# MA-734.072019: MyCERT Alert - Alert on Facebook Best Practices

**Date:** 23 Jul 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-734.072019  
**Advisory ID:** MA-734.072019

---

**1.0 Introduction**
MyCERT has been receiving quite a number of incidents from the public involving their Facebook accounts, such as Facebook account compromise, impersonating valid Facebook profiles for scam purposes and existence of fake Facebook profiles. Therefore it is important for public to practice extra precautious while using Facebook, for example ensuring their personal or sensitive information such as name, address, financial information, credentials and healthcare information is safeguarded and not easily shared through the internet. Facebook profiles, including those of Page admins, may be targeted to gain access to contacts and sensitive information. It’s crucial to secure your Facebook account in order to protect your information in the profile.
**2.0 Recommendations**
Table below are some recommendations for public to protect their sensitive information when using Facebook.
| --- | **Protect Your Account** | **Protect your password**  Don’t use your Facebook password anywhere else online and never share your password. You should be the only one who knows it. Avoid using personally identifiable information that can be easily discovered such as your name, phone number, birthdate, mailing address, etc. Your password should be difficult to guess.  **Login Alerts**  Use login alerts to get notifications if your account is being logged into from a new or different device.  You will find login alerts in the [Security section](https://www.facebook.com/settings?tab=security), under Settings. When you turn on login alerts, we’ll send you an email or notification each time someone logs into your account from a new place.  **Login Approvals**  Use login approvals, found in the same Security section highlighted above, as an extra security feature that can be used for two-factor authentication. There are 3 different ways you can retrieve your special security code:   1. Facebook will send you a text message (SMS; charges may apply) with a login code each time you need one. 2. You can get 10 codes to print, write down, or save for when you need them. 3. You can use Code Generator if you have the Facebook app on your smartphone or tablet. | **Protect Your Information** | **Manage Your Privacy**  If you plan to post to a public audience using your profile instead of a Page, the following tools can help you manage your privacy.   - On your computer, you can curate lists of friends. This will control who can see what you share on Facebook. - Use [Privacy Checkup](https://www.facebook.com/help/443357099140264) to make sure you are only sharing information and posts with the people you want to. - You can also visit the Privacy section under Settings to see who can see your posts, who can contact you, and who can look you up. - Monitor activity on your Facebook profile by viewing your Activity Log, or if you’re on a computer, see how others see your profile by selecting "View As," to the right side of your cover photo.   **Pages and Page Admin Roles**  Pages are for organizations and public figures to connect with a global audience through sharing stories, creating events, and more. Pages look similar to personal profiles, but they offer unique tools (such as insights, ads, and comment moderation) to engage with an audience.  There is no limit to how many people can like a Page, and Page information and posts are public and generally available to everyone on Facebook. Anyone can like a Page to connect with it and get updates in their own News Feed.  Pages have admins who can monitor and control what content is shown on the page. There are different administrative roles with varying levels of access for people who manage Pages, so it’s important that the role assigned to each person is 
**3.0 Other Best Practices**
Apart from the recommendation above, MyCERT also advise home user to:
1. Make sure your PCs and browsers are up-to-date with the latest upgrades and security patches.
2. Install Anti-Virus software on your PCs to scans and blocks any malware to the PC. The Anti-virus should be regularly updated with the latest signature files in order to detect new worms/viruses.
3. Do not simply click on links and attachments that they receive via social networking sites or emails. Extra precautions must be taken when opening the links and attachments.
4. Do not fall victim to online scams. Take precautions against online scams that target Internet users.
5. Users are recommended the following tips and guidelines on social networking site at:
<https://www.cybersecurity.my/data/content_files/11/918.pdf>
6. Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done on daily basis and this data should be kept on a separate device, stored offline at an alternate site.
7. Report any incidents 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**4.0    References**
- <https://www.facebook.com/settings?tab=security>
- <https://www.facebook.com/help/443357099140264>
- <https://www.facebook.com/help/289207354498410>
- <https://l.facebook.com/l.php?u=https%3A%2F%2Ffacebookcorewwwi.onion%2F&h=AT0MUd-HkO-gBo-IvGwHdeyNoVAZQw8zywDKFqijBoEzC0-u0tg6RXAc-6gV8rUNQk1h2-Wr0pzNfw8lmRlwJ1n7WX1sNuiu5Yxby5wpuPk3q-nxyMMoArvmRVLKbTk9nQoHR5nonw0o8Ef4vSXKxEzraVk>
- <https://www.facebook.com/help/reportlinks>
- <https://www.cybersecurity.my/data/content_files/11/918.pdf>