Corporate Collaboration Meets Social Media. Sarah Carter, Vice President, Actiance, Inc.

Transcription

1 Corporate Collaboration Meets Social Media Sarah Carter, Vice President, Actiance, Inc. Learn how to bring social media in line with other corporate communication tools Discover why enterprise communications tools don t meet compliance needs Find out how to meet compliance regulations for social media and real-time communication tools 1 1

2 Agenda I ll explain why I m here Social media has changed the way we communicate Who wants to use it? Why do they want to use it? Cautions with Social Media Who s actually using it? What are the risks of using social media Best Practice for Using Social Media So what can you control with Technology? Eight Tips for Immediate Success & Control Why am I standing here today? I run social media for Actiance I have a global remit, with varied experience From driving taxi s, to taking companies through IPO, to training teams on Social Media, to implementing campaigns, to an officer of the company. I work with clients in Financial Services, Utilities, Energy on policies, best practice Social Media adoption I was a late adopter, but now My name is Sarah and I m social. LinkedIn: Facebook: Actiance 3 2

3 What s your social profile? Why am I presenting to you today? I run social media for Actiance I have a global remit, with varied experience Taxi Driver Taking companies through IPO Ran IS accreditation team Training teams on Social Media, I engage with regulators and agencies worldwide and work with Actiance customers worldwide on policies, best practice Social Media adoption. LinkedIn: 3

4 About Actiance Enable the New Internet 5,000+ Web 2.0 apps, Unified Communications, Social Networks Global operations USA, EMEA, India, Asia/Pacific Market Leader 9 of the top 10 US banks 3 of the top 5 energy companies Federal, State and Local Government Broadest Partner Ecosystem Technology alliances 4

5 Enterprise Communications & Collaboration Growth 5

6 The Internet has Changed Public IM P2P Anonymizers VoIP Social Networks Games Virtual Worlds IPTV Financial IM Unified Communications Web Conferencing VoIP Remote Admin Tools Source: FaceTime Annual Greynets Surveys & Projected Users : Perception vs Reality Perception: 60% of IT Professionals estimated IM was used on their network Reality: 98% used IM Perception: 62% of IT Professionals estimated social networking was used within their corporate network Reality: 100% used social networking Actual customer traffic history (150+ organizations) Representing all Internet activity from over 150K end users 6

7 Why Use Social? The size of the market 600m +90m + 140m Listen, Learn, Discuss, Share, Collaborate Our response is tribal Generate buzz and increase visibility Engagement for the future Collaborate Worldwide, like never before Strengthen Alumni connections Extend your brand LinkedIn by the Numbers & What? Site was launched on May 5, 2003 Over 120 million users 2 billion people searches in 2010 All Fortune 500 executives are members More than two million companies have LinkedIn Company Pages LinkedIn Profile/Co page Basic info Employment history Education Summary 7

8 Facebook by the Numbers Born on February 4, 2004 Over 750 million active users 250 million MOBILE users 700 billion minutes per month spent on Facebook 30 billion pieces of content shared each month 2.5 million websites have integrated with Facebook Facebook Pages Personal Fan Group Community Basic info Credentials Interests, hobbies, etc. Objective Twitter by the Numbers Site was launched in July 2006 Over 190 million users 100 million tweets written per day Over 1,100 tweets written per second 140-character limit for tweets Twitter Profile Basic info Location Brief description Find Connections Engage, Communicate, Answer 8

9 So who s using Social Media? And Why? Sales & Marketing Promotions Advertising Branding HR Background checks Recruiting Scientists & Researchers Information exchange Collaboration IT Investigation of security breaches Students and Analysts Collaboration Social Media Types of Usage Institution LinkedIn Company Pages Department Twitter Account Facebook Fan Page YouTube Channel Individual Professional My LinkedIn Profile Groups I belong to Questions I answer Status updates I place My Facebook profile Family, friends, colleagues My Twitter Account (@SarahActiance) Personal commentary Professional promotion What s personal and what s professional? address? ID as someone who works for the organization? what are the rules? 9

10 How many people in your agency/department use social media? Introducing Risk into the Organization Data Leakage Incoming Threats Compliance & ediscovery User Behavior 10

