Mike Talon's Home on the Web

March 14, 2012

By Mike Talon
in Dos and Don’ts
No Comments

Twitter is one of the first places people think about when you say the term Social Media. While Twitter didn’t start the web 2.0 revolution, they did have a pretty big hand in shaping it.

So, what are some guidelines for using Twitter as an Information Worker?

Do’s:

– Do get an image. Using the default “newbie” icon for Twitter is always – ALWAYS – a bad idea. Find an image that is small enough to fit as a user icon, and that represents you, then use it. You can change this on the Profile or Bio page of your account. Remember to respect copyrights and trademarks and only use images you have the right to use.

– Do tweet about all kinds of things. Sticking to just corporate news is a sure way to lose followers fast. Try tweeting about things going on in your life that have some connection to your work. For example, if you make auto parts, talk about the work you’re doing on your own car outside of the parts you sell yourself.

– Do know what you can tweet about. Many companies have strict policies on what can, and cannot be said on Twitter by employees who are affiliated with the company. Make sure you only tweet information that is cleared and ok to send.

– Do remember it’s a conversation. Twitter is not a one-way communication tool, and so you should reply to people, start and participate in conversations, and generally remember that you don’t want to sound like a guy on a street-corner with a megaphone.

– Do keep your ratio. There’s a great temptation to follow a large number of people, but this is not a great strategy. If you’re following hundreds more people than follow you back, most experienced Twitter users will shy away from following you. The reason for this is simple, mass-following is a well-known technique employed by spammers, so you get hit with guilt by association. Start out by following no more than 25 people than follow you back, and stay at that ratio until you’re over 500 followers, then you can open it up to 50.

– Do balance your tweet types. It’s always best to mix up what you’re tweeting. Send some text, some links and some ReTweets (RT’s), and not too many of any one type. Mixing your content types allows others to see that you have a lot to share, that you’re not just spamming press releases, and that you interact with the community.

– Do keep multiple accounts for work and play. If you think you might want to tweet about stuff that isn’t acceptable to your boss, create a different account to do that. This account should clearly state that it is yours, and not affiliated with any particular company at all.

Don’ts:

– Do not spam, ever. Though the temptation is to blast your message out to everyone all the time; keep in mind that Twitter is a conversation and make sure you’re not just spamming links to random people.

– Do not engage in “link building behaviors.” This one is critical. Many so-called Twitter “experts” will tell you to follow thousands of people, then unfollow anyone not following you back. That’s bad for a large number of reasons, not the least of which is that you’ll lose any legitimate followers you were going to get and be left with a huge list of followers who don’t listen to your message anyway. Avoid buying followers or using faulty methods like “TeamFollowBack” and the like. Be a real person, the followers will… well… follow.

– Do not DM on Follow. This is a massively annoying habit most so-called experts still engage in. Direct Messaging someone just to say “thanks for following” – or worse, pelting them with your links and ads, is a sure way to get people to immediately UN-follow you. DM’s are typically sent to mobile devices and generate alerts on the desktop, mobile, etc. This is quite annoying to anyone who gets them and finds out that they’re nothing but a “hello” message.

– Do not sweat it if people don’t follow back. You’ll find that some people don’t follow you back. Don’t worry about it. Keep doing all the things you should do, and many folks will follow you. Annoying one person who doesn’t follow you with @Replies is a sure way to ensure that many more people don’t follow you – so it’s counterproductive.

– Do not tweet on behalf of your company. That is, unless you have express permission to do so, of course. Remember that you’re someone who works *for* that company, you are not officially representing that company. Many folks have gotten in a lot of trouble for speaking on behalf of their employers.

– Do not EVER forget that Twitter is public. Even DM’s can become public in some circumstances, and if you’re tweeting for work, then your boss is looking. A lot of headaches due to this can be avoided if you follow the “Do” about keeping work and personal accounts separate.

If you’re looking for a much more comprehensive list of what not to do on Twitter, have a look at Snipe’s page on why you should not be a “Social Media Marketer” – NOTE: it’s not safe for work.

Photo Credit: Twitter

March 7, 2012

By Mike Talon
in Dos and Don’ts
No Comments

Every organization is made of people. That’s both good and bad. People make the company what it is, and that’s good. People also have opinions – which is usually good, but can become bad if they’re not representative of your brand and organization.

You can control access to the official corporate Twitter feeds, Facebook pages and LinkedIn accounts, but what happens when employees tag, retweet and link to those pages from their own accounts? That’s where a clear and comprehensive Social Media Policy (SMP) comes into play.

The SMP needs to clearly state what is acceptable and unacceptable for tweets and posts that are linked or tagged to the corporate identities. In other words, you should have language in the policy that clearly states that anything that goes against company policies (like disorderly conduct, HR violations, etc.) should never be linked or tagged to a corporate identity. Ever. For any reason at all.

The policy should also detail what rights and responsibilities an employee has if they choose to affiliate their personal accounts with the company via logos, images, re-tweet streams, etc. If you believe you have control over any account that has your company logo on it – for example – you need to state that very clearly and directly to avoid problems later on.

