In Max Fisher’s new book The Chaos Machine, the New York Times reporter delves into the history of social media companies and how they affect our lives.

He talked with IT Brew last week about how social media can present threats to cybersecurity—and what IT professionals need to understand about the online ecosystem. Here’s some of that conversation.

This interview has been edited and condensed for clarity.

In your book, you write about the celebrity hacks of 2014. Do companies share responsibility for disseminating this material? Where’s the line between people’s right to free expression and a social media company’s responsibility?

The major social media companies have gotten more proactive about removing hacked materials, especially stolen materials that are used to embarrass or humiliate a target. But at the same time, their promotional systems have become only more aggressive at surfacing and pushing out…things that are getting a lot of attention, things that promote outrage, things that are seen as really salacious or scandalous, and that just happens to include hacked materials.

So, in some ways, it’s gotten better because the companies don’t outwardly take this view anymore of, “Well, it’s your problem if material got hacked and leaked on our website and our website is promoting it.” But in the ways that matter, it’s gotten significantly worse, because the systems are so effective at pushing that out.

What are the social engineering implications of social media when it comes to security—revealing personal information and the like—and how can IT teams protect against that?

There are three trends that are coming together to create a different sort of IT security threat than the ones that we’ve traditionally thought about, like threats from Blackhat groups…hackers who are in it to make a buck for profit, or nation states.

Read the rest here.—EH

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @EoinHiggins_ on Twitter.

Cybersecurity insurance questionnaires—a way for the insurer to understand a prospect’s defenses—used to be brief.

Do you have AV? Do you have a firewall?

Just a few years ago, answering “yes” to those two questions put you pretty firmly on a path to getting cyber-covered, said Jason Rebholz, CISO at Corvus Insurance.

Now, with the costly stakes of ransomware and business email compromise (BEC), insurers need extra pages to confirm security controls. The longer questionnaires suggest that insurers want a deeper understanding of an organization’s defenses against attacks that could literally cost millions.

“If you’re in the higher end of the SMB market, certainly in the midmarket and in the larger organizations, you’re looking at a minimum of 25 to 50 detailed questions,” Rebholz told IT Brew.

Questions like, “How are your data backups protected and configured?” might be on the list, for example, along with “What vendor are you using for endpoint detection and response (EDR)?”

BEC and ransomware. A July 2022 report from IBM revealed two tough price tags. The average cost of a data breach, via business email compromise: $4.89 million. For ransomware (minus the ransom): $4.54 million.

“When you look at the largest costs for cyber insurance carriers in terms of security incidents: It’s ransomware and it’s business email compromise,” said Rebholz.

Let’s play Risk. Risk level, given the array of cyberthreats, is not agreed upon.

“Every insurance agency, every brokerage, they’re all asking different questions,” said Shawn Wiora, CEO of the risk-quantification provider Maxxsure.

To demonstrate varying priorities, a 2022 Panaseer survey of 400 global insurers revealed a range of “most important factors when assessing a security posture.” These were cloud security, security awareness, and application security, to name a few.

Read more here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @BillyHurls on Twitter.

Today’s top IT reads.

Stat: 25%. That’s the amount OpenStore’s valuation has increased since November 2021, per a new funding round. (TechCrunch)

Quote: “The firm has not recovered the vast majority of the devices.”—the SEC, announcing a settlement with Morgan Stanley that includes a $35 million fine for “extensive failures to safeguard personal information of millions of customers” (CNN)

Read: How AI image-making without limits offers users the ability to create both fantasies and horrors. (Wired)

How IT’s goin’: What’s the state of modern physical security? Rhombus surveyed 250+ physical security pros in the IT world to find out. See which strategies Fortune 500 companies leverage and how priorities have shifted in Rhombus’ report.*

^{*This is sponsored advertising content.}