To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://software.silicon.com/security/0,39024655,39166552,00.htm

Web 2.0 security warning for business
Mind the leaks...

By Tom Espiner

Published: Tuesday 27 March 2007

Security vendor Clearswift has advised companies to review or implement security policies and procedures around web 2.0 applications after a survey found that 42 per cent of company employees aged 18 to 29 had discussed work-related issues on social media websites.

The survey, which was commissioned by Clearswift and conducted by YouGov, polled more than 1,000 business employees. Clearswift said the results of the survey illustrate how widely used web 2.0 social communication has become, and that this signalled a risk of leakage of confidential company information.

Some marketers have attempted to harness social-networking sites such as YouTube for their campaigns, while many corporates are keen to use wikis, RSS and content tagging because of clear user benefits.

However, 59 per cent of office workers in the 18 to 29 age bracket believe they should be entitled to use web 2.0 content from their work computer for personal reasons.

Ian Bowles, chief operations officer for Clearswift, said: "The younger generation have never known a business world without the internet. Young office workers come out of university having used social-networking sites. They see nothing unacceptable using corporate resources for personal use. Content is king. If you have policies around content, you can control what's going on, and prevent partial disclosure of financial results, or product design leaks."

As well as risks to company intellectual property, Clearswift highlighted risks that arise from using web 2.0 technologies themselves. According to Clearswift's ThreatLab manager, Pete Simpson, Ajax and XML code used to develop web applications mean those applications can potentially be subverted. "To secure a website is not trivial," said Simpson. "For a determined and skilled attacker, there are many ways to inject malicious code into a network. You can inject JavaScript code into a web page using cross-site scripting, for example."

Cross-site scripting (XSS) involves injecting malicious code into pages served by other domains. An attacker can gain access privileges to sensitive page content and session cookies by exploiting XSS vulnerabilities.

Tom Espiner writes for ZDNet UK