Return to main newsletter

The Sophos poll revealed that 63 per cent of system administrators worry their employees share too much personal information via their social networking profiles, putting the corporate infrastructure - and the sensitive data stored on it - at risk. The survey findings also indicate that a quarter of businesses have been the victim of spam, phishing or malware attacks via sites like Twitter, Facebook, LinkedIn and MySpace.

"Let's not also forget that social networking sites can have beneficial business purposes for some firms too, giving them the chance to network with existing customers and potential prospects."

Graham Cluley
Senior Technology Consultant, Sophos

What is your primary reason for controlling access?

Cyber-attacks: a new frontier

From traditional scams that aim to fool users into sending money to foreign destinations under the ruse that a friend is in trouble, to malware disguised as Facebook error messages, cybercriminals are using the same old techniques, but pushing them out via social media.

A typical method of attack is for hackers to compromise accounts by stealing usernames and passwords - often using phishing or spyware - and then, use this profile to send spam or malicious links to the victims' online friends and colleagues. Sophos research reveals that one third of respondents have been spammed on social networking sites, while almost one quarter (21 per cent) have been the victim of targeted phishing or malware attacks.

Have you, or any of your colleagues, ever been...

Total lockdown is not necessarily the answer

With social networking behaviour firmly ingrained in many employees' daily routines, Sophos experts predict that users will continue to share information inappropriately, putting their identities - and potentially the organisation they work for - at risk. However, banning social networking in the workplace outright may be a rash move - one that could cause more harm than good.

Cluley explained: “The danger is that by completely denying staff access to their favourite social networking site, organisations will drive their employees to find a way round the ban. Let's not also forget that social networking sites can have beneficial business purposes for some firms too, giving them the chance to network with existing customers and potential prospects."

Sophos concludes that social networking sites are here to stay and urges businesses to find a practical way to work with these sites - not against them. By adopting a more holistic approach - including investment in greater security and control solutions, as well as offering comprehensive user education - organisations will be better equipped to deal with social networking risks.

Top five Sophos tips to help business and users stay safe:

Educate your workforce about online risks - make sure all employees are aware of the impact that their actions could have on the corporate network

Consider filtering access to certain social networking sites at specific times - this can be easily set by user groups or time periods for example

Check the information that your organisation and staff share online - if sensitive business data is being shared, evaluate the situation and act as appropriate

Review your Web 2.0 security settings regularly - users should only be sharing work-related information with trusted parties

Ensure that you have a solution in place that can proactively scan all websites for malware, spam and phishing content

Source: Sophos online poll, 709 respondents, February 2009.

Please bear in mind that this poll is not scientific and is provided for information purposes only. The comments expressed are those of a subsection of poll participants, and not necessarily those of Sophos. Sophos makes no guarantees about the accuracy of the results other than that they reflect the choices of the users who participated.

Click here to download Datasheet on SaaS Web Security and learn more about URL and Web Content Filtering, Internet Access Control and Web Threat Protection.