In this RSA‑sponsored interview, host Diane Macedo talks with online‑security specialist Robert Siciliano about the dangers young adults face on social media and the broader internet. Siciliano cites a survey of 1,000 18‑ to 24‑year‑olds showing that 91 % friend strangers on Facebook, and he warns that the digital footprints created now can damage future job prospects. He outlines the scale of identity‑theft (≈10 million victims and $54 billion in fraud annually) and explains how seemingly innocuous personal details—birth dates, addresses, pet or child names—can be used to crack passwords or answer security questions. The conversation moves to practical hygiene: strong, unique passwords; avoiding password‑recovery questions that are answered by public profiles; never using public PCs; securing laptops on free Wi‑Fi with up‑to‑date antivirus, firewalls, and encrypted connections; and recognizing that Macs are as vulnerable as PCs to phishing and botnet‑driven attacks (e.g., the Zeus botnet). Finally, Siciliano advises proactive reputation management: regularly Google yourself, remove unwanted content, and publish positive material (e.g., blogs) to push favorable results higher in search rankings.
Chapters
Welcome back to the On the Job Hunt segment. I'm Diane Macedo. And of course, we keep talking on this show about using the internet to network, and networking is so key to job hunting. But of course, we all know that every time you put yourself out there, you also run the risk of having your identity stolen and, more importantly, everything that you've worked so hard for. So here to help us keep that from happening, Robert Siciliano is here, and you're an online security and ID theft expert, is that correct?
Yes, I'm with RSA and maintainmyprivacy.com.
So Robert, I work for a website. Whether I like it or not, I'm on social media all the time.
Yeah.
And you have some statistics that scared me a little bit today. Why don't you hit us with those and elaborate a little bit on them for me?
So I'm on social media all the time too. I have hundreds of friends on Facebook. I probably know like 10 of them, right? And all of these people are people who find me and they want to, you know, align themselves with me, you know, a credible expert and so forth.
Well, and sometimes, you know, you kind of know them, you don't want to say no, maybe every now and then you'll say hello, but they're not someone that you're regularly friends with.
Right.
Should I not friend those people?
Well, as long as you're communicating professionally on Facebook and other social networks, that's okay.
Okay.
But here's what we found in our study.
Uh-huh.
We surveyed 1,000 18- to 24-year-olds, and we found that 91% of those on Facebook and other social on social networks are friending people who they've never met, who they have no idea who they are.
Okay, that's weird.
Yeah, 91%. That's a lot. It really is. I know people college age that have thousands of friends. I mean, how could you possibly be 19 years old and have thousands of friends? And that said, this age group, 18 to 24, they're saying and doing things online via social networking sites, posting pictures and so forth, that may bite them someday.
Of course.
You know, I, uh, Araceli and I, we were quoted in Newsweek this week, and I had stated jokingly that if everything that I did from the age of 16 on was cataloged, I probably wouldn't be having this conversation right now. You know, uh, but that's the reality today, in that our— we are living in the fishbowl, and online reputation management today means making sure that what you say and what you do is not going to have negative repercussions when you're on the job, when you're hunting for a job, or may get you fired from a job.
Yeah. And so how do you keep that balance? Because I'm on social media both for work and for pleasure. And so how do I go about continuing to socialize with my friends, keep in touch with them, you know, what these things were made for, while still maintaining that barrier between what's public and private? Or is that even possible?
Well, we've heard the term, you know, think before you click, think before you post, think before you upload that picture, and that's really how everybody should be thinking at this point. I think the ages, you know, 18 years old, your brain hasn't fully got the fact that eventually you're going to be 28 and then 38 and then 48.
Right, you're not thinking that far ahead when you're 18. You just want to make new friends.
Right, and so there is a fine line that you cannot cross. Things that you say, things that you do, pictures that you post, videos that you upload, and if it If you think that, you know, the principal of your school or the professor in your university, it's something that they might frown upon, or the potential job that you apply for, they might have an issue with it, it's probably not something that you should upload.
Now what about in terms of ID theft? Because that's a big concern even for those of us who are adults and do understand that you don't post crazy pictures on Facebook. I mean, my identity is still vulnerable and people can still steal that.
Identity theft certainly is a major issue. There are as many as 10 billion people, uh, 10 million, millions of people being affected by this crime every single year.
Right.
You know, $54 billion in fraud, 10 million people every single year. So this is one of those problems that unfortunately is going to keep getting worse and it's not going to get any better anytime soon. And if you're posting personal information in social networks, that allows someone to gather enough data on you to actually commit fraud, to use that information against you, to crack certain passwords. That you might use as qualifying questions for your email program, let's say.
Okay.
