Web 2.0 threats catch enterprises unprepared: survey

Enterprises are not prepared for the security threats posed by Web 2.0 technologies, because they use insufficient Web filtering and have failed to train users and make employees aware of potential risks, a Forrester Research survey found.

Bandwidth is also being sucked up by employees using Web 2.0 staples such MySpace, YouTube, RSS feeds, Google Maps, blogs and wikis, often for nonbusiness purposes. This unofficial use of Web 2.0 applications along with their inherent security threats complicates the decision-making processes for corporations that want to safeguard data while embracing collaborative technologies in ways that enhance productivity.

“Organizations are struggling to maintain a balance between the need to regulate Internet usage and making effective use of what the Internet and Web 2.0 has to offer,” Forrester states in a new report commissioned by the vendor Secure Computing.

Forrester surveyed 153 IT and security professionals at enterprises with at least 1,000 employees about their concerns and approaches to dealing with Web 2.0 risks. One-third of the organizations reported data leaks that caused significant problems, while more than half are extremely concerned about viruses and Trojans.

Almost every official surveyed thinks they are prepared for Web-borne threats, but a look at their actual practices shows they are not, Forrester reports.

Most enterprises primarily use gateway URL filtering and antivirus scanning for Web security, but zero-day attacks must be caught using behavioral and heuristics-based detection. Only one out of four enterprises use behavioral analysis to detect zero-day malware, and 37% use heuristics-based detection, Forrester’s survey found.

“Despite the fear for malware and its disruptive consequences, organizations are not doing enough to protect themselves,” the report states.

Substantial majorities of surveyed businesses have been hit by viruses and spyware in the past year, and 12% have found zombie computers within their networks.

Forrester also examined bandwidth consumption related to Web 2.0. More than half the organizations surveyed say at least 30% of their bandwidth is consumed by nonbusiness use of rich media and social networking sites like YouTube, MySpace and Facebook. One out of seven enterprise executives say sites like these consume more than half of their Web bandwidth.

Businesses are also suffering decreases in employee productivity since employees log on to many of these sites for personal use.

The main challenges for businesses going forward are personal use of social networking, user-contributed content, mobile content services, enterprise integration of Web 2.0 services via mashups, and increased risk of data leaks, according to Forrester.

The research and consulting firm offers a few pieces of advice: examine the adequacy of security policies and protection capabilities; improve user awareness training on Web 2.0 and other Web-borne threats; and use next-generation Web filtering technologies, like reputation services, content filtering, blended threat protection, heuristics and behavior-based detection.