11 Web 2.0 & Social Networks Regulation & Compliance Regulation SEC and FINRA Gramm-Leach-Bliley Act (GLBA) PCI Red Flag Rules Social Network and Web 2.0 Impact Obliged to store records and make accessible. Public correspondence requires approval, review and retention. Extended to social media. Protect information, monitor for sensitive content, and ensure not sent over public channels (e.g., Twitter) Ensuring cardholder data is not sent over unsecured channels AND PROVING IT. Prevent identity theft. Protect IM and Web 2.0 from malware and phishing when users are more likely to drop their guard. FRCP (ediscovery) and IM are ESI. Posts to social media sites must be preserved if reasonably determined to be discoverable. Web 2.0 & Social Networks Regulation & Compliance Regulation Social Networks and Web 2.0 Impact Sarbanes-Oxley (SOX) Canadian Securities Administrators National Instrument (CSA NI) Investment Dealers Association of Canada (IDA29.7) MiFID and FSA Markets in Financial Instruments Directive (EU) Model Requirements for the management of Electronic Records (MoReq) Businesses must preserve information relevant to the company reporting. Retain records for two years, in a manner that allows rapid recovery to a regulator, Can extend to IM and social media. Demands the retention of records with respect to business activities, regardless of its medium of creation. Specifically requires the retention of electronic communications conversations when trades are referenced. European requirements for the retention of electronic records. 11

12 Pg. 22 FINRA Regulatory Notice 10-06: Guidelines for Social Networks Regulation SEC Rules 17a-3 and 17a-4 and NASD Rule 3110 Social Network and Web 2.0 Impact Retain records of communications related to business Public Appearances Prior Approvals Participation FINRA Regulatory Notice Restrict Personnel Electronic forum & chat rooms, content posted to social media may constitute a public appearance Wall postings require prior approvals Real-time participation on social networks equals participation For instance communications between research and investment banking departments should be restricted Only those subject to firms supervision should have access, provide training prior to engagement, prohibit or restrict those who pose a compliance risk. Restrict access with technology. 12

13 FINRA Regulatory Notice Social Media Websites AND use of personal devices for business communications Key Topics Communications with the Public Social Network and Web 2.0 Impact Further clarification on personal versus business communications. Personal Electronic Devices Record Keeping SEA Rule 17a-4 : communications relating to the business as such. Independent of the ownership of the device. A reminder to preserve records of business communications, for a period of not less than three year. No difference between static and interactive content retention requirements Social Networking Websites Supervision A change from Approvals in the form in which they will be launched. Interactive content can become static.: Therefore NASD 2210 applies and pre approval is required.. Appropriate training is required. A Best Practice Approach to Social Media 13

14 Best Practices for Social Media Usage Research social media usage Draft a social media policy Identify who needs access Determine extent of access Archive Moderate, if necessary Research social media usage Find out if employees/students are already using social media to do work-related tasks How many public-facing pages do they have? How many Facebook, LinkedIn, and Twitter accounts do they have? Are they actively using these social media tools? 14

15 Draft a social media policy WITH THE STAKEHOLDERS Be clear on what the policy covers Which sites Permissible uses Ramifications for breach Effective date Archiving policy Disseminate the policy company-wide Make sure everyone understands it Inform users of updates to the policy Identify who needs access What are the objectives for social media? Who really needs to use to reach the objectives? Marketing HR, Admissions IT Legal Alumni / Researchers 15

16 Ensure your Users are Educated Risks Appropriate Actions Sanctions Compliance Requirements Re Educate Determine extent of use Read-only? Write-only? Which sites? Which sections/features of specific sites? Engagement with Colleagues/Students? Confidential and Proprietary 2011, Actiance, Inc. All rights reserved. 16

17 Archiving Archive everything relevant (what about irrelevance?) Include posts to all social media sites, including messages that were blocked by the administrator Log user activities for each site session Retain data for however long the applicable legislation/regulations says for you to keep it Moderation If necessary, moderate or pre approve the content before external publication to ensure compliance (pre-review) If it s post-review, take down inappropriate content Apply lexicons to make the review process more efficient Use alerts to notify admins of questionable content Use warnings to caution individuals about what they re posting 17

18 Review and Revise February 3, million people Things change! Appropriate Technological Controls 18

19 Appropriate Controls: The Basics Who s using social media in the organization? Which groups or individuals need to be monitored? What controls need to be applied? How do I implement and manage the controls? Defining the Issues Requiring Control Issue Identity management Activity control Granular application control Control Requirements Ensure that all the different logins of an individual link back to corporate identity Posting of content allowed for marketing but read-only for everyone else Employees can access Facebook, but not Facebook Chat or Facebook Games Anti-malware Data leak prevention Moderation Logging and archiving Export of data Protect network against hidden phishing or Trojan attacks Protect organization from employees disclosing sensitive information Messages posted only upon approval by designated officer Log all content posted to social networks Export stored data to any archive or WORM storage 19

20 Eight Tips to Security, Productivity, Compliance 1. Understand the landscape, get visibility 2. Engage stakeholders in policy setting. Set the policy. 3. Consider and address the risks, in a granular fashion. 4. Understand the moving legal and regulatory situation. 5. Provide education for your users on acceptable and appropriate use. 6. Understand and manage the fallibility of human beings. 7. Record and retain (appropriate) communications. 8. Review and refine policies (regularly) I can t emphasize 10 enough changes across Facebook, LinkedIn, Twitter since Jan 1,

21 Questions, Further Reading Specific Questions? (desk) 21