Right? That's a problem. If you're posting name, address, generally, you know, that's public information at a certain degree. But if you're posting data that could be used to crack the code, that certainly, you know, opens up a whole ball of wax. That's when identities are stolen.
Okay. Like what? I mean, obviously we were all told never give away your Social Security number unless you absolutely have to for, you know, for a legitimate reason. But aside from that, what is this barrier of information that we're supposed to protect? Because people say that all the time, but I don't really know what I'm putting out there that people could be using to crack the code, so to speak.
Well, what I recommend that you do is maybe keep your date of birth off of social media.
Mm-hmm.
Don't post your address, picture, names of pets, names of kids. If these are all phrases that you might use as passwords, that's something to be concerned about. So that means beef up your passwords. If these same phrases are the answers to questions, like when you forget your password for your email program and you click a link and it says you forgot your password, and then you have to answer qualifying questions like what high school did you go to, what was your mother's maiden name, stuff like that.
Don't ask yourself questions that you have on your Facebook profile.
Exactly. Yeah, yeah. And what we're finding is that 73% of those polled are concerned about issues of fraud and identity theft, while 71% are doing things to put themselves at risk. You know, they're keeping their PC online all day long, logged into these different social networking sites. They are sharing passwords with people that they know that ultimately could compromise them. They're putting their passwords on little sticky yellow notes on the side of their monitor. That's obviously a red flag.
So now, I mean, these all seem a little bit common sense, but are there any tips that sort of dig a little bit deeper that we might not have considered?
Well, certainly being aware of public PCs. Many, you know, students are using public terminals like in internet cafes and in libraries to access social media, to access online banking, to access, you know, documentation that might have more information in it. And when you use public PCs, there very well can be keyloggers, spyware, on these PCs that ultimately will compromise your usernames and passwords. So never use public PCs out in the wild.
What about just general Wi-Fi? I, I take my own laptop down to Starbucks or whatever to do some work. Is that not okay?
If you're gonna use your laptop to do some work, just make sure your laptop PC has updated antivirus and you have spyware removal programs that you are connecting to a secure wireless connection, opposed to free wireless. And generally you want to make sure that your firewall is set up so the bad guy can't come in. See, we have— what's going on right now is this phenomenon called a botnet. Now a botnet is a robot network of computers, right? Now a botnet is a bank of PCs, could be 4 million PCs. There's a botnet called Zeus, right? They call this botnet Zeus, and all these computers connected to the The botnet, again, this robot network of computers, are all slaves, they're all zombies, right? And all these zombie PCs, they are all PCs that are in our homes and our offices and connected to the internet in these internet cafes. And they all have viruses on them that allow a criminal hacker to remotely access and control those computers. So when RSA and MaintainMyPrivacy.com did that study, when they found this out, we wanted to make sure that all those connected to the internet understand that You know, this isn't a game anymore. This is real. That the bad guy is winning this battle with 4 million computers with this one virus, with this one botnet, you've got to know that this is a really big problem.
So should you never be using free Wi-Fi? What if you don't have a choice?
Well, if you're going to be using free Wi-Fi, just make sure your PC is generally secure, right? Make sure that you're not banking online via free Wi-Fi.
Right.
So you're not doing things—
Don't do anything that's too— it's too close to home.
If you're in a public Wi-Fi and you are accessing pertinent identifying information, entering usernames and passwords for online banking that ultimately someone could capture, they could sniff out that wireless information, then you probably want to change your habits.
Okay. And you keep saying PC. What if you're working with a Mac?
Mac are just as vulnerable as PCs are. It is a myth that Macs are more secure. Generally, if you receive a phishing type of an email, phishing with a PH, an email that looks like it's coming from your bank, it looks like it's coming from PayPal, if you're on a Mac or you're on a PC, you click the links in the body of that email, you're vulnerable. You're providing your username and your password to a 14-year-old Romanian hacker. I mean, that's really what's going on today.
I'm laughing, but I know it's not funny. Yeah.
So, you know, and other things that you can do, you know, right now I suggest that everybody go out and they Google themselves. You know, go online and find out what's being said about you. To manage your online reputation, you want to make sure that there isn't information in the first 2 or 3 pages of search that shows up regarding your identity that are pictures or videos or things that are being said about you or by you. That could bite you someday.
Okay.
And the way you manage your online reputation is to know what's going on out there, right? To make sure you're not doing anything or saying anything or posting anything that's going to get you in trouble. And then also what's good today is to blog, right? If you blog yourself, you're burying any of the other negative stuff.
So that's how you get positive links to come up to the top of your—
Exactly.
Of your searches on Google or Bing or whatever search engine you're using.
Exactly. You want to make sure that you control your online reputation by doing and saying things