Of course, if your firm is particularly conservative in these matters, you may simply have a blanket policy that says that only the corporate identities can have anything to do with the company on Social Media. That’s usually a very bad thing to do, as it will severely limit your ability to take advantage of a lot of opportunities that leveraging employees can bring to the table. However, if that is indeed the way you want to operate, every employee needs to know it as soon as possible to avoid confusion, embarrassment and bad blood.

Finally, don’t make the mistake of believing your current employment agreements have you covered. If those agreements haven’t been updated in 3-5 years, you need to revisit them and ensure that the sections on intellectual property and corporate ownership of resources have been updated to operate in the digital age.

Photo Credit: Mr. Norris

February 28, 2012

By Mike Talon
in Dos and Don’ts, Security
No Comments

When using social media services, the biggest mistake folks make is to believe – even for a minute – that anything they say is private. That leads to embarrassment, possible employment termination, and lots of other consequences.

For example, many users believe that their Twitter direct messages are not shared with anyone but the recipient. That’s not necessarily the case.

When you DM someone on Twitter, the message can be seen by everyone who subscribes to their timeline if:

– There is an image attached to the DM – image services are not private, and will carry the text of the message as a caption to the image on the photo-sharing site.

– There’s a link or you use a tweet shortening service (like TwitLonger). This one burns people even more than the image services, as you may have a shortening service enabled for all tweets in a 3rd-Party Twitter product on your desktop or phone. Bit.ly links and other URL shorteners are also public, so links in tweets can become public very easily.

– They retweet it. Twitter will try to stop them from doing that, but there lots of ways around that.

– You accidentally replied instead of sending a DM. It’s easy to do, and you’d be surprised how many times it happens.

On Facebook, all the default security settings make nearly everything in your profile and posts public information. Even if you think your data is shielded, a change to profile information policies can flip things to public without warning – it’s already happened several times.

The same goes for Pinterest and other sharing sites. Even though you can try to keep everything private, the sites are designed from the ground up to share, and with one wrong click the world can see whatever you posted.

Just before this went to post, Eileen Brown posted an article that proves the point. Twitter is allowing 3rd-Party companies to mine historical data from their archive, which means that your tweets could be used by another company. While they don’t seem to want to expose DM’s, one poorly-coded script could make that happen.

So, use social media wisely. Remember that it’s supposed to be SOCIAL, and that sites and networks are designed to facilitate public communication. Even if you think something is private, there’s a good chance it’s not – or it may become public later.

Photo Credit: floeschie

February 23, 2012

By Mike Talon
in Security
No Comments

Well, that happened faster than I thought.

Yesterday, I spent quite a few hours rebuilding my blogs, as nearly all of them managed to get hacked. It was a porn-site redirection attack, inserting javascript into each and every PHP page in the WordPress system.

It started with one blog, but by midday, it had spread to three of my four sites. The site that got hit first was the newest one, so it was surprising that a site with very little traffic was indeed a target to someone out there.

While this issue is never fun to deal with, I expected it would happen at some point, and took the appropriate precautions. They saved my bacon.

Luckily, I have a few friends in the security world, who had armed me properly for how to identify and overcome an attack like this. They also had me prepare to block such attacks, but in this case the hacker found a way around the defenses. That’s not unusual, as new attacks are created every day, and tools like WordPress firewalls and exploit scanners only update so fast.

So, how do you prepare for a potential attack?

1 – Prep your site. Install plug-ins to ward off the more common attacks before they hit. The WordPress Firewall and Exploit Scanner can help quite a lot with this. Both tools were able to deflect quite a few attempts to access my sites before whoever got there yesterday found a back door.

2 – Know what’s on your site – always. There’s a great plugin called WordPress File Monitor that scans your files regularly to see if anything has changed, and alerts you by email when it finds anything that has changed. Sometimes, it gets annoying, but this time it let me know that all my WordPress files had changed at once. This was something that allowed me to address and fix the problem so much faster than I would have been able to do otherwise.

3 – Back everything up. There are plugins that can back up entire WordPress sites – with their content databases – to Amazon S3, DropBox, or your hard drive. Use them! If you do get attacked, you will have to restore from a backup, and so you better have one handy. I had been backing up, but a configuration error meant that many posts ware lost. I have copies, but that will take some time to restore manually.

Luckily for me, I saw the attack happen, confirmed it, and started cleaning up everything all within hours of the actual attack. That kept my readers safe and my headaches limited to the fact that I mis-configured my backup and lost some posts.

And if you do get hacked?

@Snipeyhead – a noted WordPress Security expert – has posted a great guide on what to do next. You can find it via this link. [Note, she does not pull punches, verbally or visually, so her site is very mildly NSFW] The article is a bit old, but the strategy is sound, well researched, and spot-on still today. Follow the process she shows in that post, and recover what got hit before your visitors get infected by drive-by downloads or you lose face due to defacing of your sites.

Remember, change ALL passwords, including the FTP/sFTP logins and your web host login. That’s in addition to the site logins, database logins/users, and any other security info you have on your site. If you can’t identify how you got hacked, then play it safe and change everything.

Now that everything is back online, I can say I weathered the storm. It can be MUCH worse, and it’s never fun, but you can indeed overcome attacks against your site quickly and effectively if you prepare ahead of time.

Photo Credit: neoliminal