Security threats Toolkit

Businesses warned over Web 2.0 security

Tags:
Clearswift,
Office Workers,
Cross Site Scripting,
Simpson

Tom Espiner ZDNet.co.uk

Published: 26 Mar 2007 16:37 BST

Security vendor Clearswift has advised companies to review or implement security policies and procedures around Web 2.0 applications after a survey found that 42 percent of company employees aged 18 to 29 had discussed work-related issues on social media websites.

The survey, which was commissioned by Clearswift and conducted by YouGov, polled more than 1,000 business employees. Clearswift said that the results of the survey illustrate how widely-used Web 2.0 social communication has become, and that this signalled a risk of leakage of confidential company information.

Some marketers have attempted to harness social-networking sites such as YouTube for their campaigns, while many corporates are keen to use wikis, RSS and content tagging because of clear user benefits.

However, 59 percent of office workers in the 18 to 29 age bracket believe they should be entitled to use Web 2.0 content from their work computer for personal reasons.

"The younger generation have never known a business world without the internet. Young office workers come out of university having used social-networking sites. They see nothing unacceptable using corporate resources for personal use," said Ian Bowles, chief operations officer for Clearswift. "Content is king. If you have policies around content, you can control what's going on, and prevent partial disclosure of financial results, or product design leaks."

As well as risks to company intellectual property, Clearswift highlighted risks that arise from using Web 2.0 technologies themselves. According to Clearswift's ThreatLab manager, Pete Simpson, Ajax and XML code used to develop web applications mean those applications can potentially be subverted. "To secure a website is not trivial," said Simpson. "For a determined and skilled attacker, there are many ways to inject malicious code into a network. You can inject JavaScript code into a web page using cross-site scripting, for example."

Cross-site scripting (XSS) involves injecting malicious code into pages served by other domains. An attacker can gain access privileges to sensitive page content and session cookies by exploiting XSS vulnerabilities.