What's the business value? - It's important to consider whether utilizing these tools will add any real value to your organization. At the same time, the phrase "if you can't beat ‘em, join ‘em" comes into play here. If there aren't any social media activities/technologies sponsored at the corporate level, your folks will likely put something out there anyway and without your control. When this happens, it quickly spins out of control.

A company contemplating starting a blog or utilizing social networking sites should:

• Produce policies, standards and procedures
• Training regarding business strategy for use of such sites
• Update and refresh material as necessary to be sure the messages are always accurate
• Measure success and quality distribution channels

Evaluate the security and risk - The most effective way I've found to illustrate security risk is to educate by example. For instance, say you have a sales person who uses LinkedIn to create a network of business connections. Sounds great, right? Not always - anyone can easily view this person's connections and see who many of their current and past clients and co-workers may be.

Here's another example. Technical people may use support blogs and forums to post questions about challenges and problems. Again, while this certainly has value to the individual, these posts often provide huge insight into an organization's IT infrastructure. I think we can all agree attackers would love to get their hands on this type of information.

Security-related items to consider include:

• Information use guidelines and policies:
• Dictate what content can/should be published
• Comply with company's confidential guidelines
• In-line with company's image and vision
• Respect all copyrights and trademarks
• Train employees on publishing materials and document the results of this training

Don't forget to assess and review - How do you know if these sites are effective? How do you know what information is being put out "there" if you don't check for it? This is a key part to understanding effectiveness and finding examples of policy breach to utilize for training purposes.

This final step should include:

• Identify authorized persons or agencies to access social media websites
• Monitor for information leakage
• Automated tools are your friend
• Gather proof for training

I know this might seem a little overwhelming, but taking note of even a few of these could make a difference (in a good way!) for your organization. I'll continue to use this blog as a way to offer tips - keeping the line of communication open on the "risks and rewards" of social media.