2008 Security threat report: Social networking

A procrastinator’s paradise or an identity thief’s dream?

Social networking websites like Facebook, Bebo, Orkut,
and MySpace have become phenomenally popular – not
just with teenagers trying to keep in touch and internet-savvy pop groups, but also with hackers interested in stealing information from individuals and companies. So organizations are facing the dual concerns of social networking websites causing productivity issues by distracting employees from their work, and the risk of malware being introduced to the workplace.

Productivity threat

Users openly brag about logging in to their Facebook accounts rather than work. The “I have dossed around on Facebook all day and consequently have done no work” group for instance has more than 220 members. Sophos research into how addictive social networking can become,
showed that one in seven users were logged into their Facebook profile virtually all the time during office hours.

How often employees access Facebook from work:
Once or twice a day --> 37.2%
Up to ten times a day --> 8%
Virtually all the time --> 14.8%
I only access Facebook from home, never at work --> 40%

Identity theft threat

Sophos also conducted research into the dangers of irresponsible behavior on Facebook. Using a fake profile. Sophos was able to discover information about other Facebook users, such as their date of birth, current email address or phone number. Sophos also gained access to further personal facts including employer details, complete resumés and one user even divulged his mother’s maiden name – information often requested by websites in order to retrieve account details.

Giving up so much information about their interests and personal life, along with detailed information about their companies online, is playing into the cybercriminals’ hands. 32 percent of people use the same password for every website they access – if criminals guess it in one place,
they may well be guessing it for the company network too. In order to protect their data and their reputations, organizations need to act quickly to set up guidelines for employees who are posting on these sites.

Do you use the same password for every website you access?:
Yes, all the time --> 32%
I have a few different passwords --> 48%
No, never --> 20%

The social networking sites themselves also need to address the problem. While Facebook has been commended for the strict security options available31, it needs to do more to educate its users on securing profiles, and consider changing its own default settings

Sophos.com