[CITL] Meta / Facebook Business Account Security

[Jonathan Ocab]

Due to a possible emerging threat related to Meta (Facebook) Business
Accounts (soon to be rebranded as Meta Business Portfolios), the
Information Security Office is sending out the following guidance.

The ISO recommends that all units operating a Meta (Facebook) Business
Account:

1. Regularly audit all roles and permissions for the Business Account to
ensure only the appropriate personnel have administrative access.
2. Ensure that all users with roles for that account have Two-Factor
Authentication configured and enabled - ref.
https://www.facebook.com/help/148233965247823
3. Enable the 2FA requirement on the Meta (Facebook) Business Account -
ref. https://www.facebook.com/business/help/280940009201586
4. Ensure that the primary email account used for the respective user's
Facebook account has multifactor enabled.

In the event that a UCR-related Meta Business Account is breached, we ask
that the incident is reported to the Information Security Office using
ServiceLink - https://its.ucr.edu -> Stay Secure -> Report a security
concern.

If you have any further questions regarding this topic, please email
infosecoffice at ucr.edu.

Thank you.

---
Jonathan Ocab | jonathan.ocab at ucr.edu
Manager, Information Security Operations
Information Security Office
University of California, Riverside
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ucr.edu/pipermail/citl/attachments/20240130/98c26f42/attachment.html>