What's the real reason behind blocking the social sites? Even legitimate sites like twitter which acts as a knowledge repository?

Question

I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?

Answer 1

There are all sorts of security risks - the ones I tend to highlight are:

• The big social networking sites are a wonderful target for attackers. Imagine a group of over a billion users, most of whom are not technically savvy, that all use the same web app (eg Facebook) and have personal data, links to others etc. So take it as read that these sites are continually targeted by well funded attackers and (slightly) more reputable companies who use the functionality of the application to gain significant access to your machine or data (eg Farmville) which may include passwords you may reuse elsewhere.
• Additionally, the large pool of users accessing the same application means a zero-day in that application will be very rewarding.
• A company that allows social networking has very little egress control over data - so how can you protect against the leakage of sensitive data? Think of the Wikileaks implications...

Obviously you also have the time-wasting aspect - social networking can be a huge time-sink. One thing to be aware of is that now everyone and their dog has a smart phone, the social networks are available whether or not you allow it on the company network, so the time wasting may still be an issue.

Answer 2

Number 1 - as others have mentioned - is control: you should be working, not playing on facebook, or telling your dog on twitter that you just got yelled at by your boss (for playing on facebook).

Number 2 - is bandwidth. Even if there is plenty of bandwith available, there is no reason to waste it on, well, sites that you shouldnt be using when you're working. And if it's not being used - then they can cut their pipe, and pay less to the ISP...

I think that in most organizations, except for the most secure/paranoid, its not really about security. And in many of those places, there's no Internet at all, anyway...

Answer 3

In short - because you should be working. And, in general, any truly relevant knowledge available via social sites is equally available elsewhere.

Answer 4

Others have pointed out that social sites are loaded with malware and waste people's time. However, there are surely legitimate business uses for social sites like leveraging them for sales and marketing. Therefore organizations need to implement network security technology that enable them to enforce policies that control who has access to which social networks and for what purposes.

Answer 5

Many of you mentioned time-wastage as a reason for preventing access to social networking websites.

An interesting response to this is a local corporate bank allows access to most sites, and has the popular ones tiered.

Tier 1 - Financial Times, Washington post, etc - unlimited use

Tier 3 - Twitter, Facebook, gmail, etc - 10 min slots (total 30 min per day)

Tier x - unranked websites - blocked.

Unfortunately, it does require someone to rank all major websites, but it means that productivity is maintained as the staff are directed to leave the page when the time limit is met.

Also, content control is not managed, so there has to be an additional system!!