Can Social Networking Be Secure at Work?

CIO — As more workers spend a greater part of their days on social networks like Facebook and Twitter, hackers have turned their energies toward spreading their malware across those services, harming workstations and company networks.

That's the contention of a recent report measuring Web 2.0-targeted hacks that occurred in the first quarter of this year and was conducted by the Secure Enterprise 2.0 Forum, an industry group aimed at enabling the safe use of social media in the workplace.

Increasingly, hackers have turned their attentions away from e-mail, in part due to the fact people spend more of their time communicating with friends, family and colleagues over mediums like Facebook and Twitter. In addition, the e-mail environment has reached a level of maturity that makes the new frontier of social networks more attractive to hackers and spammers, says David Lavenda, a vice president at WorkLightt, a vendor that sponsored the study.

"E-mail is in a steady state," Lavenda says. "It's an electronic warfare game with spammers, filters and security tools, and it's reached some sort of status quo. With the new [social] tools, as people come online and get more involved with them, there is an opportunity to cause harm."

The list of security hacks on Web 2.0 and social networking sites were impressive, the report found. Nearly one-fifth were caused by authentication hacking (where someone is able to gather user names and passwords). Others included database hacking (21 percent), content spoofing (11 percent) and cross site scripting (XSS), an incident where malicious code runs on a webpage and eventually can enable phishing attacks.

The consequences of these types of hacks can be incredibly harmful. According to the report, nearly 30 percent lead to the leakage of sensitive information. Around 13 percent resulted in actual monetary loss, while more than 10 percent installed malware on computers or their corresponding networks.

The report will likely fuel the resolve of CIOs and heads of technology who have banned social networks in the workplace. By most measures, nearly half of employers have gone that route out of concerns about security and productivity.

Lavenda's company, WorkLight, has a vested interest in the study: It provides enterprises with a server that allows them to move company information over consumer portals like Facebook and iGoogle without it living on the servers of those sites.

The company takes a different approach to social networking than other Enterprise 2.0 vendors. ("Enterprise 2.0" is a marketing term used to describe how Web 2.0 technologies are mimicked for enterprise use.) While most focus on creating new enterprise software based on blog, wiki or social networking technology, WorkLight claims that it allows your employees to stay (safely) on their favorite consumer sites to connect with each other and customers and partners.

In the market, Lavenda says CIOs have been more willing to let employees use the tools, but have been at times reluctant, due to anecdotal stories about security breaches. The report, he says, will allow them to know what those threats are and make informed decisions about letting users access the sites.

"Forbid it or not, most CIOs know users will find a way to use these tools anyway," he says. "Even if they don't buy our product, this report moves the market forward because they know what the threats are and can see about addressing them. Once you know what the threats are, then you can go about mitigating them."

C.G. Lynch covers social and consumer applications for CIO. You can follow him on Twitter at @cglynch.