I will be the first to admit to using social media for both personal and professional use. And it seems like every other day there's another scam circulating on Facebook (see Graham's blog entry here for the latest) or some news about security and Twitter. But this particular piece is not directly aimed at social media sites, but at the users.I've said it many times before that while social media sites are somewhat responsible for the security of their users, users, too, share a bulk of the burden. And we at Sophos continue to see that, overall, social media sites are keeping up their ends of the bargain. But what about the users?

In a word, FAIL.

If users were taking security seriously, then the scams you see above would not be successful. People would see them for what they are and delete or ignore them. So why is it people are falling for them over and over again? Is social engineering really this powerful?

To be blunt, yes. People have such a high trust factor on these sites. They still want to believe their friends are best-intentioned and what they are being sent from their buddies is legit. Whether it be a "free iPhone/iPad" or "OMG! Check this shocking video," most people will believe that if it comes from a friend, it must be real/true. (Remember the whole, "If it's on the Internet it must be true" from the early '90s or so?) How can one instill a healthy paranoia and a reasonable dose of skeptisim?

Another problem is simply reaching all of these users. Most of the readers of this are tech- and security-savvy. They read all of the right blogs and websites to keep up on the latest happenings. Usually these people don't get scammed. But how to we reach the casual Web user? What about the grandmother who simply wants to keep up with her family? Facebook has now hit 500 million active users. Twitter has hit 145 million users. Friendster has 90 million. Is it even possible to reach that many users?

I've wondered about social media sites offering "tutorials," such as "Spot the phish" or "Is your personal information safe?" But would it even be possible to reach that many users? Sure, you could require it at the next login, just as you would when accepting a new terms and service agreement, but again, would people actually read it or would they click through it as fast as possible to get to the site? I'm certainly open to dialog and suggestions.

Beth Jones is a Senior Threat Researcher in SophosLabs North America. She manages the day-to-day research and analysis activities of incoming suspicious malware threats and potentially unwanted applications that arrive in the Lab via Sophos customers, partners, and prospects.