Web 2.0 – Hype, Reality and Security

I have been reading a lot lately on Web 2.0. There are numerous articles and commentaries that range from “Its hype” to
“It’s changing the world” to “Its YouTube”.

There is no doubt that today, millions of people put content on the Web using sites such as Myspace, Facebook and Linkedin. There are numerous Blog sites such as this one, and then aggregation services like Technorati and Feedburner.

The scale is astounding. If I read it correctly, there are close to 8 million Blogs on Technorati, and on Myspace it says that more than 700,000 Blogs have been updated today!

These sites are much more than hype – they are phenomenally successful at attracting users.

So is there a security implication if they are used in a business environment?

Security company Sophos seem to argue that there is. Sophos publish a Security threat update, and if you haven’t read it, I recommend it.

www.sophos.com/pressoffice/news/articles/2007/07/securityrep.html

This Sophos report states that virus writers are placing malware on third-party web sites – and they suggest that about 80% of all web-based malware is being hosted on innocent, but compromised, sites.

Sadly, malicious code is also placed on the social networking sites. Sophos quote that in March 2007 the SpaceStalk spyware Trojan was discovered embedded in a QuickTime movie on a Myspace page.

So, how do you protect your users and resources from this malicious code? Do you block these sites?