Risks and risk mitigation measures in social media use by Mobile telephone operators in Kenya
Mobile telephone operators in Kenya have been using social media in their business activities. The objectives of this study were to determine the extent to which social media is used by mobile operators in Kenya, to identify the risks that mobile operators are exposed to when they use social media and to determine the mitigation measures that they have put in place in order to mitigate the risks. A descriptive survey research design targeting managers in the Human Resource, Marketing, Customer Service, Operations, Legal, Social Media and Information Technology departments in the four mobile operators in Kenya was adopted at the time of the study. The study utilized primary data that was collected through a selfadministered structured questionnaire. One of the key findings of the study was that social media had been widely adopted by the mobile telephone operators in Kenya. Secondly, the study established that mobile operators were exposed to social engineering attacks, disclosure of intellectual property rights, disclosure of confidential information, malware spread and non-compliance to privacy laws when they use social media. Lastly, the study established that mobile operators enforced social media policies, monitored activity on their social media sites, trained their employees and used symbols in risk communication to mitigate their exposure to social media risks. The study recommended that the mobile operators should adopt a training model that includes an annual or bi-annual refresher sessions for all employees in addition to the first social media training that is done when the employees are newly employed in order to increase the state of awareness of social media risks. The study also recommended that the mobile phone operators should adopt a co-ordinated and integrated approach to social media policy development. Lastly, mobile telephone operators who do not have disaster management plans should develop them in order to have a clear set of procedures to use in decision making in case of a social media breach or attack.