Forrester: social networks and enterprise, what are the risks?

Forrester has published a study looking at the risks brought about by the integration of large public social networks inside enterprises, raising issues about certain elements.

By interviewing 900 IT managers in North American and Europe, the research group Forrester has attempted to evaluate the risks of large scale use of social networks within enterprise.

The results show that 26% of interviewed managers already use general public social networks for internal and external needs, while 12% are planning to either implement such a strategy of updating their existing one. 6% of respondents are looking to integrate social networks into their activity.

Combined, this is a rather significant number contribution, with this indicating that almost 50% of companies are more or less engaged in integrating such services into their company. The other 50% of companies are either not interested in social networks or are not planning to look at this activity in the future.

For enterprise security managers, numerous threats have been identified which need to be taken into account. These are notably linked to malware risks and attempted phishing attacks which have the aim of installing malicious software within the enterprise network.

Another concern is that potential loss of sensitive data through employees who are not up to date with the current network security policies. Finally, managers also point out that an enterprises image may take a hit through the use of existing accounts used for external attacks, or even fake accounts being created through hijacked systems.


Caution about malware, phishing and spam
Forrester has identified numerous risks linked to the use of social networks. For Facebook, the major threat is malware and phishing, although security can also be put at risk through the creation of third party applications using the Facebook API, increasing the security risk for an enterprise.

As for Twitter, the risk of spam is greater through the use of malicious URL’s sent to users. This is primarily linked to bad user habits, with users opening and following everything that is sent to them, allowing a malicious user to take advantage of this by quickly creating thousands of user accounts which can then be used to spread hijacked URL links.

Finally, the professional social network LinkedIn has been named as a potential problem if not followed closely by enterprise when corporate accounts are in use. A person not aligned with the company may be able to integrate themselves into dedicated groups, with sensitive information then being potentially leaked through the social network to them.

Despite these risks, the research group doesn’t believe abandoning social networks within enterprise is the answer, preferring instead to enforce a use policy that users are aware of. Before any information is shared by users on such networks, they should be aware that strict user controls need to be adhered to depending on their role within the enterprise, while restricted use should be enforced when possible.