Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I see some sites are blocked for IT security at schools, colleges and offices. But, why do some obvious good sites are blocked too?

share|improve this question
8  
Twitter is a knowledge repository? Really? –  Josh Brower Jan 30 '11 at 13:04
1  
@Josh It IS. Depends on who you follow. –  San Feb 8 '11 at 14:26
add comment

5 Answers

up vote 11 down vote accepted

There are all sorts of security risks - the ones I tend to highlight are:

  • The big social networking sites are a wonderful target for attackers. Imagine a group of over a billion users, most of whom are not technically savvy, that all use the same web app (eg Facebook) and have personal data, links to others etc. So take it as read that these sites are continually targeted by well funded attackers and (slightly) more reputable companies who use the functionality of the application to gain significant access to your machine or data (eg Farmville) which may include passwords you may reuse elsewhere.
  • Additionally, the large pool of users accessing the same application means a zero-day in that application will be very rewarding.
  • A company that allows social networking has very little egress control over data - so how can you protect against the leakage of sensitive data? Think of the Wikileaks implications...

Obviously you also have the time-wasting aspect - social networking can be a huge time-sink. One thing to be aware of is that now everyone and their dog has a smart phone, the social networks are available whether or not you allow it on the company network, so the time wasting may still be an issue.

share|improve this answer
    
I almost agree with all of your points. But, I see the challenge in this and I thing we should look for learnings and development in this. What's the role of security if you stay home? You gotta move out, then only you will know the power of your security system. –  San Jan 29 '11 at 11:24
    
I loved your reference to the smart phone now everyone and their dog has a smart phone LOL!! –  San Jan 29 '11 at 11:25
    
@San - I agree. The fun in security is about balancing usability with risk. Locking everything down is inappropriate in all but the most sensitive establishments, but having everything open may destroy your business - so where do you stop? This is why security consultancies exist and why I have a job :-) –  Rory Alsop Jan 29 '11 at 13:49
1  
:-D Your job must be interesting. –  San Jan 29 '11 at 14:31
    
@San - oh yes! Wouldn't want to do anything else. Well, except be a rock god, obviously. –  Rory Alsop Jan 29 '11 at 14:50
add comment

Number 1 - as others have mentioned - is control: you should be working, not playing on facebook, or telling your dog on twitter that you just got yelled at by your boss (for playing on facebook).

Number 2 - is bandwidth. Even if there is plenty of bandwith available, there is no reason to waste it on, well, sites that you shouldnt be using when you're working. And if it's not being used - then they can cut their pipe, and pay less to the ISP...

I think that in most organizations, except for the most secure/paranoid, its not really about security. And in many of those places, there's no Internet at all, anyway...

share|improve this answer
add comment

In short - because you should be working. And, in general, any truly relevant knowledge available via social sites is equally available elsewhere.

share|improve this answer
    
I thought there would be something related to security. –  San Jan 29 '11 at 8:38
4  
@San: availability of your staff. –  user185 Jan 29 '11 at 10:57
1  
@San - Part of Security's job is implementing technical means of enforcing corporate policies as they relate to computer and Internet usage. –  Iszi Feb 6 '11 at 20:03
add comment

Others have pointed out that social sites are loaded with malware and waste people's time. However, there are surely legitimate business uses for social sites like leveraging them for sales and marketing. Therefore organizations need to implement network security technology that enable them to enforce policies that control who has access to which social networks and for what purposes.

share|improve this answer
    
Absolutely - after first understanding what social networking will do for them. So many seem to forget this step and go "Oooo - whizzy new buzzword. Make it so!" which can force the security team into being major blockers (and as a result thoroughly unpopular) –  Rory Alsop Jan 30 '11 at 19:56
add comment

Many of you mentioned time-wastage as a reason for preventing access to social networking websites.

An interesting response to this is a local corporate bank allows access to most sites, and has the popular ones tiered.

Tier 1 - Financial Times, Washington post, etc - unlimited use

Tier 3 - Twitter, Facebook, gmail, etc - 10 min slots (total 30 min per day)

Tier x - unranked websites - blocked.

Unfortunately, it does require someone to rank all major websites, but it means that productivity is maintained as the staff are directed to leave the page when the time limit is met.

Also, content control is not managed, so there has to be an additional system!!

share|improve this answer
    
That's an interesting solution - I haven't seen anywhere else do that but I can see some positives in there. –  Rory Alsop Nov 21 '11 at 16:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.