Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Web 2.0 Users Open a Box of Security Risks

Software-as-a-service can leave a trail of potentially sensitive data on publicly accessible servers on the Web.
Page:

When she can't find the financial information she needs in the system, the vice president asks her assistant to export the raw data from the financials database into a text file and e-mail it to her at a remote meeting. She receives the file, imports the proprietary data into a spreadsheet, massages the numbers and shares the document online with another assistant, who polishes the final product. The presentation is a success, but the process didn't involve Microsoft Office, SharePoint or other IT- approved enterprise-class collaborative tools.

In fact, everything happened out of band. The raw data went to the executive's personal Gmail account, and the new document was created and shared using Google Spreadsheets. Copies of the data now reside on Google's servers.

Google Apps, ThinkFree Office and other hosted Microsoft Office alternatives are gaining in popularity as ad hoc collaboration tools. But such software-as-a-service (SaaS) offerings have few, if any, service-level or security guarantees and can leave a trail of potentially sensitive data on publicly accessible servers on the Web.

The suites of hosted applications, built using Flash, AJAX or other Web 2.0 technologies, deliver a lightweight alternative to Microsoft applications at little or no cost. While far less full-featured than Office, the streamlined SaaS products are faster and easier to use than their bloatware analogs. As a result, the applications are growing in popularity among users. Fifty percent of ThinkFree's 250,000 customers are business users who share growth projections, marketing materials, sales presentations and other documents online. The technology is working its way in through business's back door in much the same way Web mail and instant messaging did.

Users may start using online application suites at home as a fast and easy way to set up collaborations with friends and colleagues in clubs, civic organizations or other groups. It's an easy way to use shared calendars, discussion forums, collaborative workspaces and tools for creating documents, spreadsheets and presentations. Because users need only a Web browser, there's no need to worry about application, file and cross-platform incompatibilities. Using those same, familiar tools in a business context is a natural progression.

Even some business unit managers are jumping on board, viewing these consumer-grade services as a way to reduce chargebacks from IT, says John Pescatore, an analyst at Gartner Inc.

Unfortunately, little thought is given to reliability or security risks. Authentication is typically limited to a user log-in name and password. While data in transit across the Internet is encrypted using Secure Sockets Layer, the services generally don't offer encryption for data at rest on the provider's servers. If something goes wrong, support may be limited. And availability isn't guaranteed (Google offers an uptime guarantee only for its Gmail application as part of its Google Apps Premier Edition subscription). "What if someone hits Google with a denial-of-service attack?" Pescatore asks. If that spreadsheet is inaccessible or takes 10 minutes to load, the user is out of luck.

Page:

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Citrix, Gartner, Google, Microsoft, Salesforce.com, ThinkFree, Virtual Office, VMware

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
Whitepapers
  • Developing an Information Strategy - Strategize, Align, Govern, Execute, and Optimize
    An information strategy defines how a company will use the data it collects to achieve a competitive advantage. It is a comprehensive, constantly evolving plan that encompasses five distinct actions. In this white paper we explore how these five vital actions, as well as the technologies that enable and support them, can help organizations develop an effective and broad-reaching information strategy that drives positive change.
    Learn more »
  • Lower Your IT Costs When You Standardize on Oracle Database 11g
    As business operations become more complex, the demand for change in IT increases, along with the associated risks that must be mitigated. Today’s IT professionals are asked to manage more information and deliver it to their users in a timely manner with ever-increasing quality of service. And in today’s economic climate, IT must also reduce budgets and derive greater value out of existing investments.
    Learn more »
  • Eight threats your antivirus won’t stop - Why you need endpoint security
    News headlines are a constant reminder that malware attacks and data loss are on the rise. High-profile incidents that make big news might seem out of the ordinary. Yet businesses of every size face similar risks in the everyday acts of using digital technology and the Internet for legitimate purposes. This paper outlines eight common threats that traditional antivirus alone won’t stop, and explains how to protect your organisation using endpoint security.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments