and a company’s stock price can be damaged by a single viral video on YouTube. A great example is the YouTube song by musician Dave Carroll. His guitar was broken on a United Airlines flight, and the airline did not compensate him and treated him poorly. Dave wrote a song about the incident. The song, which went viral on YouTube, had over 9 million hits. The Times newspaper reported that the video caused United Airline stock to drop 10 percent.4
4Chris Ayers, “Revenge Is Best Served Cold—on YouTube,” The Times (July 22, 2009, http://www.timesonline.co.uk/tol/comment/columnists/chris_ayres/article6722407.ece.
Information Gathering
The next step in assessing a brand’s reputation is determining the risk of external attacks and the defense tactics needed. Finding this information is a daily 24/7 effort. Your IT security department can implement tools to track reputation attacks. But you also need to be aware of third parties that are completely external to your company and determine what kind of response you might need to those attacks on your reputation. One example of a tool to track mentions of your brand or name is IceRocket (www.icerocket.com), as shown in Figure 2-2. Using IceRocket, you can begin tracking what is being said about your company Twitter account or brand name.
Figure 2-2 IceRocket tracking of key Twitter terms
Crisis management is a significant aspect of a security response plan. You have to analyze your current capabilities to respond to an attack both from a technology perspective such as stolen profile information and from a brand perspective such as the fake BP Twitter account. What policies and practices do you have in place if a crisis were to occur today and how will you address gaps you find in your crisis management plan regarding social media attacks?
In crisis management, there are various roles to play. What is the role of IT versus HR versus Marketing in a crisis? How do you determine when crisis is security-related versus marketing-related? This is a gray area unless you do some scenario analysis prior to actually having a crisis. In some cases, the Marketing department itself may set off a crisis. A bad campaign can launch a chain of events that leads to an attack on the company’s brand and reputation. For example, the hugely successful online couponing website Groupon ran controversial Super Bowl ads in 2011 making light of some serious social causes. Their efforts to raise funds for those same causes were completely lost on the public, who expressed their disapproval across social media platforms. How do you analyze whether your marketing campaigns affect your security model? Does your marketing team actually notify your security team when a major social media campaign is about to be launched? Are there team meetings between the groups? What is Marketing’s responsibility in terms of monitoring activity versus IT’s responsibility when a new campaign is launched? IT and Marketing should work together to select the right reputation management tools. One example of a tool is Social Mention (www.socialmention.com). Figure 2-3 shows an example of the data that can be tracked using Social Mention. Key functions of these types of tools include measurements of “sentiment,” activity, keywords, along with what is being posted and tracking important mentions.
Figure 2-3 Using Social Mention for reputation managment
Prior to social media campaigns, if a marketing campaign were to be launched, there might be some IT support involved. Perhaps IT would set up e-mail lists or a new website. Now Marketing teams can create social media profiles on Facebook and launch a whole campaign without involving IT and determining beforehand if there are any security implications. A marketing campaign can instigate a cyber attack against the brand without IT being involved. Without the proper tools in place, measuring reputation attacks is hard. What tools should IT use to support Marketing functions and understand the impact on reputation management? Whose responsibility is it to defend the brand? There are a number of challenges that IT needs to address along with other departments to address reputation risk.
Measuring the Current State: H.U.M.O.R. Matrix
Table 2-11 shows how these risks can be assessed in our fictional company JAG Consumer Electronics. JAG is, of course, weak in this area as well because no real tools have been implemented to track what the public is saying about JAG. There is no tracking of any potential mentions of JAG in a Twitter post or blog post. JAG has some capability to determine the value of their brand but no way to measure the effect of the attacks that could devalue the brand. As IT is not notified in advance, they can’t work consistently with other departments when it comes to launching social media campaigns.
