US research body highlights dangers of popular communications technologies
Instant messaging and peer-to-peer file sharing software are now among the highest risks to business users of Windows, according to this year's Sans Top 20 vulnerability report.
Ross Patel, director of threat research at the Sans Institute, a corporate research and education body, said, "We have seen a massive rise in the use of instant messaging." Many businesses have been running instant messaging services as a form of communications rather than as a business tool. As such, he said, they may risk breaching the law.
"Regulation will require financial users to archive instant messaging communications," Patel said. Free instant messaging software generally does not offer auditing capabilities, but businesses can purchase enterprise instant messaging tools that do.
Patel also warned about security in instant messaging software, which is often bolted on, rather than built as an integral party of the instant messaging client, making it less secure.
The other major new security concern raised by the Sans Institute for Windows users was the rise in popularity of peer-to-peer file sharing networks.
Many businesses discourage users from running such software, since file sharing consumes network bandwidth. However, Patel said, "As desktop PCs are not locked down it is very easy to install P2P client software."
Businesses could face a legal liability if end-users share copyright material across their network. Confidential documents can also be copied easily using P2P software. "Unless it is configured properly, any piece of corporate information could be accessed," said Patel.
The Sans Institute's findings were reflected in a report from Forrester Research. "P2P applications are a serious threat to corporate networks because P2P software can potentially make personal and proprietary information public. This can happen in a variety of ways, most commonly when users configure their P2P applications and inadvertently allow personal/corporate folders to be shared," the analyst firm said.
Forrester said enterprise firewalls were not always equipped to handle P2P applications. "Many P2P applications operate on port 80 or are port agile so that blocking a specific port will be impossible," the report said.
Forrester recommended deploying personal firewall software in order to block the P2P software completely.