Web 2.0 Applications and Sites (and Security Concerns)

One expert's breakdown of security issues created by social networking sites, BitTorrent and other Web 2.0 technologies

By , Senior Editor

August 08, 2008 — CSO — A recent survey released by security software firm Symantec found 66 percent of Millennial employees, those born after 1980, admit to using Web 2.0 technologies, such as Facebook and YouTube, while at work. The same poll found younger workers also regularly store corporate data on personal devices, such as PCs and USB drives.

Meanwhile, 75 percent of corporate IT managers surveyed by Symantec said they have policies that restrict corporate data and information on personal devices and 85 percent of corporate IT managers had policies restricting download and installation of software on work PCs for personal use.

Security managers may need to rethink their risk assessment and strategy to adapt to the technology habits of today's workforce. So, exactly which technologies are commonly used by younger generations in the office? And what are the specific threats they pose to an organization?

Aaron Wilson, assistant vice president, chief technology officer and acting chief engineer in the Managed Security Services division of Science Applications International Corp., a security and consulting firm based in San Diego, CA., compiled this list of the technologies that are now pervasive — and what you should be aware of when managing your network.

Peer to Peer (P2P) File Sharing
Examples: Torrents, Kazaa
Threat: Possible malware, transmission of copyrighted/sensitive data, productivity
Prevention: Intelligent content proxy, UTM (unified threat management), host-based protection
Possible scenario: An employee with an improperly configured P2P application could inadvertently share their entire hard drive, exposing all of the data to millions of other P2P users.

Social Networking
Example: MySpace, YouTube, FaceBook, blogs
Threat: information exposure, possible malware, productivity
Prevent: user training, intelligent content proxy, website rating tech, host-based protection
Possible scenario: Users posting pictures of to their blogs from the workplace. Consider pictures of secured areas which could pose a threat to national security (think airport). In the commercial world, pictures and details of unreleased products can fuel competitors and damage sales.

[For recent examles of technical threats against social networking sites, see A Photo That Can Steal Your Facebook Account and Sophos: Facebook Malware Attack Puts Work Computers at Risk.]

Instant Messaging(IM)
Example: AIM/MSN/ICQ/Yahoo/IRC, and phone texting
Impact: Depends on what's being discussed. Do you know? Username/password, data leaking, file sharing, social engineering.
Tech: Deploy your own enterprise IM/VOIP solution with crypto, logging, policies. Train employees.
Possible scenario: Support staff using unencrypted IM to send root passwords, IP information, drag/drop network diagrams, etc, all of which could be intercepted and used against the company.

Removable Media
Example: USB thumbdrive, camera/phones, iPod/pda, laptop, Wifi
Impact: information exposure, difficult to track
Tech: Digital Rights Management (DRM) and to a lesser extent Data Leak Prevention (DLP)
Possible scenario: One of the best known examples would be the USB drives found at a bazaar in Afghanistan containing US military secrets in 2006.

Read more about data protection in CSOonline's Data Protection section.

Other stories by Joan Goodchild

RESOURCE CENTER